{ "Event": { "published": true, "date": "2026-06-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-26", "timestamp": 1782518582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "05f175ed-b734-4588-9e52-43a3fe8c9e5c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09d706f-713e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782464975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464975, "uuid": "3c89cc24-bf6e-46da-b87c-4719e48aa48b", "comment": "Malware payload (CoinMiner)", "value": "0da68a55a4752acb0e7dd233294564db", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464975, "uuid": "806c6f07-acb5-4b4d-be7d-9c1843bc5d02", "comment": "Malware payload (CoinMiner)", "value": "001ba935c6d09702e2ca8a41a74daba441f49aa71572a356352b26ca3f9e465a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464975, "uuid": "8393d30c-08a0-405b-9381-3cf5322ee7f5", "comment": "Malware payload (CoinMiner)", "value": "3dbf0c8ca39b05595f1790d1954b6084c34dcf45", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464975, "uuid": "2ef304fb-73ca-4988-80e3-2d527d32bfc8", "comment": "Malware payload (CoinMiner)", "value": "aa7aff4641a2938b997516d3a003ef1d1f2ba658748f7b1f8ecc1b79ecf56487489ea415cc1fb60c31f46165c4d3dab2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464975, "uuid": "84856d85-a1f9-40fe-b558-66f133458090", "value": "T1DE642A0A77608FE4E274C13006F74B96A6FE21A656F24985D33DEE107E9034C6A5FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464975, "uuid": "1aebbd90-87f4-41b8-8949-7ad3b619d1c2", "value": "6144:dorSpWWzrizwImuau1F4AtsZYyvtyq9+JIy50ENIkwlBoOfrEVNmN3:dofKu03vtUSzXUk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782464975, "uuid": "36772dcf-4bc4-4a24-acae-583189fb82e3", "value": 333964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782464975, "uuid": "8c5dad44-ae35-4e4c-ad89-030d6c845598", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464975, "uuid": "c1058e7d-199f-4536-bd9e-90bcd0dc75ce", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c878c19-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479061, "uuid": "bbdf577a-c92b-4409-8c54-57519cb55e7d", "comment": "Malware payload (RustyStealer)", "value": "99809c96a288be22824d5fccbda95ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479061, "uuid": "adcdf7a7-3290-4078-9d9d-6d4b4e525ddc", "comment": "Malware payload (RustyStealer)", "value": "03418b5196affd9519c6eef53f4e0092fab19ac2f9da6ff59e4d0180a40b1c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479061, "uuid": "6e7378e9-2932-4ec8-9f11-87d56948f4e5", "comment": "Malware payload (RustyStealer)", "value": "46fb7ea0e7018fc26168c763bf43d683bc89f3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479061, "uuid": "0edf1889-c4df-4ad5-84b3-1eabe94b2c99", "comment": "Malware payload (RustyStealer)", "value": "dbbabfd0c47b5805badf23880ed7091b81e9204553ccce765c8ae6026bccb94f8a56a2ba54580ccd3cb17a0a14557457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479061, "uuid": "12922731-a494-446c-9b14-03a930d40d02", "value": "T15D167C03FA9582E9C09EC179C71B9233EB72F88D5624B69B1BD44A213F53B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479061, "uuid": "98e2aaa1-d589-4e25-8b76-402cf53ef463", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479061, "uuid": "efccdc6d-09a7-4bb2-b9b5-d205f2c9623c", "value": "49152:/MhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jreFGyFZZt2:/5w3u+vBoTheSioTM8jSFGGZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479061, "uuid": "2c66b03f-821e-45da-800c-d7f69187d795", "value": 4217856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479061, "uuid": "f29e7d08-59c8-458c-ac36-b3b922a66364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479061, "uuid": "ecd3aac5-886f-40e6-a77b-73f82d5a5992", "value": "03418b5196affd9519c6eef53f4e0092fab19ac2f9da6ff59e4d0180a40b1c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fe2b1e-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782486429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486429, "uuid": "12e44ded-4b34-40f8-bd62-f03f9991e1e2", "comment": "Malware payload (Mirai)", "value": "0f0351fb3ea4a6230c5413cabf83d782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486429, "uuid": "5d27e90c-7a91-4944-83e3-29ec860795ec", "comment": "Malware payload (Mirai)", "value": "0415f463a25c257eb5a49db51fe4e0f5abcde0d7d950902ad7d583d6f8bbbaaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486429, "uuid": "ad0bb4ae-eee8-41ec-88c3-17cb0a9f6cca", "comment": "Malware payload (Mirai)", "value": "befbf6fb1b2205cd4055977d79d3b07d61e20f37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486429, "uuid": "7e6d46e0-6624-49ec-af6d-d3237a9155e0", "comment": "Malware payload (Mirai)", "value": "c276598d26f52f3bddaf45a90a3ace3aeebc031d632f7c1fb58bf5ca0c352d918d1bf2463af27cf1ca3de9724f482041", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486429, "uuid": "3fff1fb3-1717-47f8-9857-f811dee5e2dd", "value": "T178C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486429, "uuid": "10dc3658-631d-4a83-a125-7cac1ce61cd5", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPLO:LzhWutxBaORaebXQd+mzBzlkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486429, "uuid": "9bfc5d50-2f98-4b12-8d04-f8f89fe121ed", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486429, "uuid": "d7fb8135-cb9b-49c3-b0cf-0e94a8c5449d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486429, "uuid": "e94a5912-7d7a-49e5-afe2-838084ed21ba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179c8ef0-7126-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782454384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454384, "uuid": "a316d77a-e55a-4d23-850a-aefb4858a581", "comment": "Malware payload", "value": "6b1cdb94f77cf51e0f2ca52d3549d404", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "OtterCookie", "colour": "#6C9508", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454384, "uuid": "27b03577-6c6d-4421-8145-3c4f586e15f0", "comment": "Malware payload", "value": "049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "OtterCookie", "colour": "#6C9508", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454384, "uuid": "439760dd-1cd4-4ed3-b431-64ccc57a84b6", "comment": "Malware payload", "value": "dd1b7f7488826448dc204228ee14dced91b82dd3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "OtterCookie", "colour": "#6C9508", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454384, "uuid": "655f5c16-9936-497c-9480-7ef0d8eb5d63", "comment": "Malware payload", "value": "e59ac33102caa7458df42a0e29627c2b9b9ac7eab1a194fa75146dff77650e970d158ff28c387967dda9f40cca9616fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "OtterCookie", "colour": "#6C9508", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454384, "uuid": "81ab3d94-63d5-4f61-b706-910fc5e849b0", "value": "T13494A62EC5719D3B8A1249DC2AD13F11BC0773E1D149A268368CC269ABCD47DA2DDDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454384, "uuid": "7973ff73-f3e6-4a96-aeaa-9600e3d73d95", "value": "6144:mZ7yf+/wg1IwxS2+YTP92mc2T7bTI/EfQf8LbibAnnEvS4FHT:M7S+YeIgzTV28T7brQf8Lm0EjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454384, "uuid": "e9f0b39c-66ee-4f05-82af-d8bb3a54fbd0", "value": 430388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454384, "uuid": "32deb886-963d-4b2f-a4e2-455b9b1843a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454384, "uuid": "6db96ecc-9202-43b4-a90d-cca76be4d031", "value": "049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff1961e-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782451928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451928, "uuid": "4e287047-ff08-4f56-a908-24cb0645161a", "comment": "Malware payload (ConnectWise)", "value": "9c12f6650505efe9d11e68f2f66cf4ae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451928, "uuid": "2d8b7990-c9a4-47a3-8f3b-49f1562309c4", "comment": "Malware payload (ConnectWise)", "value": "04991975b5e06842040b36f38bf69649874a7279940f9e65752dac627eb479b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451928, "uuid": "a76eb0dd-d674-4c09-8c01-d65270b5280d", "comment": "Malware payload (ConnectWise)", "value": "4159775ac4d9b82ab65b41f355b093c7f2f46a36", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451928, "uuid": "fff67edc-e7d0-470c-9773-e9c7b744cb08", "comment": "Malware payload (ConnectWise)", "value": "950efad2d68104c18ed50d506bfc8c24c4a85b464c901f4fc28375950ff80e949ab7a2c320ee1c2882e23794740295a1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451928, "uuid": "c60c7d05-5049-4f09-8de1-2f1c727694a5", "value": "T1C0646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451928, "uuid": "cf605f9b-f26c-4b1f-a4a4-2cdbdf4ca6b7", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451928, "uuid": "fd82bf9c-12dd-4773-9144-58df0e1e86ac", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9i:R1iw7gryNkSV1hy1Z1u2JLu9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451928, "uuid": "be6f8e23-11f2-476f-b9b5-79035cca1db8", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451928, "uuid": "bf2e7587-45f6-492f-905e-3bcf2e1ae4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451928, "uuid": "143c2a41-c2c2-496b-b895-3b3fc3075c04", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b99e2d-7184-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782495055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495055, "uuid": "7932c028-e05d-4b75-a76f-bb6c8d0c63dc", "comment": "Malware payload", "value": "b182e1f5a7a86f83c1871f8b2b4a5137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495055, "uuid": "e66d4a31-48d0-463a-9ec8-f5944100d97f", "comment": "Malware payload", "value": "079b5572f35d9de8cdfcdd1d0dbdc395753f1c9bcb474f18dac752842f745b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495055, "uuid": "4a4338ce-29ed-492f-8e73-915070a70231", "comment": "Malware payload", "value": "90c6af22c6617ba702467f5e9025a923a16935ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495055, "uuid": "94f63e04-0f50-4aba-9c84-f41acb3e852e", "comment": "Malware payload", "value": "560e8a3dcc1282005ce92e7ad8d5afb127499c88496ed1bf821ce48fda3dd76b7c7dd06572c05123aa90fdec7a1d0cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495055, "uuid": "6d7226f7-a540-4c5f-b6c9-562676b303b7", "value": "T1D4C68C73914238D9E5A88DB4D11026526DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495055, "uuid": "1c78e636-893d-43de-a213-1ae6548600bf", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQE:cqYUQuVDt0TZED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782495055, "uuid": "98c046d5-a83b-4562-9c78-64eef21f5317", "value": 12156928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782495055, "uuid": "f55b980b-415f-4d68-afac-7d07ad7ada8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495055, "uuid": "edb9187d-d0e8-4bfe-abe5-2a552eb684cd", "value": "079b5572f35d9de8cdfcdd1d0dbdc395753f1c9bcb474f18dac752842f745b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72c2743-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479133, "uuid": "0da8938f-7561-48a0-b2b4-dd89c273538a", "comment": "Malware payload (RustyStealer)", "value": "72899882c6cb903c51d2f8f99d8e0d3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479133, "uuid": "d610239c-1dcb-4117-8d06-c3bf3e5f28ae", "comment": "Malware payload (RustyStealer)", "value": "07ff9393c8dfffd7d630ab83682e88118bbd75fff8d6804a1ee45b68c2d5b483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479133, "uuid": "cc1a6600-6cee-4be3-ad50-8da9c14c6855", "comment": "Malware payload (RustyStealer)", "value": "6c268f18a0e9dcc7b3d9b83a2821bbbb38fa5703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479133, "uuid": "14aa99b1-780b-42b1-857e-ac41f113c168", "comment": "Malware payload (RustyStealer)", "value": "7043d33a16eaedebf2be4e33e5937384fe7420dc8022c04579a758d0fe1f1926d1400ae9154ceeef8bef64491ff3e8ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479133, "uuid": "cd03f7e8-49e0-4b4d-9b5c-299be9477603", "value": "T167167C43F6A581F9E45EC078C31A9233FBF2B88D1620B69B1794CB612F57B605B9E314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479133, "uuid": "f25b4416-9673-44bb-97d8-36b8d6fcca01", "value": "49152:rSBYLTMG1PKWkQS+a1hbv5Fs26w5tP5sZ1L5T1ogsLkq4UvfrzMJisWrCtZCuOUx:rBMPvUwba/L5hoxvYZtUuHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479133, "uuid": "bc79ce31-8c6d-42fb-929a-428a73b52276", "value": 4250624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479133, "uuid": "1021b5f6-1f50-40e8-8885-e27466c735b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479133, "uuid": "cf6e8964-4e05-4883-9163-4f793dfcec8c", "value": "07ff9393c8dfffd7d630ab83682e88118bbd75fff8d6804a1ee45b68c2d5b483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4db33e7-7197-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782503154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503154, "uuid": "d7f4b0c9-00aa-4a3b-a482-32e95c81b2aa", "comment": "Malware payload (Mirai)", "value": "ded5d3bcb7f9c8c174881af37c7fb3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503154, "uuid": "3b4bab61-677c-4605-a60f-fd74c5a717b1", "comment": "Malware payload (Mirai)", "value": "08b40c951747b139fafb060bde6c9eebcce49d0502496367edc192679d0ec790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503154, "uuid": "99483878-3d5a-4a81-9069-cd821cfb6bb6", "comment": "Malware payload (Mirai)", "value": "047b1b24adfea46a2d20a5bbf08ea218d6bee937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503154, "uuid": "d1ff44e8-8e73-48c7-b486-906b7d617303", "comment": "Malware payload (Mirai)", "value": "7ad9aea2142361c69e2dd93a14235104dc31692b7c28be1ff8019d6be4f8803a77f241b0b237063eccdf1f73b95cb207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503154, "uuid": "405d4ce4-9715-4019-8b82-b1a9b97f3d45", "value": "T17944941F2E22DF6EF7A9867007B78E30975C36D626E1D680E26CD6105E502CD641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503154, "uuid": "45fd7f52-a964-443e-9877-04104c986f62", "value": "6144:YtaTQfMdO2jBUOCARhGwzBLDaB378/TB3RjL:YtxwGGaB374L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782503154, "uuid": "3ec5faf1-a51d-47aa-851f-13f154ed78bc", "value": 256816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782503154, "uuid": "1e9a10b7-d0af-4f13-8b52-ee8250147235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503154, "uuid": "7516f622-2134-4cc6-b8b8-6753e80e78a5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c447d0fa-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1782452956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452956, "uuid": "16291c53-7123-4b3a-9a64-f6250d03ea1c", "comment": "Malware payload (OverlordRAT)", "value": "9ec06b7c2393c1e082d248443e5a24dc", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452956, "uuid": "b8628776-bf10-482a-976d-5a412a843501", "comment": "Malware payload (OverlordRAT)", "value": "0c627ab6a8d28441c206e17807ded824d2148c3424c6a13bd7455e0c2d2d039d", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452956, "uuid": "af41eade-069c-47a1-a924-e138d790e551", "comment": "Malware payload (OverlordRAT)", "value": "64c71fbb867415af21422a705fde94f5da63f04a", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452956, "uuid": "a630f5d3-7852-4140-8ebc-f72222fed7bc", "comment": "Malware payload (OverlordRAT)", "value": "c6c3436ed50070dc1126f4bab8b78ac973c45f0d192e804c19d33ec0fb623493bb1333bdea6a3f606ec22dcf4d37045d", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452956, "uuid": "9ae3b960-5058-4de5-9556-d3c651460345", "value": "T1F832AC97E443C26F393BEA3BF68D2E61A9469ECBD9CC870250D8822D53F839570056C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452956, "uuid": "c5afb7f6-9272-4d04-ac6c-b48df4f13669", "value": "192:OCwkyM/vfikJCY73M8aiDh53a88ppqVW6Un3+RNa36c+16rEsTBWXBr9WW:OCwSviXuNN4q1m+HaKL6rNmr9WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782452956, "uuid": "28f18414-98ce-4730-bd7b-9f3b5af05bf1", "value": 11354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782452956, "uuid": "6a2f63a1-f799-48ea-94bb-73c765a208a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452956, "uuid": "6f85d2fa-1253-4819-8f58-2e1213e455c8", "value": "09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.filesusr.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a72466-70f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782432257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432257, "uuid": "c4b27149-537d-4436-8a23-725dab9f016e", "comment": "Malware payload (Mirai)", "value": "c3bfa1989e74f3f098327da5fea1816b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432257, "uuid": "f2d9053a-3946-44a0-8bc5-ee3942ccc11c", "comment": "Malware payload (Mirai)", "value": "0d7e6368812054f582aeebc64894770bc09353f074fb26a0281cf79e395f4963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432257, "uuid": "9ca9ebed-562e-41d3-b661-c291edb72be4", "comment": "Malware payload (Mirai)", "value": "9fb82b278450577cf9f67742f710fd41547c429d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432257, "uuid": "6fa76ae4-0342-448c-b0e7-46db818fb02e", "comment": "Malware payload (Mirai)", "value": "bc70500b566b6256dbae9f3364f72ef8fbabc4e8f7b0b2d97c47409a70456b52ba8e36baeb57e8b17c764b9433848b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432257, "uuid": "128246ac-bde3-4704-8e99-0afc1e8d3ddf", "value": "T167C31A52BD429F13C5C321F6FBAE42983B136B7DD7EA3202A924BF5027478DA0E36551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432257, "uuid": "9ccf3770-53b3-4dab-96fb-b4ac6b9549de", "value": "1536:1Ayt0fNKRSYAINxipIrTMTSHIlI6fmY4jQhfdcAya+pPilojZGtO3H+/QK1brW7a:1d0sJVQS64jQN6JnpPikm71PqHvPqG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782432257, "uuid": "86cec96e-3896-4f72-a84b-0a25ae7ad6dd", "value": 120448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782432257, "uuid": "10234f15-99ff-48f7-9b12-c5d1d5a1a58f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432257, "uuid": "de4f8bb7-1aa1-4640-9da2-2c49f7dd8d55", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbc1df6-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782452948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452948, "uuid": "eaddee09-8d35-492c-b93b-7ca355c1f180", "comment": "Malware payload", "value": "d5c6c427a95a91ee691b9cebdf8a56f4", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452948, "uuid": "e7afa9ea-7d99-43f4-9f28-8457c280ed72", "comment": "Malware payload", "value": "0e3317df95f6c236bdb7f7761b1b3c839100c89797f9ae52eedc9daed96f7bbb", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452948, "uuid": "abb41b77-2180-4e74-a26f-28c3af0b58c8", "comment": "Malware payload", "value": "3a90b67112d9d36e2283620d1f0dad966ef8cc8a", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452948, "uuid": "4cf2ee21-89d7-4ae1-a277-1db6c2259592", "comment": "Malware payload", "value": "54f83c9bd32ae50f2d64e3600aff847a63db001c2d46ba097b4be2b8b57f4316cfbe47a1fab79ec732e3fdd27356dc38", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452948, "uuid": "3dbccca1-4358-4947-b4a0-c0aad5bf2b40", "value": "T16D032B538C995E43A878C7A9BF470F6D6F497D4EA4827AFF302E0D867B312605C0D16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452948, "uuid": "83efbcbe-c90c-43e6-ac74-4a2ab2224d7e", "value": "384:+nl241osPjFLjhdlCxJPxncS45sJflFbfhfhfhfhfTZZZZZZZZ61J:6l24lpdCxJZnjWsh3bfhfhfhfhfmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782452948, "uuid": "51a1ddef-48dc-48b7-b536-8495021c1bdd", "value": 40420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782452948, "uuid": "e2b794d4-60bb-4e82-9068-8ff34d44d731", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452948, "uuid": "c02017b2-8498-4650-a669-41edb9babdb6", "value": "invoice-1645080830.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18c127-714b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782470253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470253, "uuid": "401f2e39-39d6-42b4-aa5f-1dc61fd05612", "comment": "Malware payload", "value": "cda75e7f83d122c17fe19fd2cd802b64", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470253, "uuid": "18eefeb0-227a-4c52-b6fd-87fde8b252f6", "comment": "Malware payload", "value": "0e528e9c8d4fb54204d5e2b99a14942d39609bb3ab01711e9a67328661e96c54", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470253, "uuid": "91ed92f3-73d2-414e-ae86-9772055dc7fc", "comment": "Malware payload", "value": "1881bc50d55d96d270ad155b4a080feeeed29ab8", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470253, "uuid": "7550a30b-b0d7-40f3-8846-42e40da1e20e", "comment": "Malware payload", "value": "bdec48838ebf8cce4b73261f681904abc7b0e6a7e85985996ea945a9fa64864624fc775f68d55ab8737fc316cce7ed00", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470253, "uuid": "c8972dcd-0b7d-4e77-b707-ad58d8a28cec", "value": "T1C061DA5C35D6A0A4433EA7F89B1F8125F4278527A5490AD1FCAC90B17FB642092A7EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470253, "uuid": "e8cbc9cd-30e8-4251-9573-194e394b427c", "value": "48:U3Yf0R1rv/muh0UZH0l8dwSiQtEPOVn2VT6jm3rUlBAYg4hqRNCEEx0:EZCuhlul8GSiQqA2VeGy7qG10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782470253, "uuid": "17d2f248-9f6c-48eb-a9a1-f4aaeb3b3ecf", "value": 3471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782470253, "uuid": "9d27fae3-bc26-4154-9174-a9020e4ed012", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470253, "uuid": "2c0889d2-a102-4255-b65a-0a51b2b43a9c", "value": "script2-from-2nd-obf-script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9baa1ac-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "cfc79dd8-5e80-45c4-bdcd-33210ef7b0d3", "comment": "Malware payload (Mirai)", "value": "e14e8c7e1e7dec78e15a09484ab75e80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "b373967a-1110-428b-9dfb-c12e525dac8c", "comment": "Malware payload (Mirai)", "value": "0efe0e8cdfd4aedd949d8201865a6591e4d4d993b21eea8f3ae27af9d5c9d420", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "75a5ab69-8e9f-4f02-893d-318e2293b7fd", "comment": "Malware payload (Mirai)", "value": "4ffba683f2452a139b33c7a0c2a3e4d8ad324b70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "e824d2d5-7534-42f3-8efd-a1f4e34d6ef5", "comment": "Malware payload (Mirai)", "value": "307d65e9a14c7adac29e810da9008b42b869e5cfa101b698ac4a1474ef2a69d485545137a51449e5e6967103e6fc50fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453018, "uuid": "e1858008-5fd9-4db9-ad38-d0c87ff5f150", "value": "T15183F680B942DA1AC7C2177BFE5F018D3725BBDCE2DE3212DC252F9437CA55A0C5A266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453018, "uuid": "10aa54cf-4d2c-4425-bf27-ca793de1895a", "value": "1536:M2hyDlkLAaOSTLqwM4LkKDybbkzRU+QTeEw2etYbJ7yUPy:MBDl+AaOSTLTM4XGXARhE5et8J77y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453018, "uuid": "8e488ca9-d64e-4485-8670-5ef012132501", "value": 81284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453018, "uuid": "5011cb8e-041c-4f0f-82dd-c5cabd2c6136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453018, "uuid": "352e38ca-b268-4334-a9be-9539d3f66132", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a9223c-710f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782444883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782444883, "uuid": "3399cb2a-0011-49fa-9aaf-8a40325d1294", "comment": "Malware payload (RemcosRAT)", "value": "e0e9f907f1d2989ce43c01b0ac3dd729", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782444883, "uuid": "2183939d-aabc-497e-b1ae-fb803d80aa85", "comment": "Malware payload (RemcosRAT)", "value": "0f1463735ee52aca65375ac7ac116cb7980a0be3068360c3cbcce75bdb2c09ae", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782444883, "uuid": "93f0efed-751d-4aaf-bf2c-5b6d2a9fe871", "comment": "Malware payload (RemcosRAT)", "value": "1d82b10861144103fd4aee14a85873b4426e47e5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782444883, "uuid": "9daff8d5-60b4-49c3-ae76-d52183753b52", "comment": "Malware payload (RemcosRAT)", "value": "1e678af6b5cc5f00eac54e71cf0468918e97f52db65509b7c2de69edbee6b6d3f4d2540bc8725933be58e5ce451c878a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782444883, "uuid": "4543f2be-0f2d-43ec-b2fc-e3f637a7c2dd", "value": "T1B1636D71DD14066A0E4B27BDEC90AE61C5BDC266512300F9FFED130D940BAACB7BD64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782444883, "uuid": "7dcea5ce-448f-4233-b34a-04bdf2af6d3b", "value": "1536:R8h2VXL+d9f716iY7oo/NYCmHuZ7wFVIDQ9JTZa:RAiXL+d9f716+RCZu2DUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782444883, "uuid": "cb793874-e04b-404b-b511-51aca668e819", "value": 70403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782444883, "uuid": "15f8404a-96ef-4759-83fd-c07f24043f51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782444883, "uuid": "c3a5f81a-b084-4c87-aa6d-1383323a8ad8", "value": "Stridsskrift.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1b772c-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "90b8a00e-ddf0-472e-b088-0e4e29448ee3", "comment": "Malware payload (Mirai)", "value": "3a969c201d281ebc30764c11c368462c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "841884a3-1f1f-4dd7-9c39-b81d1a35143b", "comment": "Malware payload (Mirai)", "value": "0f7612152769196c7de49c80f5da38e9d339eeacb147c87bd863fc83c6511c93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "287b8984-6b4b-42d0-9bd4-8a1b93d460e8", "comment": "Malware payload (Mirai)", "value": "795b359ed8d31c9c7bb96dada698cebd166303bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "d712c519-9b6a-40cd-b58d-338cd7db10af", "comment": "Malware payload (Mirai)", "value": "3faa600765f1ef34b1c5608d4964dc33861271fbaaf67881875ae0b73f6bda672218d92393c800aa41fdd190de2519f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451897, "uuid": "fee2741d-d5f8-4f69-81cb-e723a9b3cf63", "value": "T11173A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451897, "uuid": "bcff1bee-3f6e-4930-ae79-f652f92d8898", "value": "1536:YZIJO4rSB6xKqzEIBCRIxuF9IJajZvGIyv:LPOB3qzEkxxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451897, "uuid": "d778623d-e382-4919-bc79-7ae2279e12bf", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451897, "uuid": "111262bd-e67f-4586-9cfc-126eb8789443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451897, "uuid": "a3e1ff89-6602-4c03-bce2-938131f7869e", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9b3310-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "b46891df-6c2d-478c-b1a7-0bc9793b1494", "comment": "Malware payload (Mirai)", "value": "fb6bdc33023435e1d0c0e64de382482e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "8731b7bd-175d-4f7c-846d-5ea5907fe14a", "comment": "Malware payload (Mirai)", "value": "1291de78ff8ae14afdf67b55d85d3b9445b6781694e53d5c70c91252a78cb45b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "1fa147e7-5364-4ffb-8154-730c8ca88776", "comment": "Malware payload (Mirai)", "value": "537fc8ac517d091950dcdff71eb3ecebc14a645b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "6ce63622-02e1-4d53-8f26-3238a33fdfa1", "comment": "Malware payload (Mirai)", "value": "a759992040a525682c5cc89e2a429a318929a28c637e6cd000f51e9f661c5dbd40251205e06aaf5954a2185a942af896", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "753b5968-4d51-4fc1-a4d3-282c1ccf5e2e", "value": "T1D2534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "67dec864-a7f0-437f-9de5-29ad0674998c", "value": "1536:LE2dKd40y5tgq28qqPgN8l8MsINprfm7uCciPY:I25q+g6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451899, "uuid": "ddd0985c-49aa-4633-9e73-5bd25f3b69be", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451899, "uuid": "cd3787bf-727f-46ea-851f-3854078323d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "8e1fb3a4-c2ee-4ab2-85eb-fc2f1c10ed53", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e4a6ae-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782458569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458569, "uuid": "3602ed9f-9e17-48d4-affa-1a2b5b285ad7", "comment": "Malware payload (Gh0stRAT)", "value": "d7a5c23c2237da3b7556ae20ca9af66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458569, "uuid": "ad9e73b1-3e74-4712-a707-3676fa3a75e6", "comment": "Malware payload (Gh0stRAT)", "value": "12d72753c1e65457eeccf9957b4501e26397e28379eafc363440f6b81060d5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458569, "uuid": "daf0498b-9b3a-40be-a225-4cd8ff5f4a03", "comment": "Malware payload (Gh0stRAT)", "value": "a8220d744750dad02c1600e34bb90740a0e64ae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458569, "uuid": "2d747a7a-850d-4b7f-bbe8-2d54733d4db4", "comment": "Malware payload (Gh0stRAT)", "value": "91642c4a537e24a39a0aa11713e18f9b9d0623122d8d3d38c797af6cf0874c42ba664c41dd14cb445616d152bc676de7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458569, "uuid": "559e87e8-7ed7-473e-8707-eb0f2feb9983", "value": "T1DDB5D013F28BA13FF06A4A3649B3D222593BBE6169128C6697EC385CCE351D11D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458569, "uuid": "182f4c68-23da-43d1-ab52-162853990959", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458569, "uuid": "7ece19a6-06f7-41eb-86fa-47af7d86d3b1", "value": "49152:exXXm66O7pdgtAi9Goxm2CtEY1UZGpZP/j:exHX74tAzoxmF1/pR/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458569, "uuid": "44099356-ce9b-4d4c-b6c7-94816217580f", "value": 2314668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458569, "uuid": "b882a1c9-ae70-473e-9e23-03c6b1400bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458569, "uuid": "e97b8ac9-b7d1-46e3-9e71-c2ea9c810476", "value": "VPN\u5feb\u8fde\u5b98\u65b9\u5b89\u88c5\u530501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3a3223-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "e2743e62-e87d-4edc-b970-cb8545720ac7", "comment": "Malware payload (Mirai)", "value": "6c31b5ff7e2d7d981f7b1fa6e561cdab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "519318b7-e150-4b05-bdbf-e7e57c4a0722", "comment": "Malware payload (Mirai)", "value": "133e4034fe2866bc551e84daa2541ab75761eb1651c689b0188adeaa2832d95d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "9ae93bd3-12cc-43d7-9d82-fb948a42cf3b", "comment": "Malware payload (Mirai)", "value": "f70bfdb3b0ccc30569918293d01287c1e5604807", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "d3f98997-3b40-426f-b5aa-9b6c61564743", "comment": "Malware payload (Mirai)", "value": "e77511c9d367c8e25285f38bb8c57217a5de7147de4373996b68fb6cabb343641f9812abd4e8c7b1a31d8591c28d1f7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "fcf3cd84-4c53-4e01-b39e-a50b010574a4", "value": "T189430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73078D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "8e5da2f4-ca3a-4619-89a4-4bcf1640760f", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7l1suV27c1hMDHs:Q6ia7du1b27ahq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451899, "uuid": "e880312d-8996-48fd-8f33-74c8c3fe5bac", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451899, "uuid": "9605b902-f6d7-4f96-93b5-75aeca6ff835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "9dc2b9b0-a315-4ccd-b854-df58604cc07d", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e94e57-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782458481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458481, "uuid": "1696cf0d-5fd6-404a-96b6-49c619ca8527", "comment": "Malware payload (Mirai)", "value": "bdfc698eb66e567ef1dbb8c0cd4ed435", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458481, "uuid": "a168724d-6d16-45b7-a2b2-ad6992141394", "comment": "Malware payload (Mirai)", "value": "13629e53f66f45d0a9ca05f01fe78bff4db11476c9cf07033bc578af3f53a146", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458481, "uuid": "18460946-adc2-437b-96b0-029a0cf6d8fd", "comment": "Malware payload (Mirai)", "value": "854c209d740755f518ba5b3cff2e15550e30a358", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458481, "uuid": "f85a4829-7d08-4cc1-bd55-18318ba211bc", "comment": "Malware payload (Mirai)", "value": "e880a283f8489c0a22e522ec28dfc4fc5b7999920ab00e6551e5824c01e7c9b404638c67305e10913ffdb3c13582804c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458481, "uuid": "7a017cba-0054-4cd6-a8aa-40a04b862bf5", "value": "T16466335291AF7FB7A00ED14EF7692EC2620853A23DE9EE009DC5D1894DB50FB80B5673", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458481, "uuid": "cd2a4f6c-30b4-43ac-899a-b7b3ff25b5a9", "value": "196608:xrgQk5Ay1ZGU09gYd4l8F9tMHH+IDY32R:x0QkaQZGV1d4l87tMHkmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458481, "uuid": "2dce953e-44c0-449c-b65f-6c8da7f23e55", "value": 7042196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458481, "uuid": "22b581f9-8e71-4582-825c-feb7d30a8acf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458481, "uuid": "da913f27-3ef2-4cfa-8bc8-18045eaa9874", "value": "apache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26362939-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478890, "uuid": "f7cf48ac-a648-45ae-acb4-705497da9da1", "comment": "Malware payload (RustyStealer)", "value": "3f5b7e07efee987cd75000a6a413fedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478890, "uuid": "74c054ae-c509-4fe8-917c-9dc1da9bcaad", "comment": "Malware payload (RustyStealer)", "value": "137f184f33a0b694139073c3863291667202e58f80078c180de6e2be9c2cc70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478890, "uuid": "7f01bd2b-152f-401d-9cc7-66e35dae2325", "comment": "Malware payload (RustyStealer)", "value": "35dc8c856816cdd20ad2b81335f194076b3261ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478890, "uuid": "766186c3-9231-4468-95a9-7022d084fec5", "comment": "Malware payload (RustyStealer)", "value": "619073624876b736bb0125cd06b364e2c73dad89993302814b6766737160e68e8da1599a92b0ecd21e44ca8ad5320c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478890, "uuid": "07d8bb1b-ee3d-4b39-b980-a58cce3bed54", "value": "T18A167C43F695A1E9C2DEC538C31B5233EBF2B88D0671B69B17964B612F13B681B5E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478890, "uuid": "f445b9fa-6fd7-4c16-820f-ef1dee50d02e", "value": "ac24c75129de769cfd950785b3c3d496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478890, "uuid": "12355757-4b8c-4318-a14d-a763345cf60d", "value": "49152:4HSYxnvUT7lq7Yutzt5ns0W29cW1mI/HL5T1ogsLkqb4yz26ukMGu729+aAKfYfx:4Hzvos4Sn//L5hoqpGd9bARfMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478890, "uuid": "f5d7d158-7628-439b-ad33-86c1ae51a4dc", "value": 4260904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478890, "uuid": "e50bf04c-efef-4148-bb95-0d9e1912b5e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478890, "uuid": "4bd861ed-99cc-48dc-8344-272d0581e521", "value": "137f184f33a0b694139073c3863291667202e58f80078c180de6e2be9c2cc70c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c8b520-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478946, "uuid": "cad2170a-44e8-431d-9f77-bf02ab2ccf96", "comment": "Malware payload (RustyStealer)", "value": "e2847541c512e86bc6514c0bb3677590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478946, "uuid": "30eda2d2-b0a1-4ca4-b2b9-ddaf38edd212", "comment": "Malware payload (RustyStealer)", "value": "13c520eb3e5c494b064ec61139acee1a90555bf56d0a488fcc065b19b7456397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478946, "uuid": "f4c4d982-111c-42e7-88c6-c7467bd52a59", "comment": "Malware payload (RustyStealer)", "value": "dab37328fdbeba23962ad02a24482163e899f7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478946, "uuid": "32943f8b-70a5-490b-a710-a60a878bcb71", "comment": "Malware payload (RustyStealer)", "value": "91e4bf8a522cdc55d776b84d2adfedb3d7536e6922328ca199b80ec48d4b7d028d31b355e0703e45d6618748c4b7c870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478946, "uuid": "ff06888e-23b4-4e1b-aced-151ca448e2c1", "value": "T118167B43F695B1E9C45AC978C31A9223EBF2B88F4630B79B17944B612F53B607B5D308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478946, "uuid": "c1fafd4e-e56b-408c-864f-ded1b3ed462c", "value": "49152:nMhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jreY/qiUysVS:n5w3u+vBoTheSioTM8jSY/q6sVSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478946, "uuid": "db7a435f-e42f-460c-8e6d-eefb8dfa01e0", "value": 4256256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478946, "uuid": "dded5291-0a34-4046-ac7f-fa2058fa840b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478946, "uuid": "1ae8eed6-f6e2-4764-845a-6bc55388d13f", "value": "13c520eb3e5c494b064ec61139acee1a90555bf56d0a488fcc065b19b7456397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6138cf7-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782458542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458542, "uuid": "abd2287d-1741-4ae9-81a2-733b8c607633", "comment": "Malware payload (Mirai)", "value": "82468030fb12e7f381ff81f40cc7f0a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458542, "uuid": "35102145-f176-4e6f-b765-bb8759b077ab", "comment": "Malware payload (Mirai)", "value": "144b159540ccd947e08bf8a9e889156646a5be0a3362c94d9d0d34e068d8d29a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458542, "uuid": "22b63550-cde9-4c5d-93a3-aa654c593be1", "comment": "Malware payload (Mirai)", "value": "90d5eb6565bd27606bd6af55ecea8fefa5eb84e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458542, "uuid": "bb01768d-55a3-4bc1-ad3e-7ab823214502", "comment": "Malware payload (Mirai)", "value": "a039c99a2c952bd24902e658ffed7d763504380767fd09910f29bf9fcf39f58aeca7e4ce3675ac401fc8e048e67f499c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458542, "uuid": "39f17cb0-dc90-4b69-9289-4470251bb30c", "value": "T19B075C07F9A614ADC1E6D530866BD122BE317C84432277FB2654E6302E76FE06B7DB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458542, "uuid": "8161a446-0a0d-448e-ab75-b3f629b71827", "value": "393216:emTt3uHJSIiASp5eEtv13uFnCPwGsuYU+LVVkkC:eUICme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458542, "uuid": "25b64219-37a7-4985-809b-7cf91cda2643", "value": 17191177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458542, "uuid": "b0a07d2b-4d44-46b4-89f6-91d3d223cd3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458542, "uuid": "6f2f4a93-d355-48a5-9f57-19bfe5bce145", "value": "apache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a5c9f8-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782451929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451929, "uuid": "66d4ab3a-2399-4e35-96ad-d49da7750d3a", "comment": "Malware payload (ConnectWise)", "value": "ea6180a2e35c8fd7882ff1c3af005e3e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451929, "uuid": "3adfb7ff-f7c2-45d1-bdf4-368441f02dcc", "comment": "Malware payload (ConnectWise)", "value": "14e719b4d9c7ac721a2f746bb9f25c9808bfa80f42f3f91a9910490ade4da45a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451929, "uuid": "aad76adb-d1f7-40a3-8c66-1d801805b0a8", "comment": "Malware payload (ConnectWise)", "value": "fa61de75ea4aa7f953ce732dc9da26baaa43d03f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451929, "uuid": "9d3aeff2-67c4-4cd2-adea-71dfd50a2f73", "comment": "Malware payload (ConnectWise)", "value": "bd9cee4838a5c7d3fd5a03f6bc457c51af9245b4a6d219bb8d7304ecb1e002da9dddcd06852df0e3442a3ee65fc490cc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451929, "uuid": "36f05c7f-44a3-4c3d-a629-5caa8eaabfd3", "value": "T1ED46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451929, "uuid": "a1363355-d91a-4088-a188-5d8d800ef142", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451929, "uuid": "ad2ed414-2541-46da-88fc-155eae109063", "value": "98304:uzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:uhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451929, "uuid": "a13e26e0-6bb4-4623-b334-3fbd2e1f42e1", "value": 5659088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451929, "uuid": "e2576141-f7f2-49ea-a515-7447dabfaa10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451929, "uuid": "0b3f2f9f-03d9-496a-b3ab-4b2e63743b44", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed7357e-7141-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782466100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466100, "uuid": "48e68d0f-d71f-4385-ac6a-95f4063c0ee9", "comment": "Malware payload (ValleyRAT)", "value": "61fd58a78e2bb56fe2a7e46a561cb79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466100, "uuid": "006caec1-92aa-4ac7-8146-6b52e310c06e", "comment": "Malware payload (ValleyRAT)", "value": "1510cc532b57e79000e7ce51b86809582f11300e118d4769d256c31de753dbad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466100, "uuid": "0ee192dd-f165-4c1f-bc76-88d84f201f0b", "comment": "Malware payload (ValleyRAT)", "value": "81611a9f9cd9e5eddba6b64105b11936faf5b843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466100, "uuid": "8bc7b150-7ae1-409c-ab08-4961cc205141", "comment": "Malware payload (ValleyRAT)", "value": "acfed4714e2f50324bff2427467d9cb2ccfa4eb1dbc76525d75d56fbfab7bd05f079699217e8d072c61c3937deb8035b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466100, "uuid": "6bb73853-815d-4153-b522-0a7c058b8192", "value": "T1D057222B71A5C0A4F2969436CAA386F066336C739F31C6EF749231A4163A9D37D7E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466100, "uuid": "9c17c42d-a587-43d7-8e73-2345989c2c10", "value": "054bbdfe5e6bf637221f33517c66cbc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466100, "uuid": "508aefc4-a190-4c45-8fe9-dc2e149046fc", "value": "393216:DlRrU+uKttEt8lckpKnn9Xz2zOEyrCxFaP4kcfi03BSXENhtD+qF9zt6oW2aS5bI:DlRQiHcfSIuf13BeEHtx1t6oW2p5V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782466100, "uuid": "41ed28a1-3fd4-4319-bf95-e9e27d48adbb", "value": 27419512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782466100, "uuid": "e4ca27c7-dfc8-46e0-8edb-2ff34951bf58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466100, "uuid": "1ded0f23-7ac9-4d90-afab-3b7df477a707", "value": "txwdz264_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7033dabd-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479014, "uuid": "453e5b69-7a3c-42fb-9aa2-2072e295ed48", "comment": "Malware payload (RustyStealer)", "value": "2b30f61bc9c5590780296c198d53da1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479014, "uuid": "9eb5af2f-35fd-48f7-91dc-d4a4f04e9a6c", "comment": "Malware payload (RustyStealer)", "value": "15ad8cf25718fcc8e20cb7f446f284cfb83c09632273487c9ccda77f295dd0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479014, "uuid": "a42403d4-849d-4c03-8b72-0815c36b028d", "comment": "Malware payload (RustyStealer)", "value": "c4ec56559787496634d637b447bdeff5a38fcaee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479014, "uuid": "2f239951-84ff-4c15-a3d8-0a55f1cae9d3", "comment": "Malware payload (RustyStealer)", "value": "112d31b1b898943dc5ba93bcbc7e587f34cbff5a7467379ecb6177e66b75299d542674920911c457ab402788d3a36482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479014, "uuid": "8b972372-528c-446d-bd19-6f826f33465d", "value": "T1B3167C03FAA581E9C09EC179C71B9233EB72F88D5624B69B1BD44A213F57B601F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479014, "uuid": "0aba5632-5f0a-49cf-b379-a3c4bb019fa3", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479014, "uuid": "b60b35a6-f420-4012-b8f3-f4c9d03e2999", "value": "49152:xvlph7vTlpCB/x5KpvmpF0vp2nueeu1ogsLkqa4fJZ5NDuGxIGCdK9orPt1Cugq:xdpFc9DWQueeAoxJJCM9o5Mfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479014, "uuid": "2f24b000-6a5b-4e8f-8515-3150acae1e9d", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479014, "uuid": "b06027c9-b684-4cf5-b2fc-19f21e20d922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479014, "uuid": "ae241220-1fe0-4421-94d1-e11e0f1c6135", "value": "15ad8cf25718fcc8e20cb7f446f284cfb83c09632273487c9ccda77f295dd0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd46ff85-718c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782498497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498497, "uuid": "167f81b3-66c9-4ff2-ab6a-2c534f7cadb2", "comment": "Malware payload", "value": "c6e8402219815e53ce0a6fb04c1c8289", "object_relation": "md5", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498497, "uuid": "a218ea8d-c880-4422-ad0f-7ac7960d4559", "comment": "Malware payload", "value": "15df91e37347dcb779f9d62f9a5655fc05a6834037dca4ff13fcc8dbe92f3453", "object_relation": "sha256", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498497, "uuid": "1bc7e834-99e7-4d9c-a5a6-40d4e89ad6f1", "comment": "Malware payload", "value": "0b31f810e02ee92e6150fd8849256b387054c419", "object_relation": "sha1", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498497, "uuid": "5efdd449-df4a-48df-a7c0-a5cd289f3a24", "comment": "Malware payload", "value": "6ac050e3da596887d850f8a83b0f9d49e5694ef0c7df20e95ecf51eb9950802207a09f09c0411584f0a610afaeea2f7e", "object_relation": "sha3-384", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498497, "uuid": "6cfe8ad1-fb9a-433c-bc18-f069c637aef2", "value": "T1FDE0CDC7470F9DB5AD61C0A60555314897C448179EEE19415F9A7020D5C36DD77891B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498497, "uuid": "b1cb4fa5-f217-4d38-aef1-8f9a9d5eb207", "value": "6:P2ijPeanSHPeanSKZJbvvgi0fQLQh+Ws3KRpr3Smfr3Smfr3SReg282cnmfW12:P2im6KZ0Ucs3KRpm4m4mRT9nD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782498497, "uuid": "bbb006d1-9fb7-4bbd-803a-c726a0880dea", "value": 301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782498497, "uuid": "78f86ea9-1f65-4391-a3a5-8d640c4f0192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498497, "uuid": "8a73e10f-5dcc-4dcf-b224-628fefb17f3d", "value": "sample.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f053245-7166-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782481938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481938, "uuid": "5f8a3699-4b8e-421c-8b1d-d0813aa4da95", "comment": "Malware payload", "value": "b5ab73d2e29f6dbaa28832d277118972", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481938, "uuid": "899982f6-9a82-4a5f-91d4-3a94e18015b3", "comment": "Malware payload", "value": "16158245f27b024524427ea50c65d267ea78f1697fcc3a04a7295ae7ea917a95", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481938, "uuid": "0683643f-7e3c-42ad-a20e-846d01492c90", "comment": "Malware payload", "value": "dbf34773406978cc115b39bb622860f888b059fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481938, "uuid": "d509f0ac-81c6-4045-9fe5-561798671572", "comment": "Malware payload", "value": "58312b94b8e1612c70c008c6c9a0d96e361dd21de272048ee914413a18fa4e2d89803bc85d879665657c455649e672eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481938, "uuid": "9de3d6f3-8e7f-4e71-a831-35c57db9eb67", "value": "T1C3137C6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481938, "uuid": "bf799bdc-6540-45b8-b6de-3e2d2b43f030", "value": "768:jXRWNGxVU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:dlxzco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782481938, "uuid": "54353a3e-3cca-41db-9cb0-037812da35cb", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782481938, "uuid": "3a3f9ffd-e01e-4de5-84b5-73463c033b5c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481938, "uuid": "af5e4a5e-eccd-40a7-adb5-60e879771385", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb456970-7132-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782459893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459893, "uuid": "7eebc9a6-f1fc-4cc3-aecd-e3509f497178", "comment": "Malware payload", "value": "3863cdf738a2c75693181fc136e69ca3", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459893, "uuid": "ff4b8edd-4e31-4958-ab39-bb6b8ba28008", "comment": "Malware payload", "value": "16f52468e62956791e6bfee78ecd848342dae9f1cd3535ececd2a9b027794d26", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459893, "uuid": "fb11ddad-08ba-4bf9-bdba-7a381a1a2bdd", "comment": "Malware payload", "value": "2fa1732089852d4a0ecccae622df90a5e35a28d1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459893, "uuid": "d4c0ffd3-ee09-46a4-8b8f-5caeff24b81e", "comment": "Malware payload", "value": "897e7c30e4ac90c9c4ab3a8858555961fc8590f26333593c0afeccd15210e42ed9e4422430a123e567e586e4aca1c36e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459893, "uuid": "26a15bf5-d39d-477b-9701-c4be8cad04fe", "value": "T103064847BD9248EAC09AB331CCA6515A7B69BC4C0B3227D72E90FA783E727D05C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459893, "uuid": "bee685d2-93d9-44b7-99d6-7f493d6091ce", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459893, "uuid": "2acc812d-793f-4d2d-b909-b6a7b26fe7d6", "value": "49152:bAh+DtFnP80Ttl6Bj3ORjhf6T5OjF79RnIF1m2YfmkIyTtiiYhbls:bFsefjFI6IywiuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459893, "uuid": "8ec95555-6d7d-4f3a-88fe-9a0d76b6d5e1", "value": 3765640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459893, "uuid": "3abdb60e-14b1-4e59-83e5-c6642fa1d515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459893, "uuid": "9cfff60c-1a68-40bd-9e08-6218dee6ff25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2f675a-70fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782437348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437348, "uuid": "6f5c15c3-9d39-4792-afc0-3e518cb2212c", "comment": "Malware payload (Mirai)", "value": "8f80f4d697699c66cf8d204c2481575c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437348, "uuid": "d920be1e-e18b-4fd9-96cb-06b0b72006cd", "comment": "Malware payload (Mirai)", "value": "177ef330e14c0e582da9561e46dc1b5e60183d08a5553a7598c9f4bc9e2f813c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437348, "uuid": "0e3bb946-637d-4c5d-802d-e44254d6b803", "comment": "Malware payload (Mirai)", "value": "08b3e6deae0b607ac5647d5cf23c892331807462", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437348, "uuid": "8bf03f5e-281a-4f96-a54e-7bd55f959401", "comment": "Malware payload (Mirai)", "value": "85ca49fa53b4e9790028cefcc2939dd731942662df9d3a832dbcc1087de957995129f4717fd9467f9da7d4888c683668", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782437348, "uuid": "2a887ddd-65c7-4e9b-87e3-21a99f0ef438", "value": "T19831C9CA23906BF24EECC984791298BC206C09D77E0A8BEC185C08F36F41A92FD59F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782437348, "uuid": "e69c4d81-7003-476d-94fc-75cb942696c4", "value": "24:sBYHBqF5vFBi9qBCHBRBKBdTsqBUBnllB+KB8Pf3BybgByxBMh3BjJlN:gYhGd7lChnadQ6Ydz8RywyHUxjvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782437348, "uuid": "38fedbf7-8a07-434c-8c37-9153ada8df36", "value": 1515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782437348, "uuid": "be6e3b29-1a71-4051-9efb-fc4c2ed3e458", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782437348, "uuid": "4bbb0242-f68d-4edc-9442-46addf1ec382", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f342e0f3-7166-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782482240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782482240, "uuid": "5eec6af8-9f60-45cb-ada1-201b8a97721e", "comment": "Malware payload (MassLogger)", "value": "c8d4249b636837382871b5b6fc918fdb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782482240, "uuid": "fbdb05b6-4423-47fd-a4f4-88f94a58e378", "comment": "Malware payload (MassLogger)", "value": "17de9009053285ca77727759dab38f4947213607ce39e538022b86bdb1fccdc3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782482240, "uuid": "64ac78a1-1f08-4321-b660-bf7706b72f2a", "comment": "Malware payload (MassLogger)", "value": "26010a1af24fca020b8ea92a6de2f189c57b27ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782482240, "uuid": "2e95d38d-0acb-4905-be62-83053803d6b6", "comment": "Malware payload (MassLogger)", "value": "61ecbdae93735932795938ab1701f3bb4e2eebf867a60f35ebc357631975e2dca22172c5dcf48eea62a12661609e63ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782482240, "uuid": "182b3b9c-3679-42f0-8141-f182d7974e89", "value": "T15F96B678ABB9102048B6DDF048791E64544E252EB3DFB82B49B57ECE1B43E51F93B318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782482240, "uuid": "56b9fe6d-821b-4ba5-987b-4e41d6a9e18a", "value": "6144:6QNMy2r82nCepByJlw5pZSuVO95zL8VM9aj7pcle6ej19ZP03+zOlVmHaBBGxZxB:Cw0kg1P/QzCD16zaZXyVYTzxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782482240, "uuid": "07fa93eb-e08d-4794-ad3a-c4af9713b13c", "value": 9315626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782482240, "uuid": "355fa388-a0fa-4244-944c-99442b33566e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782482240, "uuid": "9c613586-f7c2-4d24-97d7-e887cedd78bd", "value": "V-2411BI02A-1303-014-ITP-014_1 APP-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d27c4d-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "63e5f3af-442b-469a-ba5b-e8aca2025129", "comment": "Malware payload (Mirai)", "value": "43e735bcc8ea6be01106f45d6e383e0b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "f87615d0-8520-4c6c-bc49-2d22c354ea95", "comment": "Malware payload (Mirai)", "value": "17f2a8b300b94e9ab78ff48986d9b4f70d9ea8e18210f72acca6451bc256d18a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "782ff849-c169-4f74-a5d3-0b68e9902c49", "comment": "Malware payload (Mirai)", "value": "345ccf5bed3b432102b2950a5d6af1218d34b3c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "125ecc54-a08c-4018-a699-e3bffd224202", "comment": "Malware payload (Mirai)", "value": "767dc91f592d8f3803da140ea6fdcca19cf0ff6cdc1257e660005a08dcde0c176e1d5697811f219ddba37b073db8631c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454008, "uuid": "32c2f429-8f61-48ad-a876-f15b27066508", "value": "T13B74F8113B47EC7FFD6A03744AF78E7477D865A225A1858AE26ABF4D0F250D10E0CAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454008, "uuid": "b333f4f5-3784-433c-a84a-7c33e571a03f", "value": "3072:y9QXEIfoljT6IhEu3tXk0ph7CJDVPRTfdX5zF/Bnjfq/JM4Yn8dDDbIVz3Vp/Hym:eioljT6IhXrPm7TKJcoOVp5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454008, "uuid": "4b4eb446-f914-431a-a83c-d0bd48d67915", "value": 342296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454008, "uuid": "90da278b-094f-4b36-9562-5375018dfb11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454008, "uuid": "37d2540c-5cb0-4fd6-85bf-92d3c7fe69a3", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386fb66f-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "3a05f153-a4c7-4409-83e2-4598fa5f2bf2", "comment": "Malware payload (Mirai)", "value": "8b499b56e88ab701b8209a5955f51c16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "94c8af3c-04b6-4a0e-96ed-ea819c69bb27", "comment": "Malware payload (Mirai)", "value": "188666cc43add2714af082230fa60d4ee1f4c48f55a59fd7ee9e26fbbbd01693", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "792baaa5-8266-448b-becf-d63cffaef45e", "comment": "Malware payload (Mirai)", "value": "c170323db642dcc4f2ce15e77c9b691e237cfe4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "fd98e0e4-db97-460f-831b-60e18e2ecd49", "comment": "Malware payload (Mirai)", "value": "9aab39ccb3ba0ee47bb342beeb9e27733e42911598d6e00eb56aa39030acc7cfcc23c94c33a8bee592e1728cdd3eba9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "3b036a15-a77c-4096-865e-6c53688e4ec7", "value": "T183D3F846BD418F17C6C321F7FBDE42883A166B7DD6EB3103E925AFA037464D60A3A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "7b4b0f25-525c-4da4-9a61-bbaf203f99de", "value": "3072:HaAUQZY34SPKN4F2adK/LV1Kaq/LY3D7:RU2nSCN4F9dK/hIaOiD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493094, "uuid": "a3d96ffb-885f-40f0-824d-08f27cb328b0", "value": 142976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493094, "uuid": "24d13036-9080-4c4f-a651-dc823cac1013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "8624f71c-803e-41c3-bd20-d4badc29dc2a", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b0cc55-7199-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782503937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503937, "uuid": "c86fa565-9db3-4a0f-bebe-d97672419524", "comment": "Malware payload (Mirai)", "value": "41e830222ab135a165a76710c90560d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503937, "uuid": "bbfeefa6-0bf7-42f6-aade-bcdb107b9932", "comment": "Malware payload (Mirai)", "value": "18feb21998dca47116dafc1a73d1873514c23f4d120c8f98282d690c2c061c5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503937, "uuid": "e0286b32-815c-4cc9-9e60-6e2d8a896e07", "comment": "Malware payload (Mirai)", "value": "7c3aea36a85bd108828bf4aa15ef04932a7b74a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503937, "uuid": "47508146-6007-4b75-b8bb-c2b483b1a858", "comment": "Malware payload (Mirai)", "value": "c6b782b3639fe79b90bd695a3adab9cf0c2fa691331c6200270e06c7a7a3f67f2bff5db37063def5f6c94dc1ccf3b666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503937, "uuid": "d81ad22b-2676-4c7a-b2a8-ef4ce32bbb8c", "value": "T1C263021E92ED379ED42DA9FF76FB132C2C80F4C1251206691F798565CA57802EDEE428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503937, "uuid": "cf63252a-d680-41c6-aeed-57cc8ddf3a16", "value": "1536:BlCzKFmFNBRRxFODz9VzLPAtPtUCQLCthQPpwxAp3VFjXWOknJnXSLp:fCzlfxADz7zLo/UCLhByVVlkVSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782503937, "uuid": "92b10e0b-0a6a-4df8-8023-2802d8468de4", "value": 73124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782503937, "uuid": "886d445c-344c-4eb6-9809-04acef70ed46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503937, "uuid": "5c9da076-b737-4a4f-a7a4-5d5d0429bb20", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74f18e2-7128-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782455618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455618, "uuid": "7bb0b815-7cc1-4bb5-b75c-365b10d5b7a3", "comment": "Malware payload", "value": "06e46ffc47043bb6d8e4a2a4ba0d66f1", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455618, "uuid": "82286fed-4ba5-4206-902e-ddf63cb4e485", "comment": "Malware payload", "value": "193b76e37f2040163be121d6b0d44fb444cbd8e2a4c5d29e4ccf4a96ca640277", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455618, "uuid": "b3acd522-44f6-49da-88c9-ce8d2f2cc3af", "comment": "Malware payload", "value": "41aafb4f4f7d37b67c18b458415b3e2f0893b540", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455618, "uuid": "b9bb340d-79b0-4d59-8742-545e0e80c3e3", "comment": "Malware payload", "value": "2ee6d9eddcec57a990b0ca6cd4d9146c7c6b046b9a56ddbf549fe4e21298a9256200741bc81a38f201ba6167941a8491", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782455618, "uuid": "86b3e596-3ad6-4bd2-ac7f-fda0c0893ac1", "value": "T153A523925C79508F06E88ECF391765E3D2AC861025D1FA16AE08E66CB0961D0FF3DFD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782455618, "uuid": "fa480f01-ee92-4fce-a2e9-45f264589cbe", "value": "49152:0z45zUAz45zPr75zDrvrofHrOj4DfrbGg:ONDsvbXGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782455618, "uuid": "9885ca66-76a0-4922-bd40-69a0a2347e14", "value": 2137614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782455618, "uuid": "11df8d7a-b54c-4a7e-b664-7a8912db6333", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782455618, "uuid": "6e45d251-74ec-4fce-9255-3589a7c9879f", "value": "dump-rar5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c936cd8d-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1782452964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452964, "uuid": "dcbca519-bcfc-41f9-a1cd-8da03f98c550", "comment": "Malware payload (OverlordRAT)", "value": "f08971d078304ce98957c50831b0d15f", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452964, "uuid": "3e2fcf31-ef8a-4fac-83f4-b65e21d9b26f", "comment": "Malware payload (OverlordRAT)", "value": "1ad06009560916080ac44a3287f65a8688846f5d48670e058c4f9139b00df98e", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452964, "uuid": "50e216c4-877b-4309-83e2-46b2d89f2f0f", "comment": "Malware payload (OverlordRAT)", "value": "37220a8dbfa25b02180947be633adea41e15d319", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452964, "uuid": "f4413a12-ec34-45e9-9233-760b34302c02", "comment": "Malware payload (OverlordRAT)", "value": "631a230770f8697f4002897289f4928c477c316103141f993aac6a6c4c15d1197f972d395f0bfa06a365405b09485485", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452964, "uuid": "3f1d2d8e-60ec-48a1-8269-ac7089ab583d", "value": "T1544723030E0D2D5D8C3E3368CCAF1A5B569D8F911856D86297D2E6A9FBCBB44307C52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452964, "uuid": "5cb7564e-d656-41e2-b001-091229931432", "value": "49152:JekJQekJiekJRekJUekJIekJNekJ7ekJlekJ+ekJxekJgekJlekJ8ekJaekJ4ekE:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782452964, "uuid": "01a2cc21-a02f-42d1-8835-00dc5c75bf04", "value": 24814344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782452964, "uuid": "537bd584-54ed-44c3-a60a-4e1a878bb5bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452964, "uuid": "ced98881-3d9a-4962-aaeb-f49b3ccbd6c9", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf0bedb-7196-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782502740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502740, "uuid": "ac933a27-54b8-46b2-9d30-43826f04a8c3", "comment": "Malware payload", "value": "60e917482d2571859753fbeb1736373d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502740, "uuid": "b944c4fc-f787-4707-bc9e-8a0ba2219547", "comment": "Malware payload", "value": "1b0027fc3d2a78fcfb4d236e5bb44370a3bd6ea107276c483fbef0daa1687c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502740, "uuid": "08c9bd09-d8df-4898-a189-a2482b284bda", "comment": "Malware payload", "value": "bbb448fb99ccaeb3293ed80f23aac4f550d3425d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502740, "uuid": "1d8cc703-04f5-4076-8257-9077a01dd4bb", "comment": "Malware payload", "value": "14bf5526eb01a4c8d4a82c68c43829a8ec6fd53cc0f14eab8d77bc19754f48605a930f3fa19fce4977b4a3e089579266", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782502740, "uuid": "c0101314-6d6b-4105-9195-e4c7b8256845", "value": "T1D8246B437B878FA3C2246A754AF382389AD937170AA7C4E7C3B95B0167655903C2DFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782502740, "uuid": "9ea13b70-324c-4ac3-90c4-2a7a853f6ed8", "value": "3072:TKS1vXazWUUH9BzUl2YYUZFex1zI4MRusrxScjuM+w1qgb995F2M3iosDnLLcj09:t1vqz+dBzUl2OWzagcjawFBqnLLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782502740, "uuid": "69f1f104-0073-40fb-bc9c-b8698f717f57", "value": 218184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782502740, "uuid": "5476e777-abe4-4457-93c9-13eb09f65640", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782502740, "uuid": "acdac160-f437-488a-8257-23497d5134f3", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704cece5-718f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782499630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499630, "uuid": "3be70737-7219-4f6b-a7e0-71607536c31e", "comment": "Malware payload", "value": "cecac625fd8738c61c3ddf0d0d4b716b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499630, "uuid": "791a0291-d194-4634-a1f8-1580093b4fb0", "comment": "Malware payload", "value": "1b45f9d89cf03c56afa6ec5cce472e4b36680d792a47f728ee30ef993cf16648", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499630, "uuid": "fbb5c708-8480-482a-b41c-cfaeb0ea7242", "comment": "Malware payload", "value": "e281e054f83bdc08db0ec8784d7216884ce7bc18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499630, "uuid": "239abbf8-f226-4811-8f94-069e9e52ef3a", "comment": "Malware payload", "value": "5614d53ba57848fd07783aa09fd4521d00a5b2f969a7ce422a72dce81c2198a52722630b66479e2f1e8b1c6798e60b92", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782499630, "uuid": "0f288be1-788b-4891-8997-10b1144e3bb0", "value": "T159E2D4AA8891DD64C2E5DF2459FE3783B209268FECD3048A1326371D570ECACD1DB25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782499630, "uuid": "db082e10-1811-45aa-a8eb-fe574e9beae7", "value": "384:o8DvSH1Zx9r9DxwSmOJ/bQwxCQhG6JEXscloecOBvQZVgWKPBj1Beoc:osED9L2QtG6iXsclkgzPBj1ooc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782499630, "uuid": "2fa4cf2d-bcbe-4e8b-bf46-f220ca74923a", "value": 31468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782499630, "uuid": "05d50f33-fda0-4ad6-903e-2588c9f95011", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782499630, "uuid": "b279aa31-431b-4e4d-8f4e-a0ec67d59058", "value": "check_bot_m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a41d08-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782511873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511873, "uuid": "f1171ed0-1f73-4119-866b-767140f363a3", "comment": "Malware payload (Gafgyt)", "value": "37bc2c1f2698fbf9747006007a2ee0d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511873, "uuid": "1a3263eb-40e0-46c3-9f30-dadc055c2b12", "comment": "Malware payload (Gafgyt)", "value": "1cdd76661e2b39c39e2e6e52210c5f3bdc14ac0d62857583e4f4cae423ccf960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511873, "uuid": "f1dc3bef-f9c1-4b12-852d-03f991c0ce70", "comment": "Malware payload (Gafgyt)", "value": "3a608105323971eb3f6fda703565513e53b8fe0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511873, "uuid": "299e39f2-6c2e-4c27-a509-7bdef4279211", "comment": "Malware payload (Gafgyt)", "value": "1431bd87435af9e63deaf26d8690d3f905b8da01846d0c45edec821b929be3f1923d03c99df91bc66290d5e0437c2ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511873, "uuid": "d0175a07-bad0-40ae-8f4b-9b762d98ecf8", "value": "T13E932B46F743C6B3C8431BB10297AA690931F97A0A2E9F4AF31D3CF4AB134D97116B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511873, "uuid": "eabc05e8-8131-4395-b8a9-c0d09a51a3a1", "value": "1536:MrOiwR1lgnK1qWuMOWJ+a5MZ/0uVMmubDqg1O6RxPmmq+P0Gz+JwLfvKm:MrURcKthOWJN5MRFeHbFBxPmmJP0Gz+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511873, "uuid": "8a97f412-8008-437c-a01f-f5f47aa30b93", "value": 96605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511873, "uuid": "7419d863-74dd-4fb2-a249-88f4f98d1a37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511873, "uuid": "73127535-0f6b-47fd-982f-146d303db566", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b069593e-7159-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782476545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476545, "uuid": "cc5f8abe-60d8-4355-b4f6-61503ad5681d", "comment": "Malware payload", "value": "afd91a1860e8293d4bd648c950da4ff1", "object_relation": "md5", "Tag": [ { "name": "accdr", "colour": "#D44417", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476545, "uuid": "bb254472-6adb-4eeb-9b7c-be22eb2a301e", "comment": "Malware payload", "value": "1e06e60878e1c91eb02208202727297d723ac29bf69b4fc8d9a80586b97043cb", "object_relation": "sha256", "Tag": [ { "name": "accdr", "colour": "#D44417", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476545, "uuid": "eca14875-bbd6-4e5a-a221-fba8ac73282e", "comment": "Malware payload", "value": "f2380050bcc6e919907eae63bf9bde3c87920634", "object_relation": "sha1", "Tag": [ { "name": "accdr", "colour": "#D44417", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476545, "uuid": "6b0859b8-b276-4ac0-bed1-c5e92d73b29f", "comment": "Malware payload", "value": "09c9f214b6137f5787d210250f36dd160acccf6f0e367b8bdb4d02989eae580f1c9626a0c151aa6e71239e30dc21d76e", "object_relation": "sha3-384", "Tag": [ { "name": "accdr", "colour": "#D44417", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476545, "uuid": "a8ba7d4f-3205-453f-806b-9496d6127fd8", "value": "T12DD5D01467ED3A17E0B7DB794BD58AB6AA32BC90EF47831F2405731E5A70B048DA2371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476545, "uuid": "b9215b79-f0ba-4fe8-a959-960443bcc7b4", "value": "24576:miMo+NVMqTy8sgkW6eTzWAjIuGYaW1uYcnFHh7T8bWX+plEXC:uxtegvTVoYd0l98yjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782476545, "uuid": "d9253bb6-8890-4fa2-b270-331cf82140e3", "value": 2752512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782476545, "uuid": "658d1da9-10bd-415d-b7fb-1bd24454a717", "value": "application/x-msaccess", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476545, "uuid": "6e7c976e-fe83-47ba-8751-fce12ce37523", "value": "CamScanner 19-06-2026 16.49.accdr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05464794-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782486136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486136, "uuid": "ee5e12bd-6dd4-4e97-8237-7ee945909279", "comment": "Malware payload", "value": "7ca47376b4699429c324acb9c371ea9b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486136, "uuid": "60feaf3b-b697-4c33-99b4-f8c2fc7d34e3", "comment": "Malware payload", "value": "1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486136, "uuid": "39daceb8-ce55-4827-87a9-f5515db1b8d3", "comment": "Malware payload", "value": "4a1b1f975499a2fff3668c9527cb5d85144f4930", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486136, "uuid": "214709ba-3e3a-499c-978a-759753b632fa", "comment": "Malware payload", "value": "95e518cf0d95584f1fb25b9e933368e23d1510865f7536e6420dd55f05461c7fa98a7b9b24be3fd2235e61236409a6aa", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486136, "uuid": "9dbd2a32-c986-4960-8cab-e6e12232dcbe", "value": "T123768D367F805AA6C506C935B6379232C2A2B832F7E7818B7955D60B7E37B414E39F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486136, "uuid": "1c2e5a46-be23-4aba-bd4c-6765ba089c71", "value": "109f73cc95228e3eacd82c151b1a5e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486136, "uuid": "fc68f835-4256-490a-a289-a0355c4a45b0", "value": "98304:lNdwN/s9QjmxE6/0i1f0fRM+uh1kecu50qYCIHV1p6x0RxguP0yW:Xdwm+Z6/05ReKcRYVVrFP0yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486136, "uuid": "5a46f94c-81c1-45de-895f-f1b16ce79c38", "value": 7696896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486136, "uuid": "ef3408e3-5ecf-410e-8c0e-327324531431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486136, "uuid": "d32278ec-70d0-453c-9f05-4c8586ae03b4", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b2802f-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782486423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486423, "uuid": "d16d8909-2bda-4b75-aad8-d160d0213143", "comment": "Malware payload (Mirai)", "value": "3620333c05f8d545f78f7374f4a6a370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486423, "uuid": "c09915ea-b10d-4a3f-a5c4-295b1866729b", "comment": "Malware payload (Mirai)", "value": "1f9acbd618b9c829ec705e8bda2441e0fe7e6ae6b8ab7164a6ed6f65af39b60b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486423, "uuid": "ba2c3827-3375-4820-bc50-9bcfd603f7dd", "comment": "Malware payload (Mirai)", "value": "ecbd13969761fa12c553018e5ccc34e627f2d70a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486423, "uuid": "34565132-0dd7-4e97-8811-8e4f0a3b0ca6", "comment": "Malware payload (Mirai)", "value": "c5cf2292aae3da9e3a2b196df425a2358b3c92fb108a74d007a6d1d7968ef2fa0d67798135c8229b322601dc43bf3ba3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486423, "uuid": "8cbce796-9714-4de3-88bd-586c571e223c", "value": "T1C3934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486423, "uuid": "ce3ed774-daeb-4c96-8269-7ad5293677e7", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINSS:XGptyz+VJzB7T9/bLUAx9e/SBJOSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486423, "uuid": "22837da2-86fe-4f8b-a270-ecbeec7fd404", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486423, "uuid": "640ce1c0-704b-476f-9b46-a8ce369c6bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486423, "uuid": "ba6f582c-e359-41ff-9566-678ce471da74", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c223bfad-719d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782505780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505780, "uuid": "e7d156e6-ce35-432e-97ef-b5ff2471cc36", "comment": "Malware payload (Mirai)", "value": "c2b2a4ed97d656b65257df94a7ff16d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505780, "uuid": "c56351a0-5735-4a44-87c4-11a905adcaea", "comment": "Malware payload (Mirai)", "value": "213825dd74de93e765db54061e185ca92e3715775adfe2a604dc5000e31385ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505780, "uuid": "25cc986f-9479-419f-99b2-84cc96b27676", "comment": "Malware payload (Mirai)", "value": "2d89fae3fe2034c800f5e4206933ccaaf35ad23e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505780, "uuid": "fedfff31-bbb9-4494-b562-eb6ed52a1fa6", "comment": "Malware payload (Mirai)", "value": "eec678cb608dadbb69a6b9299a341455f5c718246719faa5ec5a5b9b87dceae4d60926cc2c8fbcc2fcd851ac067c4cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505780, "uuid": "8a18d35b-c41e-4327-89ed-3628a79c3f6e", "value": "T1E2141902771C0E03D1A36EF0263B27E083ABE96118F5A684751EBFC99371DB26545EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505780, "uuid": "394be338-a6b6-49d1-99f3-e5f056ae20d5", "value": "3072:ot06fz3K6sGogqOxrl5i6lI6tBlv2pzKk:ot06r3K6swXxrlQ6lIqBMpzKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782505780, "uuid": "79702bd0-1593-4419-be95-e35073c6a1a6", "value": 192380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782505780, "uuid": "8e300e97-b3cc-414f-b509-48fe551bdfd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505780, "uuid": "255b1cd7-7282-452e-a9e7-573a55a6ee9a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdcdc75-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "6e418de6-2c35-4bb4-9a53-71014ee43e45", "comment": "Malware payload (Mirai)", "value": "f70274a76234a44ec1d45bd3eb9e8712", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "412399fd-e397-46f8-a531-e5d9ab5f6b25", "comment": "Malware payload (Mirai)", "value": "23a6836422cda1e9aeb113f87fb97299eee574202b5cf420145c02241656f401", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "0422064f-6b27-4d99-a893-82c14bd21d52", "comment": "Malware payload (Mirai)", "value": "baae8f0bb68b468318c0f00e71d7f62c58d860fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "c91fd5f0-ab08-4070-9461-7c9f37b352b7", "comment": "Malware payload (Mirai)", "value": "16b4c10cd36d25965efea9b093d5be461e371d7e4c122d98458467e446487c54044d3e3dab20388b02c6a1c38f5cd37a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453022, "uuid": "4f829366-7238-4b4d-850e-9702c8eca90c", "value": "T17B8329267AB42F2BC4DD55FE12F78624F1A53B4D28B4864DBD721D9FBF2058028123B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453022, "uuid": "288b8c2c-5d8a-4af0-8de3-8e9390fa4047", "value": "1536:zku3QhofOwYlJFnk45VUSAs9NwSv0ujJ/0U0w5iLNPhQGxpFha+:wq1fC15VUWNwSvOOIhdxpFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453022, "uuid": "37ae421c-a479-46a8-9e17-ca36dba804b6", "value": 84696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453022, "uuid": "77bc8a8d-86a7-4c6a-b145-86db8f4dc25b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453022, "uuid": "b838751b-4b69-4279-a555-7be09296ad0c", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7aeaa5f-7188-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782496716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496716, "uuid": "c81f14ae-410e-4182-b980-820cc630d7c6", "comment": "Malware payload (ConnectWise)", "value": "5a21fd1d7e2aea4679ae31a7180dd981", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496716, "uuid": "7b2666c9-ff5f-4e57-be28-7bb1a0e7ee57", "comment": "Malware payload (ConnectWise)", "value": "246ec497890d94776ccf6bfb14bd5a3568cde115b72926527841255fa0a44aa7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496716, "uuid": "218045c7-0fd2-4163-af76-e70973211e44", "comment": "Malware payload (ConnectWise)", "value": "e09e707126e8046618e527f8649e16c74708e1d0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496716, "uuid": "760a8dcc-4179-4d0d-9d1e-7c79c1c8c03d", "comment": "Malware payload (ConnectWise)", "value": "8530c1a1dc1c77e2e93d1e7cd0464c278f5af274542cc9c5e23d71bb76d19c57780b195e390cb65f05b07a9e64626c1c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496716, "uuid": "e5bc3a58-6ad8-4fc1-9163-352a84402d51", "value": "T1A611440115403BCD8DD68D66D5D95317D30AA6CE2325F3D62A71A036B40B7A985B6DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496716, "uuid": "4c0218c5-d9a4-4654-b704-b2bf837e5fb3", "value": "24:x3bT8YmHRjyKs90rOkB7KbZtWwxQoyzLCHjyH95nJDl3XZIZ:x33XmHRmK/B+dtpqgjydRb3XZIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782496716, "uuid": "cb263e48-de76-4d0e-9f88-b0ce81af007c", "value": 942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782496716, "uuid": "ab3063dd-7900-4c72-a585-77c5ce0d00a7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496716, "uuid": "6db51f9d-13dd-4912-a28c-dad3cbeadf63", "value": "FileDOC0626-14.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869b61b3-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479051, "uuid": "837b12e6-019c-4d64-83be-a615529ddd67", "comment": "Malware payload (RustyStealer)", "value": "b9c0227f06a438fcb658e96c7b9f3f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479051, "uuid": "32026696-5af3-4fb2-b910-2378a6f8ce4b", "comment": "Malware payload (RustyStealer)", "value": "24afc5bc2d31311861f5d64e776f2524cada58839b07713026e1e751f0919e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479051, "uuid": "036b57a9-7d58-40f3-8aea-47c85fe4d978", "comment": "Malware payload (RustyStealer)", "value": "b3047f02a81ba92ba555b40a4ad440cb6c3cb630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479051, "uuid": "ebc3e437-ed79-4539-ba0b-4c18f70cabd7", "comment": "Malware payload (RustyStealer)", "value": "5db1d80421638e7626414f44fdf3eba7e310b2edfc666346e69baa92e4c9c155026c65db8c55a0a012ccd5d2279f49ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479051, "uuid": "779db40f-7d7c-4ede-9722-82a1bdb4dfb7", "value": "T117166D83F79541E9E0DEC178C79A9223FBF2B88E0620B69B1794CB612F57B605B5D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479051, "uuid": "d4b82a01-43df-4e7d-a413-12a628984e19", "value": "49152:s8nrfSe5TFlW3YaiK5WsgqdDlPx642vCrU7t1ogsLkqtF473dDLzC6Jq27uetmGY:s8nrSq7+dtPgGU7nohkxJj7L/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479051, "uuid": "c95111aa-f42d-4099-93d4-05df0bc12f36", "value": 4254720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479051, "uuid": "84c88079-b9f8-4c3f-8ed8-7b5ca4bca5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479051, "uuid": "c49808db-dced-4913-bd18-a85532f64e97", "value": "24afc5bc2d31311861f5d64e776f2524cada58839b07713026e1e751f0919e96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebaaadd1-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "7d3cca4a-074c-4450-ae2f-5dc5f246d4cf", "comment": "Malware payload (Mirai)", "value": "46dff487b2f04d76a72e4fd97ce6e5b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "481a0547-23c3-4755-beaf-48c655253779", "comment": "Malware payload (Mirai)", "value": "2535e8d976d91a6a453675f103c3cc5e4f2db2a5382a6190a5b3a0af8d688b44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "495f1407-6802-4be5-b6c7-da2f4751a310", "comment": "Malware payload (Mirai)", "value": "ddb3d2dd600fc1da301570e931b5d37cdf4d2da4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453022, "uuid": "cb2ebfce-7ed7-4e03-8438-775a2f5aa102", "comment": "Malware payload (Mirai)", "value": "e058c3293b6e4bf3ddc39adea32eba47d74652a25739f89ece3acbb43368f5edbb39e3ff75e9ceafbbb49724d2e8cb96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453022, "uuid": "f4739d15-de23-42d8-8a03-bd6ef6eae9a6", "value": "T10E631901B7184B47E8B30DF125BB17E0D7EAFD9215A0F288720FFA5841B1DB76845EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453022, "uuid": "b8689469-9140-40fd-ab51-83889e8aba4d", "value": "1536:GBYaEq9i8t2tcC/nwFQDS10u13gPIePXIZ7:GBDEI3LODet1xeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453022, "uuid": "9f3a137d-cd70-4e81-abb3-dbfd1a8559e9", "value": 72644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453022, "uuid": "bd889cfe-378f-41ae-8689-19be4caf36fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453022, "uuid": "088373cf-5cbb-467f-8578-5350a7cb93cd", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3633d200-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "ad7badd7-c3d4-47ff-8947-17ce2bea14ae", "comment": "Malware payload (Mirai)", "value": "e96d4a941432e1dce1b88dd3794417d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "fcb692e1-6934-4beb-8922-9f86a909ea6c", "comment": "Malware payload (Mirai)", "value": "25443e65b3dd483f050b14b82146b59dc284f6b6bffeecc4da4ee81d916c4764", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "7920ceaa-bc55-489b-b9b2-f256668f6f22", "comment": "Malware payload (Mirai)", "value": "4f71149dc865124fdb8d3519a6fc0b3041df17d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "5c44b200-2dc4-484a-9712-ac5405aea683", "comment": "Malware payload (Mirai)", "value": "d456bc1398dc95c0704435fd8462d3d9e45052624b4c97c9a3ef19f8a6d1cbb261451cc5628a65355fc13116a9e1ae42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "a14405e1-9327-4416-81a2-01cdc836c4cc", "value": "T12A342B87F900DF7EFC0BE37244674915B130BF6A18620677F122BDE6AE290D5192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "71cb605a-5b33-4a79-ad1e-6b6c26279885", "value": "3072:wqgVIOAS+iztekrinjxXFvr/pJTMy/ERp6mX6CT0TOiGk6Ex4VdjbiTL/iBGlpG9:wqgVIOboTdOy/gp6mpTKGZExdLaaGKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454006, "uuid": "1cd5f077-b374-4e7f-b43a-0c9a68a189eb", "value": 232184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454006, "uuid": "27fa8f8b-c67f-4265-9e1a-d9aed2f32fbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "2e1242d0-f80a-4131-8bff-773fad1218b6", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad1a9f8-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479139, "uuid": "17ee803b-76ad-4be3-8662-b314a304efdf", "comment": "Malware payload (RustyStealer)", "value": "7ab73b37f2b756a4e49d7a2e77920d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479139, "uuid": "8a8dbd55-3516-4670-b725-38b1a2029677", "comment": "Malware payload (RustyStealer)", "value": "2583bde597de433a2cc59c1f538d6d691fb84aaa82d83aee8625090a20a05d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479139, "uuid": "bab817e4-d42f-41b4-9cc0-041bd3e58171", "comment": "Malware payload (RustyStealer)", "value": "c907db86aa5318b2ec9da9b07315413cfb500835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479139, "uuid": "f60ae143-1c6f-401f-a3e0-4ac628d135d4", "comment": "Malware payload (RustyStealer)", "value": "ceab91534d8df1bcd2c214d8377a91780ce3ecf2127e5865b07df856c8cd9d938c90943b27ababeaa8651a13c4737c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479139, "uuid": "111998f0-6a7a-490a-b515-a07220a9cf34", "value": "T1C5168D03FAA582E9C49EC179C31B9233EB72B88D1624B79B17D44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479139, "uuid": "59036bd6-61b5-49a5-821c-ee9d8febc2f2", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479139, "uuid": "f2c64fd3-601f-4a79-9d01-7070a6b39716", "value": "49152:aSBYLTMG1PKWkQS+a1hbv5Fs26w5tP5sZ1L5T1ogsLkq4UvfrzMJisWrCtZkOKDd:aBMPvUwba/L5hoxvYZt6O/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479139, "uuid": "0b99da0d-7967-47c6-8e34-2878e6edffb8", "value": 4215296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479139, "uuid": "7c007cf3-cdb2-411e-91c3-a9f49056880a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479139, "uuid": "7b44a34e-19a6-4952-9705-f478c055d850", "value": "2583bde597de433a2cc59c1f538d6d691fb84aaa82d83aee8625090a20a05d26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a351b58e-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479100, "uuid": "39e19ec9-6047-4462-8675-4313014da647", "comment": "Malware payload (RustyStealer)", "value": "62ae160c7ed83b5a3941c4bf1b6175b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479100, "uuid": "ace2754c-edc3-4372-a807-0aa4492f2eab", "comment": "Malware payload (RustyStealer)", "value": "25a8eb0db919417573b58dbffb7cd007ceffb808cf21d6cbe82bad80e07f9472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479100, "uuid": "838fed8a-1be3-4edc-b4be-5cbfcc1df05c", "comment": "Malware payload (RustyStealer)", "value": "c839d45e1c603e33eb4637005f2f6951c42d53c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479100, "uuid": "ae33897d-c51a-4cab-9536-1631880fd074", "comment": "Malware payload (RustyStealer)", "value": "d6ef2f7daf20188168a16d1f92e2098adc86f5d80174e4e1965e72a6afb217126137483d19ed134112ea0794331a80b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479100, "uuid": "b5648876-2689-4c5f-8a9f-c0483bc182e9", "value": "T16B168D03FAA581E9C49EC179C31A9233EB72F88D1624B79B1BD44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479100, "uuid": "f41162ff-1f1e-498b-a01a-ddca431318e6", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479100, "uuid": "71b6138f-0c40-440d-9f3c-67089c85598c", "value": "49152:1FXlq7LYMS3+e70b5dsEiFjI53gkqQ5YL5T1ogsLkqZ7Dsp36ZsaH2LmXxAwPKj:1FVq78ACkjraL5hoL69Lex5Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479100, "uuid": "d0ad8b5b-0e95-448c-8ffc-c236585564ba", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479100, "uuid": "e4406779-323a-40ff-ac82-56c41d9f1e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479100, "uuid": "9e73d2f8-e7e1-4025-acc5-9c80b57bba85", "value": "25a8eb0db919417573b58dbffb7cd007ceffb808cf21d6cbe82bad80e07f9472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5bf7bc-7151-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782473025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473025, "uuid": "e0452ea0-0515-4ff0-96d7-14834e2550d1", "comment": "Malware payload", "value": "fca9f484f5d5cc25b1f6ffd796be9cb2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473025, "uuid": "b80a33c0-6ce9-4e04-b55f-24b381830860", "comment": "Malware payload", "value": "25bac861b68882cd7cccc0c20eff42d6ccd3526425f812dd9c4fd5b8fd99f7b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473025, "uuid": "4f6e36d6-cfe6-44d5-ba52-a8019a3b2857", "comment": "Malware payload", "value": "38cbf8ff7ea58ddf261fdd88338a3dd7f376e9f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473025, "uuid": "37c6d3c5-37f6-4f32-bcd7-16ff11362cd2", "comment": "Malware payload", "value": "cb32a3fe768a41cdfb05ca4607923b095c5715832354c601d71415f1e4ae7bdaba899f8b949ab079123daccf78628dcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473025, "uuid": "b8473713-7f95-4755-be70-166c345613ff", "value": "T123357D27B307A13EF99A0A39467BE221893FE7516523CE1BD7F4584CCF269402D3E256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473025, "uuid": "539f3f6a-dda0-4b7a-be22-b079d5f21f80", "value": "6f4caacfae18415bdbdbc3bb40e7c016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473025, "uuid": "0a905f61-3ffb-4ef8-9280-9b2da6014df0", "value": "12288:mmclyccAqS9Dj0RM5XvBv8QpCogPd2ccGFbIPFT5ZUsmykMn:mmclyVIDj02BTy2ccGFbIl5ZUsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782473025, "uuid": "f7042029-0392-491a-bfec-28c1ca4d0056", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782473025, "uuid": "0df04c9d-bbb9-42b0-b4a2-58c941175799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473025, "uuid": "5d04c79b-9665-4b08-b3f4-0a713de8810e", "value": "cpres.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ba891e-7182-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782494242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782494242, "uuid": "0ab5e125-e685-431f-b7b0-05f20f598939", "comment": "Malware payload", "value": "0afe00aa7694327af29efafc15336b82", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782494242, "uuid": "8b189235-2d04-4d70-9ef2-5f1f29fa9da7", "comment": "Malware payload", "value": "25dd129a4822566f38545a37e1120533266fa1a9b895f8605f5b9364744da42c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782494242, "uuid": "50ba14de-16f2-4bdc-81f1-b6a8f3e7a046", "comment": "Malware payload", "value": "ac623da18f3dbbb71364b29b7a8c212e20b46f91", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782494242, "uuid": "e1198446-3dcd-403f-940f-7223ba3ee48e", "comment": "Malware payload", "value": "b0a09dd4193936b3ceefe1440c641e090403a5cccab37d94bae04074ac93f0183d3e871ea5cff975c1ef6ca6747fa572", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782494242, "uuid": "8af2f001-fdc3-4f58-a98c-5fc3f598211d", "value": "T14F31B7172DBBDEB62041059BBF0E9B591E58A439F2B2C0CFCB5AD9E335290C4C008AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782494242, "uuid": "55bfa7aa-5e8f-4bb8-aacd-570726bcb099", "value": "48:XqGuW8Mu2ib1MKxKduw+c8kvEFexAS4XGo8PzsyZ4rb17:XqVxMuaKx/wsxFexyrtp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782494242, "uuid": "ecc313c3-3b6f-4174-93f8-d1beb4ca41d5", "value": 1568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782494242, "uuid": "903162d7-d5e1-48f4-af82-295da63e8633", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782494242, "uuid": "9b1abab5-ead8-46da-ad9b-bb18365a3911", "value": "g3xriil3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f9700d-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782441760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441760, "uuid": "c65e7baa-44b8-42c7-80ad-1f8f6e33e950", "comment": "Malware payload", "value": "df2092c7cd1df83605e7a19728b4d01a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441760, "uuid": "d863c369-5fbb-414e-8aaa-1a77aed10789", "comment": "Malware payload", "value": "264fa7c74ad7573e9cac8be654619b5bea1ab977ce205caaded115dab3b00877", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441760, "uuid": "367b1439-7be6-499a-b146-e3ea70168635", "comment": "Malware payload", "value": "b4e31af3369d60e3ca57f6fc4b3044d2323fcda4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441760, "uuid": "9f78ccbb-674f-456a-876d-e723ffc1a5c9", "comment": "Malware payload", "value": "1bff7e6425ae787bbda6d6701f5f3339de55ec43ec4fb85e236a20b17210a97e5d03abe8c60d73626a7650c67cf782fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441760, "uuid": "775a2971-ae95-4fac-a1fa-5d813dd00964", "value": "T199E28D09F9889E3B09EB566AFA6105FCDB7CD7638E91369EA110EE511F4C90340912FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441760, "uuid": "822ae168-c7cf-47df-a12d-b2ce339bcd2e", "value": "768:0UXvbPHc6PalCM6WMhvtapdy8uhREuAtCDXZ0BTEvtv6hbc1ta8btHMNi0tW:f/PcZMT6y8uhR5GIXZ0BIvtvogjDMgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441760, "uuid": "170867d9-8642-448c-84af-ff618f08e3d1", "value": 33258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441760, "uuid": "38349be0-6916-4453-9add-e4a63778ff14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441760, "uuid": "f5db683a-cdc9-43f9-9066-61deaff1cb55", "value": "ayata.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4764931-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479155, "uuid": "77783aae-796a-4a75-b6e3-875e1eb07bae", "comment": "Malware payload (RustyStealer)", "value": "16016ef97dca920aaf77b7ada30b5f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479155, "uuid": "ba9c8a53-d7cb-457f-8453-dac89979259b", "comment": "Malware payload (RustyStealer)", "value": "293c3f7991ac35535f7ceb88e6175a5a0fcd5f9265564d68ae8a16a9f3c65972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479155, "uuid": "ffab63ca-088b-4a17-abcc-56d2c729bffd", "comment": "Malware payload (RustyStealer)", "value": "1fae7b6d3213b011189bbf53126dbd1a52fa652c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479155, "uuid": "8b7dc5c1-6f49-4468-b40b-ff908925e844", "comment": "Malware payload (RustyStealer)", "value": "e4c45d58c92fdc15704a8430edceb419885dc9160fe1cd9632af034b33c3319fbb300c64002b9fe9bd32236057b06029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479155, "uuid": "c4696e46-c5a3-41fb-b221-8884d115c047", "value": "T1F6167C03F6A581E9C0AEC139C31A9233EB72F88D5624B79B1BD44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479155, "uuid": "9b332de0-62c9-4476-9466-f9d8f1055f98", "value": "3a0e9c8ab7bea5dd191d4fb4e9b75632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479155, "uuid": "27b05753-c96f-4728-9530-ed01148f3b51", "value": "49152:BQTQ/pcussnsRk3BcAOyTMk5khWmAwhSgkSXU+Jf/m+OZ0cBwh5JDpA7weUv/TGp:BQXus3cQKxSXDJYibjvLGb1F0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479155, "uuid": "acb8b9ac-7f0e-4ead-8e5b-1f836b2ad61c", "value": 4204544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479155, "uuid": "e384077c-9963-439c-a861-d14e00a0c23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479155, "uuid": "14a7217f-dda2-4e40-a29a-9f439a814308", "value": "293c3f7991ac35535f7ceb88e6175a5a0fcd5f9265564d68ae8a16a9f3c65972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd0c54-716d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782485009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485009, "uuid": "7797c2bf-7853-4f5d-a896-ae6c27fcb4b5", "comment": "Malware payload", "value": "881e29fae43333f2e9bb8e694d3dc66f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485009, "uuid": "ff54ae9a-6254-409a-b8f2-a59d7ae65c23", "comment": "Malware payload", "value": "2ba4a96cbf7dcb0230d0ff939ae5f257fd915bd780dddfbf0ec262842224c402", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485009, "uuid": "84e663bd-ba4a-44e2-b059-0ec696c461a7", "comment": "Malware payload", "value": "8bff4d7569f700642a38a5b102919e4e603a5fe5", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485009, "uuid": "387943c6-99f8-4f03-90aa-a98653a1f88f", "comment": "Malware payload", "value": "4cf5578b3eb386d9f464209a0199880a1e3bcd128f3f92098746644a6b1dd32f32bc9637ff661dfe3e8910830380f973", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485009, "uuid": "86a0214e-17ff-4d0b-9bc0-35956df882b4", "value": "T1D352D9747F069CF2E2922275C4EBE7B9CB656F5180239BB6BF49E30C7932511294D087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485009, "uuid": "9b59e7a6-27b0-4edb-b34f-565559817e39", "value": "16b98bbffdbf3abe3845056cea1f4281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485009, "uuid": "4119a473-0b2c-46d8-8893-e33fcc277e25", "value": "192:Z/5WDX1nwx1Q87GnbxpyChYzEnH33Ahfqpv1us:t5mXFwx1Q87Gnb2VEnXwI1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782485009, "uuid": "be61a0b6-02d3-4e74-86df-dfb1a1fe0510", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782485009, "uuid": "a56843ec-7318-4429-b397-6b00fc1b927b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485009, "uuid": "d379b0a0-cc3f-43ab-9a85-fe348caca6b0", "value": "HWSignature.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be435f24-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479145, "uuid": "a4749cfe-1522-4d13-b0e6-dc5c9ee226da", "comment": "Malware payload (RustyStealer)", "value": "59484d2abfceb3dcd75485e1b9d85035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479145, "uuid": "439b847a-b4af-408a-8367-3663468a129a", "comment": "Malware payload (RustyStealer)", "value": "2ba8395708412d5c31c1c56e6522b67040f807840948e544f5345e07e312d74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479145, "uuid": "f5e167af-b341-4a10-817a-ac2c37b60d3f", "comment": "Malware payload (RustyStealer)", "value": "ae9708c11cf0b9d9c5343350e68247a4f8484eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479145, "uuid": "ae37f590-d7e2-4f29-99b5-7af47b784725", "comment": "Malware payload (RustyStealer)", "value": "1e1df5b30f465c32bcfab9a65949a7decff947e5155938428da1cf0a3381c75e320b89cb50d6ccef19d3443a14b4f32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479145, "uuid": "5a312969-95a1-4d62-9b25-fa915fd86117", "value": "T1B2167B03FAA582E9D06EC038C71A9223EB72FC9E5620B69B17D44B213F53B606F5D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479145, "uuid": "78cfc902-93b0-413a-9894-7d0ccc52786a", "value": "315a925cc0a0ada517e6aa9a0c34eec0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479145, "uuid": "21f9eef6-fcae-4cb2-9e64-9047a56151ac", "value": "49152:X5XfO1bwW7yiuh2KxCiGb5fftTfGAmjrG43uB9t+GReEvRXcS6BhfurOuTJp5fWG:X5W1pyujDQB3uPtdXOKJPWlqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479145, "uuid": "91dd85f9-7776-489e-b3df-098dfc457210", "value": 4318720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479145, "uuid": "0224e9b3-0822-40d0-bbb5-89706b2fe587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479145, "uuid": "82fc7fcf-1deb-457e-898f-d53ac21da5fd", "value": "2ba8395708412d5c31c1c56e6522b67040f807840948e544f5345e07e312d74f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27b5969-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782441786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441786, "uuid": "32f57328-d72a-4b38-9e5f-df1653fd7fb7", "comment": "Malware payload", "value": "bb36c79ddad21eb443ecc5af95fa06a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441786, "uuid": "c2a55fec-c90b-459c-a95b-fdd3c385bfee", "comment": "Malware payload", "value": "2cb94b38e31e400ea9893391d701a54d597f0a2a6dbbeb316670a753543c8ccb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441786, "uuid": "6c493074-a959-4045-a42e-707e91c6de1a", "comment": "Malware payload", "value": "e9d854d08c10775960f7578dc1d96b4502af1589", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441786, "uuid": "d36da061-04f1-41b7-8bd9-bf562209ec56", "comment": "Malware payload", "value": "2078db11de964d311f11094dfd4a5bad890cf6141a4e577b6b79484e62d9191e7c0509d355d47c3f7131f5c3a884b6da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441786, "uuid": "381ff115-4795-4d55-837b-40055b790047", "value": "T15B338C80F55046F8879F186692BA05A18C6DDDDE82E828ED976C47F43FDFB2E8053178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441786, "uuid": "eb10fa6e-a043-4cc7-b6f0-6c58eb392b0d", "value": "1536:kL+iqV6WTcmSdtHIGWUXJLvkq/EHWNPTX3uOyMbY:4Xe6WT5SdtN9LMq/EHWNPTX3ufME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441786, "uuid": "2b2f16c1-6451-4c9e-9d67-457f998c1316", "value": 53022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441786, "uuid": "e35fa096-f605-4334-badd-958e808965ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441786, "uuid": "5418c9ed-5b0a-45f6-b832-afb0c66d92d6", "value": "usiju.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6f0bf1-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782441781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441781, "uuid": "637a091b-179f-404e-b467-045c68f8009d", "comment": "Malware payload", "value": "40c2bcdaa178ec567ddaaab143722124", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441781, "uuid": "05aa0223-ab18-4d59-8df1-c03db3fd5ae1", "comment": "Malware payload", "value": "2f0843f83bcccd15c17a85be6b20b98f1ff3076f4e81f086a1320dbfd7fbce41", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441781, "uuid": "9abab0bc-c74e-4ff0-b009-70b87f58224b", "comment": "Malware payload", "value": "3fe5c7db596cb65140dd706a7af238f95fe18cb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441781, "uuid": "4ced0ab9-e868-4225-8448-f3fb0a46fa81", "comment": "Malware payload", "value": "796a0cc20f18e7663db3b1c1801c9c892e01e7837274948b196ae36d2aec23cb9abd0d9af830ec7bad087dafde0bf372", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441781, "uuid": "055828dd-385b-4fb4-b986-d5dffb35bfca", "value": "T150E29DDAE1D09EB4A2164D9242A40BF5C5CF0BBB4742FBEEE30826742CE9535C6B4473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441781, "uuid": "55bf8abb-590a-4683-9188-3895af42b786", "value": "768:TEJmb7b+7Kq2UK1/L24tfZwHu6CP0ZPUTF+vAZGJbt8MN10t6:Tn7b+71nC/5tOHnbIFDZ7M//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441781, "uuid": "ff4726da-7b3c-4495-b235-b15797dc7f77", "value": 33178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441781, "uuid": "2ce9530f-9d34-4e2f-880b-e557aa9a24b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441781, "uuid": "8c7d5912-7cef-4a55-bbb0-f660f7d21440", "value": "ufino(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c47c96-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478912, "uuid": "89718885-befe-48f9-89f8-fcdc7ffdf673", "comment": "Malware payload (RustyStealer)", "value": "caefe47322a5aa05ddac7cb67aa274ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478912, "uuid": "b631c7d1-b6f6-424e-8efd-f4edce54216b", "comment": "Malware payload (RustyStealer)", "value": "2f48b8c5b7a6033bad84127f011b9780ddcd2f2bb084846bdf4a06e719f1e719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478912, "uuid": "6a0d00b7-ba1c-4ed2-bcd2-755dd4f2c44b", "comment": "Malware payload (RustyStealer)", "value": "dbc9d5cbd1708da32f8d632e93efd93a45856560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478912, "uuid": "80731061-096f-49bb-a3ec-9a8e061a0031", "comment": "Malware payload (RustyStealer)", "value": "735375535569a0652648971e88228a742b7f0f6309453c0f5627936e16d32087c385819fe4e8f8120a3c398228a1dbf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478912, "uuid": "cd652e6c-8e1b-4da3-a059-f2511b47c330", "value": "T102167D43F6A561E9C45EC038C796B233EBF2B88D1621B6AF37944B612F57B601B5E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478912, "uuid": "7ec9c53e-3039-4fae-9634-636c58687d5d", "value": "ac24c75129de769cfd950785b3c3d496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478912, "uuid": "3760bc50-a084-4ae7-91d6-e0bda19736ac", "value": "49152:qSBYLTMG1PKWkQS+a1hbv5Fs26w5tP5sZ1L5T1ogsLkq4UvfrzMJisWrCtZpGiMl:qBMPvUwba/L5hoxvYZtbGD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478912, "uuid": "b5003752-d969-485a-ab65-6ae45aec0d41", "value": 4259368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478912, "uuid": "e96bb1d0-d7b3-4ac7-a71e-3ede8d454558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478912, "uuid": "0016a7ad-6d2a-427b-ba2d-d6a9ab7d4fdb", "value": "2f48b8c5b7a6033bad84127f011b9780ddcd2f2bb084846bdf4a06e719f1e719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed74815-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478851, "uuid": "4caea1aa-8265-473e-9866-a4a03ee16eb9", "comment": "Malware payload (RustyStealer)", "value": "95f7327a2dd6ad35a7363ac72c0a3472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478851, "uuid": "41c16e61-f9a7-49f5-91a4-896024ce8bd4", "comment": "Malware payload (RustyStealer)", "value": "2f5413d9e5f3f2a1da5dba06b64a362f5a89584e1c4f2a164711d6d63cbe7648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478851, "uuid": "2620cb77-73e8-4a10-b610-ca834ef035df", "comment": "Malware payload (RustyStealer)", "value": "7bd82372c2cd370aa2cfea08fea735f5766f1bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478851, "uuid": "d5c6ca71-cb5c-4feb-82aa-051084e316ad", "comment": "Malware payload (RustyStealer)", "value": "8b51c275b01d6279598f24bdd3c261ecdb88a43b01df564d377b83d4e9143ed0fd315f7c631b3d05f1f238eb7adab861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478851, "uuid": "69e2e69f-7401-411a-8ef3-2ef029d6b070", "value": "T182167C03F79581E9C4AEC139C71A9233EB72F88D1624B79B5BD44A212F53B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478851, "uuid": "da2ce4d0-f98d-4099-bf9a-f4620d4dc548", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478851, "uuid": "7b24a56e-f04f-4fd0-9184-f1bec883f65d", "value": "49152:Tae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uucRZuXLxf:Trcb6qUgJIfQqoKX151cKXLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478851, "uuid": "a943ce7a-45e7-4c40-9271-2553d3fb538e", "value": 4209152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478851, "uuid": "d1706df0-54ca-40e6-8624-3d2e45a158b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478851, "uuid": "ea94217c-b406-456c-9386-34a9ea0ae0eb", "value": "2f5413d9e5f3f2a1da5dba06b64a362f5a89584e1c4f2a164711d6d63cbe7648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f219a46e-719d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782505861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505861, "uuid": "5ce92ab5-c9d9-41d5-bd5b-2176eb6001f2", "comment": "Malware payload (Mirai)", "value": "6bcfb246449885a0d61aec7ef9874045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505861, "uuid": "e9910ccb-5828-45de-b23e-3575f9deddf3", "comment": "Malware payload (Mirai)", "value": "2f96d4220d7c716ef6b0763052f8f8f4ffa296ffb8be68dbed5ea7c02887a8a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505861, "uuid": "51c57de3-a866-43a4-a15c-a607855a1764", "comment": "Malware payload (Mirai)", "value": "eb44005f577d720f088aacbad63049cdea90af6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505861, "uuid": "b4dee4b3-1a56-4816-b4ec-87d6302fc090", "comment": "Malware payload (Mirai)", "value": "51d9d14b4efa040fc66904c3216d0f0f87b05f0c4dec5e6aab93413baa2f7143ddba3248ae3bc38ad4a38357918fc5b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505861, "uuid": "3ca3f255-2801-4f69-9865-5f66a388c318", "value": "T1C0140742BD51AB23C1E232B7FBAE428937196B69D1EB72079C317F5037C68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505861, "uuid": "46e10a4f-55a8-410c-8926-d1813967381f", "value": "3072:KfVG24mHzcm1ZvlqqHPWWf+YRaW+EuAKftNkKFTgbwQ/UF3:KfMWf1ANEuAStNkKtgb1/UF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782505861, "uuid": "97ab4701-11c2-4361-b2d8-085fd931baa8", "value": 204548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782505861, "uuid": "638ffc23-b77b-4cde-b1c5-f123d42503f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505861, "uuid": "2a7ef114-bdf3-48f2-ab07-48e2d9a58966", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811c472e-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479042, "uuid": "137eaddf-e35f-4e5e-80e3-84de5851a6f6", "comment": "Malware payload (RustyStealer)", "value": "8f2c3c4321f23e146343c09cc7101391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479042, "uuid": "85291644-fd2f-4c50-bfa6-1bd735769af2", "comment": "Malware payload (RustyStealer)", "value": "30c6549cbe425b9b1ea6d6613ece63c72546738b06da1f678385756b806a825b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479042, "uuid": "94821462-9fc5-4c2b-9c91-8622d2c2c2c7", "comment": "Malware payload (RustyStealer)", "value": "bbd5bfce055e5d608b4073c755086e2acfada2b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479042, "uuid": "7d74a27b-5405-4c27-979b-94b1a4282bc2", "comment": "Malware payload (RustyStealer)", "value": "91244a8795fc7ec906214dfa64d8de8e8b70aa3d4759c5756b8908d8759f6e1d8525167c6cdfb199909cc5443695326c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479042, "uuid": "1f841b0f-afbd-4d6b-9a8d-0558947fed9d", "value": "T1C0167C03F69581E9C45EC178C72B9233EB72BC8D1625B79B2BD44A212F57B601F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479042, "uuid": "49965bda-7feb-4d2e-9db9-89ba08204c26", "value": "aad400cb4af8da76f0da0ef8d9853f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479042, "uuid": "0706f104-dc49-4549-b3aa-2434f6d6e1cd", "value": "49152:/YqGJaLNcwf/KVVff5ONkVSyGSq0M+PAE1ogsLkqBW7eaok40dKtJoJ7pHFkCJ:/+av8VztvVPAaou1UJS7LkCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479042, "uuid": "2aa7c3b6-0dfe-451d-ada2-e0f76558ed6e", "value": 4180992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479042, "uuid": "067c0c71-3298-4f8f-bb61-5de735de5b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479042, "uuid": "4281d8e0-fd55-423f-9651-b617a9f07cfa", "value": "30c6549cbe425b9b1ea6d6613ece63c72546738b06da1f678385756b806a825b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed14bf3-7111-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782445457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445457, "uuid": "7e87df06-689d-4f22-8cbc-930efd6627dc", "comment": "Malware payload (Joker)", "value": "cafb7391bdc966114b12c08791617e97", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445457, "uuid": "9e5d9d54-4897-406d-95c3-7c4466766446", "comment": "Malware payload (Joker)", "value": "31f3e56bad615b2e749f41a9fc12e7e8689fe57f208e900da6bc1ad9ac28733d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445457, "uuid": "844ccfd0-cefc-4907-91a6-0b8656903bd8", "comment": "Malware payload (Joker)", "value": "db4458ce8a56d0b068177b1c50ab89566c5d1a0c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445457, "uuid": "1bee7317-bcf5-47bf-9fea-f85d5369c331", "comment": "Malware payload (Joker)", "value": "bec30f9bb2a35909a3e3a80c2f8da2fe2378572760bb84850a30fb397aa1378e6c0ab85bfd51b8ec4826dd5840c0df96", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445457, "uuid": "e76cc93f-69e3-4fd9-95f1-f4e0bf2a8152", "value": "T16DE62396F36DE02FC87764734EB6A231019A0C07C583AB67A914734C6AB75D84F9AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445457, "uuid": "2b931568-8923-482c-bda9-0884d81173c6", "value": "393216:VW+XUCq9NAWPWMqXzGxJn4fp6G6wsNLjTAC:VW+XUrROzG34fpKN/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782445457, "uuid": "468ef950-bae4-481e-83a9-cb93de94e075", "value": 14303471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782445457, "uuid": "03b23d39-e1b8-47b7-b974-0ffcf4a8dc9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445457, "uuid": "b88cca3a-1e93-4096-816d-4facc1de375c", "value": "Fresh Space Cleaner_1.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76ad449-712c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782457283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782457283, "uuid": "d26849ee-517f-4954-a597-4d59cf6af5a1", "comment": "Malware payload (Formbook)", "value": "91af45cc9ec31e71e607223d1f5c5a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782457283, "uuid": "4e8655d4-1b50-470f-8df2-08d0affc0a91", "comment": "Malware payload (Formbook)", "value": "33522ec6cd83ae54e6602d1e85de8e01090fe1c134fa33f12f0aaec54dd588b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782457283, "uuid": "8f97d254-c536-4bee-bfc8-90d787e13cb0", "comment": "Malware payload (Formbook)", "value": "efdcdbb382ba807f0f1abde9a5777770c51ae457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782457283, "uuid": "139a742a-db52-4da3-8d02-75a1a8832461", "comment": "Malware payload (Formbook)", "value": "50ecb588436956d5c83b66ec5aefad4d5bf8314e351947ce2b40944e21ca18344ba1e6687e26a2b2fd8f68c48d472a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782457283, "uuid": "359d2749-ae2f-4336-b3b1-c2e3a490b621", "value": "T1B525016855238606E9B53FF01EB1E0B19776BC9AB138C2585FE61DFBB167310BD0036A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782457283, "uuid": "d9197297-1668-4e84-b457-94f46219952b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782457283, "uuid": "66a58a4e-285e-40d9-8910-c98952bd4039", "value": "24576:O78iH2wUD4HeLwSzPbzojM7/5MbuUznq:O72jD4izj0jmWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782457283, "uuid": "d66be3a1-9528-4242-9659-1f7becbba9d4", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782457283, "uuid": "3e1c2ad4-4723-42c6-b190-f1b3e09ccd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782457283, "uuid": "b7710509-9a76-4cf5-ab11-51e7ad994463", "value": "ARIBA_CONTRACT_ADNOC_INVOICE_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cf61d3-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478803, "uuid": "f5a00ea7-0b22-4e2f-8ec1-dad4fbc8db4d", "comment": "Malware payload (RustyStealer)", "value": "ede8ec7dd17d6a4337e9480f32ab3556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478803, "uuid": "9eaad95c-a0c7-4bf2-b510-49443e3c8b3d", "comment": "Malware payload (RustyStealer)", "value": "349a1d1f52f1efb7ca65a9f18c4b5f5a5ac6cb8fea801053d6ee3acd3f8e2b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478803, "uuid": "be91bb0f-c4e1-427c-a84e-1420a389e909", "comment": "Malware payload (RustyStealer)", "value": "b0047f0f91b11915cde2d30dacbce3da53d07282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478803, "uuid": "c7f3967c-2726-4db9-9471-facc0b92da03", "comment": "Malware payload (RustyStealer)", "value": "02f3e94bdd7968bdafb44af0ba1e5528ec1d176b57edbcf17e51d978a1d986459784d87debd75cfd37548e9b6f3f297e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478803, "uuid": "760a9764-f50c-4ca7-bed4-7e3e0a716d90", "value": "T139166B43F695A1E9D0DBC138C7069623EBF2B88E1730B69B5FD44A612F23B605B5D306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478803, "uuid": "f8f76925-32d7-48c7-886a-a3d9d3fe0747", "value": "49152:Vm1+MFSSTgAiV1uZ124Wnko35mhUEx/GjpjmWFkyRwKnWeELfJmqd6K9/+mwXO7F:s1pASTGuJMv1ZkyiKm9we7DErVMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478803, "uuid": "18afadc5-8745-4a99-89cb-13f4f3cf18e4", "value": 4364288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478803, "uuid": "35858f43-ad17-428c-a77a-bdd79e128660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478803, "uuid": "bfdcd649-4b16-451f-95d8-7723f09b863a", "value": "349a1d1f52f1efb7ca65a9f18c4b5f5a5ac6cb8fea801053d6ee3acd3f8e2b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08411e44-717c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782491295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782491295, "uuid": "576ca2cb-a2f4-4330-9118-7d8b2fc104c1", "comment": "Malware payload", "value": "da435b468388da710589e5caf644cbea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782491295, "uuid": "cc4e1694-1581-430e-81de-796296dc46e7", "comment": "Malware payload", "value": "34c8d2216dd1d4e016d8a8fe498dbd4141270b24982e2a5067bf9fe4287c0030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782491295, "uuid": "fcd426e2-6910-4e07-bcc5-e809927257c8", "comment": "Malware payload", "value": "029a4efb3265acd7cac8405eb60cb5c1b5c9dfc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782491295, "uuid": "27c36836-e827-41e4-b83c-8ecd5441b34b", "comment": "Malware payload", "value": "4764806fa714b63d43e606a250ee48dcb063407cf7684b76eddb8496384e6aa6ef5db23098080874cf62390d9bcbff8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782491295, "uuid": "2b94a526-51fe-4ce9-92c4-86e7e1354ea9", "value": "T15703F1946FB047CBC985AC3E0E9C2739E7B95602BB01503183E45229D773CD2E6B73A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782491295, "uuid": "8079ee6a-4c5f-4eb9-9d09-be7363d48e1d", "value": "768:GfI4zlmuIruFUZ+47HU49oc2UIFCPI1St0MLjcHVXIbJ3GA:ABEZ57049bI8PGQDLoVXIkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782491295, "uuid": "ab9ecffe-b4f3-4496-a3c7-6354ba85ced8", "value": 41216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782491295, "uuid": "2ff1db7b-f682-43e6-bc93-70cf520f69c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782491295, "uuid": "21a6f1f5-4a51-4195-8fc3-bfe057471fb3", "value": "34c8d2216dd1d4e016d8a8fe498dbd4141270b24982e2a5067bf9fe4287c0030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1e5c26-716d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782484889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782484889, "uuid": "6ec75d64-a518-409f-a9b7-93a7f3d0b2c7", "comment": "Malware payload", "value": "bc0bd602efb363a4b218f1a267f1eb6e", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782484889, "uuid": "e0cd4a45-2956-4573-b172-778f46139bde", "comment": "Malware payload", "value": "36c3dc54b916de228ece4cff973790a2e1fa46b3bb6ce2f6660087d6dabe3ad4", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782484889, "uuid": "09861897-397a-4611-b138-7f38560b01bc", "comment": "Malware payload", "value": "5d31cb99880fc9d8637870f9ea153e70ff9a378f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782484889, "uuid": "75fa8dc5-acb3-477e-a9cd-666c3e1d391a", "comment": "Malware payload", "value": "76239e9a47d6ee326a870d8ed91ab94322a589bdfd19f921ca733e39b6c8b5214441abaac14af9c506f0f25b3cb67293", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782484889, "uuid": "b08edf07-be32-470b-bb39-a263aff7e01b", "value": "T1BD163382AEC5D40E116FBFB8C97C8458B1B64FE3F8246FD2B5D8AC4359652C0829F54E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782484889, "uuid": "96aaee5b-a676-4821-8bb0-326590840898", "value": "98304:1pIAM7DFQkFSt63kLzzyFmmWnj7Gtpxorcj6Tq4xt8EYW9a:XI73FQdpXjmWnAu+EXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782484889, "uuid": "48bb4813-dbad-4cb1-a2c8-643bc3e333d8", "value": 4222006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782484889, "uuid": "707a25e8-d69a-481f-bf7f-fb406cb42611", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782484889, "uuid": "4d1e4639-2ba5-4b2d-b05b-a10919c5c374", "value": "Kugo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1981ffff-7155-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1782474573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782474573, "uuid": "f0a17e04-b1b2-4802-8624-c641a02476a1", "comment": "Malware payload (DonutLoader)", "value": "5a1114422b974e5d4c97b491868faf74", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782474573, "uuid": "98694e76-09d2-43a5-8ce5-6a0f205f3d60", "comment": "Malware payload (DonutLoader)", "value": "380cf253f18e3252376af4fb872f5c2f7ba9364e6b46af551069413258f27cc1", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782474573, "uuid": "a846acb5-f561-4123-975c-298434c77984", "comment": "Malware payload (DonutLoader)", "value": "6543e53359ee3d9118b5ce8f6185b06b4c3c34d2", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782474573, "uuid": "62a4b405-daa3-404b-8043-193c8fd4d945", "comment": "Malware payload (DonutLoader)", "value": "394da92318f969281b1282425ed5d69aae66381481b4b8bbd0beb4c03801d90868141f554c36daf179cc25a8b55a8d8c", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782474573, "uuid": "e4953437-a21d-4946-a4ab-08bc73614868", "value": "T157B1FC0D60BDF5349473D66AA663DD1CFF610A2F9418784E352CC8984F36AE681B0BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782474573, "uuid": "ef7204fb-0160-46e6-b203-321056f3e6bd", "value": "96:IiqgdKDuVtnOOmg68vZ8lRvNRIDkQD2dp:PFdKSVpmgpvc/RHnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782474573, "uuid": "1c5cc921-aebb-4ed7-9909-669bb30ed40e", "value": 5237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782474573, "uuid": "c51ef490-e3c7-45de-8556-dc031643a413", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782474573, "uuid": "d6f914b7-dfef-42d2-998a-b0d7478826e6", "value": "Project Details Including Budget, Salaries, and Online Contracts A1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b379f0-710b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443083, "uuid": "1ef919d6-2d56-47b9-b638-bb66f8fe9965", "comment": "Malware payload", "value": "55646cdc254c87deaef063f6517b958e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443083, "uuid": "77f8f55e-8e9c-4bcb-90f0-07544eca31c6", "comment": "Malware payload", "value": "3812545eca0c896401373dacca7a570711671c7d4eb969e4cc544c56c2faf1cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443083, "uuid": "1faa5e76-3950-494c-93eb-66e1cd9ea749", "comment": "Malware payload", "value": "1decfd27fcbc72d2a1adf76a9a03252ad8d2be45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443083, "uuid": "e7016b66-9aff-41cc-982f-689824c07d0e", "comment": "Malware payload", "value": "fd068c05b0843a4243d441e3e25c9388eca4127d67fba670e287fc36fe5b7cd62fc0987db281187b270f8cd66c240196", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443083, "uuid": "ba3be8dd-784b-4d15-a112-f00cc09f3bec", "value": "T128E25D32D76225381BD94F6244B74AE2DE8C88220DCD7E8BDA11791C1EE5839CDE99F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443083, "uuid": "efdb1234-a320-49cc-b54d-b43f9ed1a617", "value": "768:uIs7APlB/dnL1y3OIEZc0pE/QT3nvXbK4p7zV0a2NiylWM1c5hyb:c+/dnL1na/Qjj/p7zV0WByc5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443083, "uuid": "192b567a-dc91-4c0c-8287-ca18fabc2572", "value": 33368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443083, "uuid": "522bc591-633b-47bc-803c-00598c10c3d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443083, "uuid": "8acec749-ecaf-4ec0-ae6d-a83a2a5f4980", "value": "upene.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ec2b12-71a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782507152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507152, "uuid": "69482c3f-b9a3-47ea-9f23-520b56a0d5d2", "comment": "Malware payload (RustyStealer)", "value": "c4e5c36f5582c01dbccb562393f6ba26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507152, "uuid": "56325aa7-9bc2-4663-83ec-04edf879b22a", "comment": "Malware payload (RustyStealer)", "value": "39fec39c77cc6e2ba2c37b15485d7b7e6ec51f7aea047865adc414f52422529e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507152, "uuid": "e57cecc5-90bf-4060-b925-caf7cb69fd75", "comment": "Malware payload (RustyStealer)", "value": "83cb48f03b5f2c2f4135d5be936f8eb40bb03ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507152, "uuid": "4cc255a9-a1e4-4aef-8e72-aede92af160b", "comment": "Malware payload (RustyStealer)", "value": "7d906e5036658e2bfcc8f78defab78f34675793f2111759d0dc8fa3a646497455d758db82cae6459dc9f9afe179ab3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507152, "uuid": "3ac74efc-43d3-4a2d-89b6-fe7e918d5cb0", "value": "T195663947E1A290ECC06AC17C831BA633F631B8498534FAAB5BD4CB312E75F506B5DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507152, "uuid": "5ab89d5e-8a0c-42ce-9a1d-9e8fe3aadac5", "value": "9e19b5d9beb246a4b37cb8d4ae8a43f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507152, "uuid": "3c15cd86-2244-4748-8da3-3cc655f10ea3", "value": "98304:BeHSA1xtkOQPL+dBiRU4jlFwcAyKL1vCRAM/TG+I0:Be29zbFkyACdGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782507152, "uuid": "3761a515-30b1-4e92-8787-5f22796f6042", "value": 6486016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782507152, "uuid": "7f869b1c-4cdc-4714-be5b-d864177d08e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507152, "uuid": "a6e07e21-2fa0-4c7c-b75c-0fa1fd4b240b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deccab44-718a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782497668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497668, "uuid": "161924be-5344-49c3-a07a-e1247d9c679c", "comment": "Malware payload", "value": "59269a5f9ec13878d9f060ff0d7ae647", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497668, "uuid": "ade4770a-6284-412d-9969-0fa88c75439d", "comment": "Malware payload", "value": "3c54bcae35db1c091af07cb1fee2040430b26b1c7f2d28a3b176e211ba43ea02", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497668, "uuid": "6ea1b5c1-2782-4d1a-9e95-6079de635f09", "comment": "Malware payload", "value": "7bf9bc5986c7689aaba4b247a67524c5c05b80fa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497668, "uuid": "5ca2e4f3-4b92-457e-a967-e97cdf5d0142", "comment": "Malware payload", "value": "a4bbd6075031d89d3269ea13ddc992cdded30c1f000167cb2f32e8a35a96889a4f25527943244a83da55f63eb614e0e6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497668, "uuid": "d40718da-2022-4db6-935b-a49776c6ecee", "value": "T19FD022AA0025CD2B578BC1F48320129C89BBD3125EB0D87AC760CC0882849E26313EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497668, "uuid": "bdfce2a6-e849-4652-929b-b51f158f91e7", "value": "6:j+K13NqcN7fBNLfdMGFlIPRFM1ERHSr1ERcWAf1wUs:KK1YcN1VfdMGWI1T1j19s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782497668, "uuid": "16c73d80-b09c-4d27-9db9-d49835d1ba8f", "value": 213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782497668, "uuid": "d4c9023d-b780-4ad9-8590-9fc81be6fbda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497668, "uuid": "5619f80d-1781-45b6-bc32-20c1494e3c34", "value": "runnerr.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7534dc-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479113, "uuid": "35013078-ed9f-4894-9719-688462d97f81", "comment": "Malware payload (RustyStealer)", "value": "a81286deb2b5c60f5a68558e74428b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479113, "uuid": "79c5675b-d625-4a74-a4ce-a34c79b6209b", "comment": "Malware payload (RustyStealer)", "value": "3c8e0dbb19cfdf11cb4055e62cca3037bc659a25eba9b9fcfd440563053eaf83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479113, "uuid": "84997950-d4d0-4ee3-94dd-a92569f4e29a", "comment": "Malware payload (RustyStealer)", "value": "e7920347c5eb5ed342858d10c75d1e2132547f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479113, "uuid": "80d95201-6fc9-467f-b457-b8c04e4ec51e", "comment": "Malware payload (RustyStealer)", "value": "31bf11f31154c0217103b3e2564fe49976b40a270b42f527adca30baef6097769ea9112d5409d5a5c27a496b9dbda159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479113, "uuid": "ef003ded-7957-4b93-940b-addffc091b9b", "value": "T190167C43F69541E9F05AC138C39A9233EBFEBC8D1620B69B1796CB612F53B601B5E305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479113, "uuid": "179383a9-2de7-4cdd-8447-c3279badfb2f", "value": "49152:Kae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uJ8hI1sDtf:Krcb6qUgJIfQqoKX15W8isDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479113, "uuid": "bf606629-082a-4518-8248-70fc56c08f55", "value": 4246528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479113, "uuid": "167eb4bd-601c-4193-b17b-c595f1aac6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479113, "uuid": "427cedee-94b9-45b0-bc5c-95dece6bf666", "value": "3c8e0dbb19cfdf11cb4055e62cca3037bc659a25eba9b9fcfd440563053eaf83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752910f7-7111-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782445521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445521, "uuid": "8df00a25-018a-4d14-9f39-000a6e7a368f", "comment": "Malware payload (Joker)", "value": "910c8410c7212c8ccb8a0e4ae6f7045b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445521, "uuid": "d69fdce8-49c4-4c7f-b765-b9b2612efa5a", "comment": "Malware payload (Joker)", "value": "3cc6e6617c1664c600a11cd855bc3e58e63d7d2a47e9dd0c3159fda856aa4b04", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445521, "uuid": "7aaff25f-fc7f-41a7-919d-d14a74eb55c4", "comment": "Malware payload (Joker)", "value": "7af46c0388479eaa1fd034a205b006f7d5e31de7", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445521, "uuid": "fa07c52a-76e5-412f-a880-7cedb1418090", "comment": "Malware payload (Joker)", "value": "eab23f9ab5633b3dd5c2f2061eb4ca6e0a8721f739193ffafe91f3c8c9da63888408a4d03e5e52af10987343b578f893", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445521, "uuid": "b445acf5-3599-447b-be47-c4c18b114ce7", "value": "T16376129AE308902FE97710326DBA122202571C57D983DF43A5A5720C2EB7B945FBEFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445521, "uuid": "9371f997-537a-433d-8fb4-4f0f7d6be441", "value": "196608:c9W5AupzrAUueFp+3WC9pmXVdGY2S5EC9hX2AB:c9W5AupseFeTfcrGhKXX2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782445521, "uuid": "47af49a8-2c36-4a17-99ac-9f2310782df7", "value": 7610820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782445521, "uuid": "435db3ce-2917-4050-9481-0914b5db9714", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445521, "uuid": "3ae911fb-f761-4c85-a0f3-f122f6edf106", "value": "com.veilshort.ziadrama_1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7599ce2-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479106, "uuid": "e1a3ce49-20f6-4339-85df-d4e6eb57779d", "comment": "Malware payload (RustyStealer)", "value": "831fe85e5e12493e8fbb6728944190b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479106, "uuid": "67f9bc4f-cc00-4795-809d-13da2042d2d2", "comment": "Malware payload (RustyStealer)", "value": "3ffb231b8bdf8f56bc6d2e378ac0c37bad91cabded0d95a732855651e936e12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479106, "uuid": "f1cf968d-ac37-402d-a752-b4a901d4b362", "comment": "Malware payload (RustyStealer)", "value": "d667abbdb29226439ecd6d3534d5c542aee167f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479106, "uuid": "a1b24486-008d-4e1a-b944-7ca0c86ebe81", "comment": "Malware payload (RustyStealer)", "value": "af555e6f8c00d95acd36f488991c1419b7c1a8e8bbbbbe5905a8b2b190e4d50f3d1c9dd4d45432afd641ae8a75a09ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479106, "uuid": "367bf5b0-7d15-4e4c-9a07-5b18177b89de", "value": "T187167D47F6F543E9E45EC139C71A9223EBF2B88D2621769B1794CB612F13B601B9E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479106, "uuid": "5047e13a-0639-41cc-8ec6-835c50b43024", "value": "49152:s+eFIHlV9Bm51YpKX5sjTdcUlwRfQU1ogsLkqTUhs6UD9MKup5u1ytZ3UvIf:sTIHrIsdhIfQqoKX15uyzUvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479106, "uuid": "3a407927-0933-4c67-8547-49c8070ef908", "value": 4247040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479106, "uuid": "eff4298e-8327-4431-97e6-1b8dc7c19e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479106, "uuid": "470d21ff-8cb9-464d-9614-f990bdac5b82", "value": "3ffb231b8bdf8f56bc6d2e378ac0c37bad91cabded0d95a732855651e936e12c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2dfbf2-7136-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782461614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461614, "uuid": "86baae5e-d0e0-483e-b174-85d6d0253c02", "comment": "Malware payload (RemcosRAT)", "value": "8bede2faed3435a1fb7b59cbfe7ca3e7", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461614, "uuid": "1aea499d-f2f5-4bc1-93ef-d9eca18e1cd5", "comment": "Malware payload (RemcosRAT)", "value": "405ef24e22c3dd939e0e1df0f2a0a0a66dbea9c7d8b0c4fa58fe76fad8764ef8", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461614, "uuid": "d01838c8-fe32-4d86-b8e8-e25c99aef858", "comment": "Malware payload (RemcosRAT)", "value": "e2fa30cf56e345106be176303c25f8fbdf6ab1b7", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461614, "uuid": "71bd2152-a145-4dd7-900f-70825f355855", "comment": "Malware payload (RemcosRAT)", "value": "79e096559246ae641f2030a3e82008dd71d334e7c9b174705e30c506b32e2819aec58b8765bb0a630ad9cd40ff68059b", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461614, "uuid": "033a3cca-1597-40d3-a9b6-090436e1b9fe", "value": "T1A3E48D76D50FBE972B192B88D4182D81FE7C09D3832A5B68AC4858D333DDC535B6E4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461614, "uuid": "69ae200b-c688-4651-a211-c5b6efb238fd", "value": "12288:varP4cvC9cLGl/SiXfbcsw+1bO9XbnhzRXXDtHr/Ymrwbe4YYtX:SrPDvEa+aejcs3ybdRXXWm7CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782461614, "uuid": "a3d2f855-8631-4267-832b-2e9b5969e20e", "value": 657658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782461614, "uuid": "6270d08d-5675-4278-b519-afcb780e1289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461614, "uuid": "81ecd268-6c73-4888-a588-7812d9ae3d25", "value": "server.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90f0871-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453017, "uuid": "833ae369-5f3d-4b7f-9417-074bf28bc372", "comment": "Malware payload (Mirai)", "value": "75b315a75e36d3af02fbfc802314d057", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453017, "uuid": "dee13bed-d613-496f-8ecd-6a545ac0352c", "comment": "Malware payload (Mirai)", "value": "413154eff176aed894e0c6a9255d7a6c18eec22ecde7688b9a4b4650c0265d93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453017, "uuid": "d9e2416c-6d4e-4d2b-9021-34147480ef85", "comment": "Malware payload (Mirai)", "value": "f21a4ff664f5a2a2b3ff96eca433b97e81b9f464", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453017, "uuid": "9a305f58-dced-4202-a45b-551f780074ab", "comment": "Malware payload (Mirai)", "value": "3947955d6d6f4c30cfe3a7829c1b466988228bacd0fe562f8aa7d46270bcd3ac4e3efd005dbcc272df43d8c04ac8cb39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453017, "uuid": "73e1c884-12b4-4f39-ae35-62548549ef7f", "value": "T1BAB3850E3E159F7FFBAE867487B78E31824533921AE1C445E15CFD051E6428A780FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453017, "uuid": "7c5bc773-6db5-4c9d-a324-3be2f4291668", "value": "1536:TYhISRmMkEk+ZXSodqC604QOA637kjF7FnUgDMAu9MQQVvE:TYJ7ShCKQdWWF7FnUKMAg2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453017, "uuid": "c6c1e4b2-f085-4524-843d-18bfc3f69621", "value": 112108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453017, "uuid": "d2d4da01-ad84-4a72-8d84-ee71ce5d3b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453017, "uuid": "a6379e95-0a43-4534-88bb-15658eac610e", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f80fef8-7156-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782475013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475013, "uuid": "a2cc7769-840c-43d3-a34c-8cd56cc761b9", "comment": "Malware payload", "value": "6c3814ac025e31d2cda7ffcc13dfc215", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475013, "uuid": "a5da2db4-db64-4267-9990-a5fd4df4f45c", "comment": "Malware payload", "value": "419f4b89f080ee9aa726df0f9c2217fac41101c867994124c85d68b3cb6c6332", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475013, "uuid": "88d75aab-266d-4329-b607-66b59e857d74", "comment": "Malware payload", "value": "1ab297cdaba02c59cbfb1f8c6fa11d4fef8db590", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475013, "uuid": "23ffa348-de5e-47e9-b547-c35abb220f47", "comment": "Malware payload", "value": "59ceacf877a8600652cf78dea7fca43d573d773c9bddb44a4da0512bae2c5d656faa53c8c10c89fee96223d28ae13e18", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782475013, "uuid": "da525a2d-b88d-4dd1-880e-209b7b8bfceb", "value": "T15407330201792BB243A52D790D422DFB0E85E39F84A763A81CAC2D72B95766D7D3CCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782475013, "uuid": "74772cc3-aef6-49c1-9de8-96ab5d5450fc", "value": "393216:7TdDKmLomTnYdSrW0fMTdDKmLomTnYdSrk0fy:7pDFomvrW1pDFomvrkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782475013, "uuid": "38d05c77-4a67-411c-ab79-1121467f894d", "value": 17504704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782475013, "uuid": "46e119ab-e6f4-44b7-9b91-0458f86b88c0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782475013, "uuid": "ac75af2d-dc66-487b-976b-9068e0182d45", "value": "MO_TA_VIEC_LAM_PDF (1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c322c9a2-7186-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782495903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495903, "uuid": "97f8aac0-7e07-4714-9158-58fa8e6a22ea", "comment": "Malware payload", "value": "59d5881080ac6af8650245b1798cd1d6", "object_relation": "md5", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495903, "uuid": "a03ae050-711d-41fa-b722-7bb30ebe14f3", "comment": "Malware payload", "value": "41e1c249f8f18a9ab94e82627cc81c30eee66057ddfeeaef43e0483f820179e4", "object_relation": "sha256", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495903, "uuid": "4ad2f65f-9fed-4139-9779-18f870083493", "comment": "Malware payload", "value": "2e03d837cc3ce3ff48da7ce27d8681be31352e51", "object_relation": "sha1", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495903, "uuid": "16c785fb-0de1-4186-a9fc-84e660c4435e", "comment": "Malware payload", "value": "3e4107a46cc342ae939ee17858e5ecfc3b740205f7c2b510baa5157def9163148961e016eba746e3e2746e7247c33a17", "object_relation": "sha3-384", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495903, "uuid": "2db8d99a-bdb6-45e4-b9eb-851ea8e5a6ea", "value": "T13CF6DD9A1CD4EC7256E62BEC73860437A1576956F1EE3143FA630CC61B7E4C062AEBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495903, "uuid": "f7726fbd-4f55-4daf-91db-b4477c689a19", "value": "49152:ARRLs1ks1ks1ks1ks1ks1ks1t/QRWAjFSgJ+6DyvB6tFVJeJtI+9MjJcFRGPpokt:ARR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782495903, "uuid": "27281e16-8185-441f-9275-cf74d91e93a6", "value": 15993735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782495903, "uuid": "bcfd7556-7a86-45b7-8f58-c9453112c0dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495903, "uuid": "c05b7c77-fe25-4806-83f3-e4537ddf8b02", "value": "xizoxf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f5ae3b-7131-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782459453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459453, "uuid": "64da22af-940c-40f9-be63-d13dba29c03c", "comment": "Malware payload (CoinMiner)", "value": "22f3c908d82b03797c724984404e584b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459453, "uuid": "0d2cb8f4-9f3a-4bb3-82aa-e7b01b7721dd", "comment": "Malware payload (CoinMiner)", "value": "4225c73c7a0f0cc9512662bff169b8a772044bc7f7a72b1b0e241f946af7f60a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459453, "uuid": "043ad580-7742-4dc7-b0af-0cb739ce129f", "comment": "Malware payload (CoinMiner)", "value": "7f381368f75183ea4729ca5f9c4c5c9a0f0aa1f3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459453, "uuid": "b2eb20d5-8ec1-4853-8b97-440dc701c24d", "comment": "Malware payload (CoinMiner)", "value": "13cf47d45669576b25f7dc476f52513e76b2f16f3efb7953d5f49ba741fba9076ceeddbda10c849d53a97bbff917fbda", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459453, "uuid": "fd6698d6-04c0-47c7-b339-abc1591ecb32", "value": "T1FCD31258066C6CD0937EEB7D80F50D561202FC8261EE17BDC8A18C6BE552E1ED68DCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459453, "uuid": "d09bc4e9-e3ac-461d-a3c7-48521d0a4f98", "value": "3072:pZi+bRJFE+ggWjstmyLMh/cwi7AtWyr5uR5BcSEOI:fimFYgCSmdh1iErEDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459453, "uuid": "e85d6089-82b1-4358-a981-381e5b72f67d", "value": 133820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459453, "uuid": "72a93164-9185-414c-9a9b-5c62c28a90a9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459453, "uuid": "e7262c08-a550-4866-bed8-64dc56757f7b", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90728f44-7147-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Meterpreter)", "timestamp": 1782468760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782468760, "uuid": "1c82e969-8356-468f-9bcb-74a5e4d472c8", "comment": "Malware payload (Meterpreter)", "value": "51cb20a608521c1ed724b06ae007e86d", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782468760, "uuid": "d0946346-7a6c-4739-8aa0-1b4089010818", "comment": "Malware payload (Meterpreter)", "value": "42405d1848e283c80a03b7e6e59044e9bcddcdac2c4c0302c8be0edb67a4084e", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782468760, "uuid": "f86bc661-4fa0-461b-9678-31bef8d378c8", "comment": "Malware payload (Meterpreter)", "value": "4ee9c2ea2223efad8f6669faa97e00839dfc14d9", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782468760, "uuid": "3ebb38dd-db46-4083-95ea-bccbe7e97fe3", "comment": "Malware payload (Meterpreter)", "value": "36042bc73633c5f2001f8cecb3c85a8ee6d3a258f84bfe20ba10bfa143605f5f52426c18fed315f68b29c59fd1c4269d", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782468760, "uuid": "814187d7-226e-43a6-a822-28d9a2177edd", "value": "T13DD08082C152D143C47C8D3575442FAE5724C12740501F2663D57FC9CCEA5550E31F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782468760, "uuid": "47cb79cf-5a5d-4ff4-8da4-f4bb06596d17", "value": "3:Bkkk/tMlwXll/O/slrCs4X1lFrSwfOEULs0XIM8IPNioOHyUvwGcVhVflgLfE2:Btk/tMl//E2s4CEUlIKQXSEwhVDlOfE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782468760, "uuid": "4b1db26b-aa88-459a-bd18-86518a48c9e4", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782468760, "uuid": "c27404ae-0915-4d55-9e26-99e7ad1b1d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782468760, "uuid": "b36da927-02d1-4aa5-a7f1-a6ca3cbe6e85", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60592547-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478987, "uuid": "babaf03a-2082-40aa-8909-74456afc053d", "comment": "Malware payload (RustyStealer)", "value": "444b819900e286ff196511d8cc4c4458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478987, "uuid": "4e2eaf44-9f5f-4ae0-9d18-df961bf9d80a", "comment": "Malware payload (RustyStealer)", "value": "42c6a1581f9ac7134dcd392b13d3c7fad3c75fef3473ee68ffc6ae8d2e086fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478987, "uuid": "1adddf81-b64d-4ff4-8cdd-724227daf2b9", "comment": "Malware payload (RustyStealer)", "value": "a4eae2b207bfc9257728ccf4560b567b843afa38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478987, "uuid": "981ef203-c85b-479e-9bfa-68411c3049d1", "comment": "Malware payload (RustyStealer)", "value": "68ed32eedeb41c9b4bd16090b0943bd9264b2a819f81101037850d96b319778b4de1e14cb145ca336e338b827e5a201b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478987, "uuid": "be7a9c65-e380-41f4-b332-50b43275f9fc", "value": "T11E168C03FAA582E9C0AEC178C79A9233EB72B88D4630B79B17D44A213F57B605F5D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478987, "uuid": "c0c2fa97-b127-4422-9bc3-b97698e79854", "value": "fe28d440ccb73b49d5b56477bb54d89e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478987, "uuid": "f0e34c70-eae7-4058-a98e-d912f17cdc85", "value": "49152:SDo3c61EAs6EShBwght6PJ5nc5rJjpr3NhgvkJSCc3mwETtKXc03F6AJ8i2FmN3m:S01QgWsNxbJSZ3Y030mxzeBlGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478987, "uuid": "1c0fe6ce-a824-4aa2-b437-63f840623fad", "value": 4379136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478987, "uuid": "cdd7bfa8-cd86-4d82-9ba2-05ab5ecb4dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478987, "uuid": "e8453a39-2d83-4521-b575-0e2dd280a7a9", "value": "42c6a1581f9ac7134dcd392b13d3c7fad3c75fef3473ee68ffc6ae8d2e086fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38458674-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "c510e9fb-05dc-48b5-8907-9cc9fc72e4af", "comment": "Malware payload (Mirai)", "value": "c2946f950a16d1559156025d0efb946a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "08ccb043-a1a8-41bd-93b9-84cc0b64482a", "comment": "Malware payload (Mirai)", "value": "43ee8228dfd0793473a04e8e8324bfb8491712f97a6015efc40129b88dc3de98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "0a409025-49e6-432b-9d0b-1900b6c7609e", "comment": "Malware payload (Mirai)", "value": "692f44d180033111324f950b36a9583d1d63e342", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "aa0a469a-dfd9-48d0-beaa-25cef6da375e", "comment": "Malware payload (Mirai)", "value": "8077f6688d32bbe889080f8aee5786c1a62ef43899027aec3b9c962d65e936ccfa95ab655fa2bb02907ea151db34dd8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454009, "uuid": "48c237c6-591f-4702-90c0-87705dde46a4", "value": "T18714E946BD518F23C6C311FAFB9F429C37266BA8D6EB3102DD157FA437864DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454009, "uuid": "b3775bb3-cd57-4024-b28b-716502cf3603", "value": "6144:FNx7P6kO+mQpTKl375GL2fnLjMq4j+LL:FNxT6kOypTKl39vfLjMq4j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454009, "uuid": "52e7d1f0-4312-46b5-8dc2-db0586a306f3", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454009, "uuid": "f2ae78c9-e11d-480b-9bc5-1488afc54272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454009, "uuid": "7f00915d-26fd-4267-9593-790a7e9f0b15", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b243e41-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493098, "uuid": "d27bdde4-852f-48e9-9859-113a7c82dd52", "comment": "Malware payload (Mirai)", "value": "ac21065241b98c62d87bfa4359f8c589", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493098, "uuid": "fe722581-3792-4c1f-b2fd-dac5939ad9b8", "comment": "Malware payload (Mirai)", "value": "441b51ed84e32c6e5c079b70314b3c5bbbb52273755a99b20fd5e96f62592d08", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493098, "uuid": "7bffbf0f-8018-4ade-8a90-49ccf6825140", "comment": "Malware payload (Mirai)", "value": "464de780684497c30a7641e29d53da2466422645", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493098, "uuid": "5cbb3e8e-b203-4a68-a5af-0262919c1ddb", "comment": "Malware payload (Mirai)", "value": "15ae5f5491f48d6c8caf086855c2d9ef58c09ab2e39e41f6e7036b4b1c143ae7d15cc8d71a3e06672a14839ee1fb7bb1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493098, "uuid": "14374925-4402-4742-9c86-9db24fa4c1ec", "value": "T1CCE308027B0D4F43D1533EF02B3B2BE0879BED5628B59640B52EBEC94271DB22546ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493098, "uuid": "2598fa97-0dfc-4edb-afa0-976fa0911cf1", "value": "1536:2EUq7mCYMUKoOCfnfMxxNMp3zrj+EuduSQVxqPAK5VelvAFXoUD6Rm721RrnqdOP:Dh6Ko3MxxI4PAcVpFR6waRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493098, "uuid": "47bb6ea7-c80d-488d-a960-77aa0f19b969", "value": 149532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493098, "uuid": "e35b3579-7ce7-4cf9-bdcc-3c8fdc23d270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493098, "uuid": "4422ff83-475a-436b-b4f3-a80396053f53", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67372049-7126-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782454517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454517, "uuid": "5e387679-7300-4f59-bf2e-417f3a93f28c", "comment": "Malware payload (WannaCry)", "value": "5e52dda9f9b3529d7617c7d8dd4f3e10", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454517, "uuid": "3c0ab21b-d3ca-44ef-a0e0-aa13ad68149e", "comment": "Malware payload (WannaCry)", "value": "44843140f8287b29e8dff038249ded0aa74d6e64b26f764a9780be5fad2488d2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454517, "uuid": "2a7e7ac6-edff-4e51-ad4b-0a0a1949fca7", "comment": "Malware payload (WannaCry)", "value": "050c21e216c404df3e9a4cb0d7c9900e1c3466b4", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454517, "uuid": "bf746461-eb9f-452c-9c06-d85603431c5c", "comment": "Malware payload (WannaCry)", "value": "a3e66837066382728fb27a470d8571f2d4e82ccb841cd02d48c7ef9fa6d72c2685fabfce764f2b7b7b1feb6a130c6519", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454517, "uuid": "c500869a-344a-4781-b244-dfeffd93e1e8", "value": "T1EE363354636C91BCE0510E7484B38D2AF7B37C6A97BA4B1F87C0866F0E53B97AB90741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454517, "uuid": "9c4c980f-4c1a-4247-a669-a3ff3a28d9a2", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454517, "uuid": "eb1392bb-f25d-466c-b774-c30cd212d59b", "value": "98304:DXDqPoB81aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DXDqP31Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454517, "uuid": "e236b484-0e0e-4dc6-9f83-73ecf2c1992b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454517, "uuid": "b6ed2901-2196-4b65-911d-c1bd943c9292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454517, "uuid": "c3b7e014-2626-4945-b63f-b1b7f7f4c8f2", "value": "44843140f8287b29e8dff038249ded0aa74d6e64b26f764a9780be5fad2488d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45064064-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478941, "uuid": "1344d969-2a00-423a-b10e-e763a89de507", "comment": "Malware payload (RustyStealer)", "value": "7ebfeb5782fcf974362581c0a1533445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478941, "uuid": "f154f680-bcf0-47eb-82a9-3eed85a25212", "comment": "Malware payload (RustyStealer)", "value": "45c6158d789c92df57cec8d280c88604d06de0d4119c49e5cd500542a0ad60b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478941, "uuid": "8a95e57f-8d97-4c09-9d98-86d9a398a083", "comment": "Malware payload (RustyStealer)", "value": "45752bdbc88e3f281c9e6822b7e7f3b371af7742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478941, "uuid": "cefc1dcd-6e97-4715-ac94-494dfc57593d", "comment": "Malware payload (RustyStealer)", "value": "f922b12c2c06dcfe6416cf64a7f001a29e6de423cee40a38709ba854e58105662c964464138580ae78b0f78c376e1069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478941, "uuid": "c2af7a4f-3140-4c7d-bad0-f628d29a7edf", "value": "T175168D43F69561EAC05EC079C39AA233EBF2B88D0621B69B27D45B653F13B601F5E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478941, "uuid": "8bda225f-c169-4766-8319-67e57314ab6e", "value": "ac24c75129de769cfd950785b3c3d496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478941, "uuid": "d2767387-08cf-4e2a-8ae5-0de7aab76b11", "value": "49152:CMhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jresuFtaRg2:C5w3u+vBoTheSioTM8jSsuuRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478941, "uuid": "c2bc4dc7-24ab-4c18-b515-a459b8d71b49", "value": 4265512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478941, "uuid": "b8f4ead5-79c6-4ada-82ca-e42cb1ebbf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478941, "uuid": "0cb25335-120f-4e1f-be75-016732f0f3da", "value": "45c6158d789c92df57cec8d280c88604d06de0d4119c49e5cd500542a0ad60b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed29a6b9-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478794, "uuid": "d4abc0b2-649d-43fd-abfd-fb56f6875902", "comment": "Malware payload (RustyStealer)", "value": "8cd1ed35cc813729823da0630d57808d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478794, "uuid": "73dc9b90-21cf-4a61-b28f-3c7579ef6968", "comment": "Malware payload (RustyStealer)", "value": "45c93c7aa3c228704da86609c949a466c49ddb25d3b9647283f9b5ad77b88df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478794, "uuid": "72181fc8-12dd-4584-90dd-89646dca7520", "comment": "Malware payload (RustyStealer)", "value": "643fa77d5b6eef7fc5050abcd7b3b69a97908109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478794, "uuid": "0bc9a52b-eee5-4239-96f8-23864786e41b", "comment": "Malware payload (RustyStealer)", "value": "15ad1678003fde8d3cc1472a1c4c4c3e7e410d44e207c7622133c09f615ebe99bd06992410dff37b9e619c0167c0c592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478794, "uuid": "1724e667-e3de-4289-b50b-4f2f702f188a", "value": "T1C3168C03F69581E9D0AEC038C71A9233EBB2F89D5620B79B5BD44B612F63B602F5D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478794, "uuid": "0302524f-2bf6-4d32-b1b3-36989cfafd97", "value": "74d6feed3733d70f0de83dd62ce9d2b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478794, "uuid": "9cf1d24a-8550-4151-b10f-c861caee0929", "value": "49152:TZp7cq0qjiy70iwC9sO8TE5GfS+4VPoe75+D+bqOUC/dwKnWeEL/UA112lx7z73O:TZp4q08IlgH5LjUC/mKbFNiCmcYOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478794, "uuid": "71baff76-fa31-46ba-a709-6dc0288a494d", "value": 4400640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478794, "uuid": "32d0c4bb-c1d9-4450-a7ca-631737572319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478794, "uuid": "0bf39bfe-a4fb-435b-9db3-ef5a36a6bec0", "value": "45c93c7aa3c228704da86609c949a466c49ddb25d3b9647283f9b5ad77b88df5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d19763-712b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782456637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456637, "uuid": "45ff28bd-439e-4f05-9525-ef199905d1b7", "comment": "Malware payload (Mirai)", "value": "5362ef6e17e82ead2b46884cf926664f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456637, "uuid": "7431b1c0-c0c6-45c0-82f1-9bb01b414794", "comment": "Malware payload (Mirai)", "value": "497bc4983adc5437e39636f39669518b0e055ba007932160e366392913c21421", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456637, "uuid": "958d303d-a4bb-45f9-8522-53f16cd3ef19", "comment": "Malware payload (Mirai)", "value": "5639f4f11550505ffc8da4f09cd2d5f267fc0efa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456637, "uuid": "915754bd-9d74-4194-a8b9-b37ab2eebdbc", "comment": "Malware payload (Mirai)", "value": "169c42b5b1a29f11f9f71a4337ec5b3305acd5f363da4fcd7f4975b594b0de7a9206bbbb2e7d67a9becb9b7a0daaa635", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456637, "uuid": "5d892c8e-e7c6-42e7-9fe2-5c66b5335378", "value": "T12231C7C92390ABF35FECC984F93285FC206C04D77E1A9AE4A41848E36F442C2FD59766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456637, "uuid": "60656b5e-8581-4e81-9f9b-00638fc6a7b7", "value": "24:VBlHBqQ5vFBi+qBCeBoBnBdTHqBFBxYB4btByqf3By3BMOgByUN3BpuuJw:rlhvd7SCecBdL67igyeyx2yex8u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782456637, "uuid": "70394916-d348-4ccd-bfbf-2e86c8524eb1", "value": 1509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782456637, "uuid": "a0ac948b-dba3-4c97-90e6-e855b85eea93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456637, "uuid": "ea63f9a0-b4e1-4675-954f-b80661d27e63", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568f9613-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478971, "uuid": "17cefd6e-e716-412b-bcc3-8eb5007f296f", "comment": "Malware payload (RustyStealer)", "value": "6d8fcf33be0cd5f4ead399412271c8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478971, "uuid": "ba664506-5975-4f1f-9baa-615e267249e5", "comment": "Malware payload (RustyStealer)", "value": "4989f797197cdda8a4c2a36b19a4d3d9142543f3d56c71c73f7be584918ee0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478971, "uuid": "b7a3d44e-2523-4658-a09d-ebb327ed88bc", "comment": "Malware payload (RustyStealer)", "value": "3a7bed880a5420cd10fe2787e06d7d842c778e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478971, "uuid": "bb77bbe9-c0b3-4b49-86ca-30cd08b3d09f", "comment": "Malware payload (RustyStealer)", "value": "49047b6d75b0bf5941e63f1f70849f3c82e3d2fe8e26be48e97edee4614158d51f56194d42bb617e2612df8299113440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478971, "uuid": "77df249e-0f38-452a-b4d1-c1de69165989", "value": "T1F0168D03FBA581E9C09EC139C71A9233EB72B88D1625B79B1BD44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478971, "uuid": "c8846e50-a663-420d-91ac-c41c0b8f3e48", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478971, "uuid": "37100252-873a-4083-a689-8288105d26a3", "value": "49152:syUSUEczSeKTxMqfvuNp8RV5/N/7iECHIMdSEq37pD1ogsLkqwD/avR6/egNgiqz:sP+nZZwvcES7pRomtJqkao9X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478971, "uuid": "77a3c6f8-9b5e-4e7e-9503-bc2fdfb7a446", "value": 4215296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478971, "uuid": "02b2565c-3ef7-4825-9a18-13d16f3aac88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478971, "uuid": "f11bcc4b-5d29-4ba7-a425-ee7501783dae", "value": "4989f797197cdda8a4c2a36b19a4d3d9142543f3d56c71c73f7be584918ee0ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf8f06-7144-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782467655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467655, "uuid": "40577110-b59c-44ba-93b2-95a649f408e2", "comment": "Malware payload", "value": "d087326743835334a36898ad259711c6", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467655, "uuid": "cb5bf9dd-66b2-4fec-aa65-7f3b65cb7793", "comment": "Malware payload", "value": "4d38bdf060a3dd62095569a88dcf411f5c1e32b05db9d4e3841bcf7fe9bae4d4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467655, "uuid": "6ac23a5a-0870-4b05-acca-4e9d055c9bbe", "comment": "Malware payload", "value": "1e77a6d97c814b003b5d7f340ff84ca3b5567ab7", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467655, "uuid": "0437e585-d318-4cac-9802-235581aaddce", "comment": "Malware payload", "value": "2233c03ef60f6b32f5e111852f5686644d6279f1ad27df9076a85b3e30d0ef7100510a089265b2a6d015e477ea36c785", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467655, "uuid": "52affd40-12c1-406c-8ee4-af612fc83655", "value": "T123F57C0ABDE148E9C09AA33188B7529A7B75BC490F3127E72E50BB782F727D05C35B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467655, "uuid": "656cb9f1-cab3-4311-9d94-3413171b75b0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467655, "uuid": "65c741e3-10dc-42ab-833e-9e3e33d3ee2d", "value": "49152:xmodQxADgB+5JhGFqd/sKAlXhazuFPAw6pISw/jvxEfsoLKU4PdQrkBYtwNEa:xiHs0FPkuEECg4kBOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782467655, "uuid": "f8fe3ed4-de02-4d6e-aa99-26d6a9ddf416", "value": 3488136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782467655, "uuid": "765d8178-4134-46df-811e-db03877168c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467655, "uuid": "575d07e9-b7c9-4ed0-a5bc-44adb182d3d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977374f2-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479080, "uuid": "d74e1b8b-5406-49e6-bdaf-411d55c1f18c", "comment": "Malware payload (RustyStealer)", "value": "a6c1720f3024ce8bae45b493e54c6c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479080, "uuid": "7374714a-c853-405b-8fad-ee536d5c6eb6", "comment": "Malware payload (RustyStealer)", "value": "4de08ef8c99d7a83d9013587801a190dfdb6033593a24e7a1265db7cef617c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479080, "uuid": "aa69b0f8-cde8-46a8-9575-036883fa4ad4", "comment": "Malware payload (RustyStealer)", "value": "3e908361f4ba6061499f39823e790af9fb322bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479080, "uuid": "aaacc371-abd6-4782-8a62-227120ab3e0e", "comment": "Malware payload (RustyStealer)", "value": "c9085aadb3a91d13923486114b976b022526e87813715a97ce7aa9519c7b86b3e5d3ea7a09f26831b694b03a9803c57a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479080, "uuid": "ebda0838-c997-44ca-852d-59a9fbc86c18", "value": "T1B4167C03F79581E9C4AEC139C71B9233EB72B88D1624B79B5BD44A212F53B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479080, "uuid": "776757bd-dc25-4cf5-b671-d4e912153bcb", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479080, "uuid": "0f50bc4d-4d12-4a5f-9846-bf7b037c7b84", "value": "49152:j+eFIHlV9Bm51YpKX5sjTdcUlwRfQU1ogsLkqTUhs6UD9MKup5uwSRgm/LUf:jTIHrIsdhIfQqoKX15bS5/Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479080, "uuid": "9bbb0ece-4f3c-41bc-ada1-c3cf025843ac", "value": 4209152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479080, "uuid": "87cf03f6-9623-4447-bfda-eedc798e1d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479080, "uuid": "d0d0555d-72ab-4e60-9c8f-fb4eb2035255", "value": "4de08ef8c99d7a83d9013587801a190dfdb6033593a24e7a1265db7cef617c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f03799-7126-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782454705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454705, "uuid": "270ec2d6-ec9b-4a3c-87d3-3bd3b5110fb1", "comment": "Malware payload", "value": "4522725d24ca4eb6f660dcafeacc4af7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454705, "uuid": "ceb1b155-f38f-4c00-8bf3-c0aa78796180", "comment": "Malware payload", "value": "4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454705, "uuid": "39ce9c54-5ff1-456b-ac9d-173faa79239a", "comment": "Malware payload", "value": "9a3f5f4c54069ef0013a1e03869d56f5b4bf3b3f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454705, "uuid": "d96741b7-b9eb-4fd3-89c3-d9c101cb78f8", "comment": "Malware payload", "value": "1f6ea60fb1139192f4327a88c4274cae4347e9b41e166618763b94883c3bf6efd071dbaf1f3c067af61b02604a9407c4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454705, "uuid": "19de4c2e-dabd-4521-a74c-0b870bb5adeb", "value": "T144B413623D5B1EF7DB2496BE8D66B34F8821C9EA700C09E435EE084DB6D7A74DE201D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454705, "uuid": "a58c71c0-3f9d-49c3-bc9f-6981914e6726", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454705, "uuid": "fd289722-1d65-4a66-91a1-e7ee2908935a", "value": "12288:UAKRNEupTotYDOoPT1iu6reqFutUzcFATeu:UAoKswY9pi9Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454705, "uuid": "d251e190-e278-43dc-aac1-19f6555e4710", "value": 494563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454705, "uuid": "6d5c087d-70cb-4226-9999-4d2aa7df4003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454705, "uuid": "4b216b86-c31c-4008-bf16-bc7bb721a8db", "value": "4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d37e765-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479009, "uuid": "d1e152ab-a130-42ff-8c3d-7ba10350698a", "comment": "Malware payload (RustyStealer)", "value": "7fc39c5f95187eacf49c5bb111344df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479009, "uuid": "2f03d6a4-b918-45fd-8ed7-95001e16eba7", "comment": "Malware payload (RustyStealer)", "value": "4f9f2df05d605116324d0d4575debe7d2238d882065f110c2aaf373d6696f74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479009, "uuid": "0ff2b07c-f1c3-4bc1-ab6f-94eb8a095666", "comment": "Malware payload (RustyStealer)", "value": "e087ad88510644a5833558479ce2288f3b2c6cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479009, "uuid": "df655b0d-6a6c-4612-9f4a-4900360a11d2", "comment": "Malware payload (RustyStealer)", "value": "0f98ca7cf00fe178d721de3bad1da33ebc6688316ddea697a871a85041111c5d1c1b79c35a8bf08a73a09096a3bdf9e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479009, "uuid": "feb81024-ba45-43ac-ad7d-408dce3e2738", "value": "T1C4167C43F695A1D9C05EC138C79A9233EBF2F88E1E32B69B17944E612F57B601B5E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479009, "uuid": "ab43c013-8abd-4872-9ab1-31986548f662", "value": "49152:wvlph7vTlpCB/x5KpvmpF0vp2nueeu1ogsLkqa4fJZ5NDuGxIGCdKH4PMmX6jGs1:wdpFc9DWQueeAoxJJCMH4nX6Cpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479009, "uuid": "3c783192-a3c1-400e-840b-c4647dff638f", "value": 4251648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479009, "uuid": "7ba4a1e7-f4dd-4415-9f87-8913b5ec53b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479009, "uuid": "04832e60-d8d8-47bd-bad7-ce2e5ca65743", "value": "4f9f2df05d605116324d0d4575debe7d2238d882065f110c2aaf373d6696f74f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa005bb-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "e8404932-e102-4af4-ad5a-416c00f669b4", "comment": "Malware payload (Mirai)", "value": "da85a09be0cdd34bd6590b57e056f187", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "8be73964-183a-4e84-a6ac-df7b95fda158", "comment": "Malware payload (Mirai)", "value": "4ffd6c0b0298c1ae222771b977c443d8c9eee8e7a2f1e3edb4dd9d70c2e09e5e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "f3c2a4e0-5cd6-4ad5-abb2-c831be3d1619", "comment": "Malware payload (Mirai)", "value": "fce89b3e9d94bb4ac9cdb0d7bdd0c041bacc8721", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "1f6e4198-a936-4d8f-bb66-242e2767f208", "comment": "Malware payload (Mirai)", "value": "602195bc8b477e4c43cee85be2c70a155e1343d8ea3e0742cefe4a3ca7b9683ccf1a6ae78b6bc1b4ebac672cf4379a71", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493097, "uuid": "2055cd46-90a6-422c-99b3-6277d6c250ce", "value": "T18F24B3066B519FF7C86FDD7306F58B0128CCB45765643B3A3270EA6CBA1A58B05E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493097, "uuid": "35d88a32-3cd0-4513-aa5a-6d2c15498c03", "value": "3072:/uI7ZImzM1F8dR3K2OrRhZtSlIAKVw4doh:/uI7ZImzrR3yxtSlhKei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493097, "uuid": "3cd21e8d-11b8-476f-94d9-603021c75ce8", "value": 216264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493097, "uuid": "2e93921d-e50b-45d3-8d1a-c9bd0343ad65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493097, "uuid": "a02a5921-1620-45a5-8683-116fa6499f71", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb15b8b2-716f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1782486011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486011, "uuid": "8554c2a7-a531-4964-8010-97fa8d59b433", "comment": "Malware payload (QuasarRAT)", "value": "f8de917e3675dd44f4efbc6ed02e984a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486011, "uuid": "7c3d8f2c-7428-4fc4-b534-a6aee158a7c6", "comment": "Malware payload (QuasarRAT)", "value": "509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486011, "uuid": "88a8f7be-0591-4fcd-9cb3-bf3da2b6a195", "comment": "Malware payload (QuasarRAT)", "value": "7fcc39fefb05e24fb241c2a37ae6f08fde069656", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486011, "uuid": "f40034c5-9e6c-460e-a966-20a8b9d56a29", "comment": "Malware payload (QuasarRAT)", "value": "44bc6c667645191e9b41fac1805e021c993a2aff43391b900a1bea3fa7c23581cd0db18024ffb01e9f4459217c7929d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486011, "uuid": "8e046f94-7b4a-4b67-b537-d4e32155bf1c", "value": "T12863FF6123C1F812218F2FA3FB1BF5F5E72A7D9530442C4BE1687DDC566A90ACAA4C71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486011, "uuid": "29a29e35-2cba-4aa3-9fd7-ace1dff952ec", "value": "1536:IiJUwTWvh1ThiK4iqJ19mKwyQzfTu17RXuH+:IiJUwTWvh1ThiK4iqkfby7Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486011, "uuid": "df2ab70e-54c7-4a92-b865-28a57562ac79", "value": 70569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486011, "uuid": "42030259-28e9-4907-88e4-bb8ec4dbc771", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486011, "uuid": "c08f8184-cfbf-4db7-8cbd-ab5e96a0c1ca", "value": "e-dekontpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bbe904-7149-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782469390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782469390, "uuid": "be1c8854-cfc0-453d-b130-6f0fb89f8dbf", "comment": "Malware payload (AgentTesla)", "value": "7a5224de6406df80ee440ea593e4f526", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782469390, "uuid": "4c3ece79-fd4f-4773-980a-87965f80301b", "comment": "Malware payload (AgentTesla)", "value": "51ce23480bb91da183356efa8a0003d7cba21c18847165abc435b3e7536d721a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782469390, "uuid": "3614ac33-545b-461c-b978-cc4cbe44b768", "comment": "Malware payload (AgentTesla)", "value": "b54e2388437298c34d62431eea04ac9852fb18f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782469390, "uuid": "ce8263db-a0b7-4a33-9011-51ddacfb805f", "comment": "Malware payload (AgentTesla)", "value": "3fa7246ec0e38a58712043cf2702c512239ffb637d489e59a013d40bc01f0486ac649348fa4307fece3783da5f9bd2c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782469390, "uuid": "f5093e53-3bb7-45d8-a513-aff1eb23bb8a", "value": "T14AD43882A63BE0A8F65A94B34E0F0FEE8112DD52E6BE64D5DF1072C84DF2D91D435D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782469390, "uuid": "c1326b2e-4a3f-4fab-a7c1-0cfa2b3d53c2", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782469390, "uuid": "7f74ebfb-1f29-4c06-82d0-0090b6a8c151", "value": "6144:Zbfoprb/eSgnR253E8PTcdkZkhRHNO8v0fvVoArct7Ew:Zba/etn+EioY8v0aAMww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782469390, "uuid": "f6ca788f-4f9f-43c1-b61b-da41df930372", "value": 623720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782469390, "uuid": "226ae2e0-4606-4732-982e-e960e52ea197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782469390, "uuid": "e9e50eb6-dc4c-45e8-abbe-8bd99bde98f0", "value": "SecuriteInfo.com.FileRepMalware.35212541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366088ad-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "2d74a3d5-be73-4964-b2f9-0779de26d5d4", "comment": "Malware payload (Mirai)", "value": "2a88756fee67177e4ac9b2cac13c11a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "97c70f69-7c46-4c9a-8154-a2bbadf6c3c2", "comment": "Malware payload (Mirai)", "value": "51d6c546f7ceaf2009d302b929418b3c61739e4c8a517e78b152ad747d875cd3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "4d8f1d08-6c93-4e5f-b9c1-a99a6a31c3a7", "comment": "Malware payload (Mirai)", "value": "dcbed32e6c8afcead593e97c53144b6d3b6a0170", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "82f2753d-3433-454a-8ca6-e933a9d8408c", "comment": "Malware payload (Mirai)", "value": "b47ac1553fe61fbdce4534a3df509ae6dfb10df138f0f423d36a9a2205b0d4ed9072d43548c5983904dd0e96c970ac4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "35c960ed-0246-42c9-b3c8-559855eb7fae", "value": "T16604F842EA43DFB3E55310F202B787310E71E97A6C66D542E3BCBCB4A9615D1A60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "c73a4dbe-642c-41a9-be1e-99e9c7888d95", "value": "3072:nfmM6+Sg5eOESSvk4sOmdc6AIFX3PElOxi32KpzyPN7GE/2lpGe:nxx5eOBLgIFhA32OuFT/EGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454006, "uuid": "7480f40d-a1be-41c2-91e7-2011afcfaf6a", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454006, "uuid": "08b365f7-26da-4520-81b0-d866917259fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "bda50bb2-cb6f-45c8-ac36-51e51817ca61", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6371cb92-7194-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782501756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501756, "uuid": "3832e8c3-cd7f-4def-8a2b-909ff16d6583", "comment": "Malware payload", "value": "aecbde24d3e810cbf62289981c36de9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501756, "uuid": "fcac9f8c-a6c7-4f34-9957-1dd36c071fdc", "comment": "Malware payload", "value": "5210829b2e77f77fb73d91eabdb98cadad7bbff09d7a38e8c224be275d57027f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501756, "uuid": "547ca644-fc7c-46e8-a0bd-ca3e5988bd02", "comment": "Malware payload", "value": "c16776269ab75e55af52bde0fbf8c719bbb235cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501756, "uuid": "86ccb817-c84f-46ba-9318-76cafbdbdc36", "comment": "Malware payload", "value": "4c9fe7996f6c06d52b4fffb6de660b0fd837a41836e9bb713103fe0225fdbfe38e9013886c6727f106a5c6aa665407e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501756, "uuid": "396741a7-1bab-424c-b0c9-37be9ec5481f", "value": "T1BA247D03B6A254FDC08AC4F0436FA316EE3774A9461B75F77B847B312916EB18E09792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501756, "uuid": "df0af444-87e7-454c-94ec-2bacdcd83b7c", "value": "6144:+0qdsO7NGBRdhen/RaLVPMyF2THoXVdqGZmd:+0CEr4qVdpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782501756, "uuid": "cef7462b-919e-4177-a839-a8461b518886", "value": 215248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782501756, "uuid": "9d3e9fe4-8a23-4529-bbcc-9ac360ef3695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501756, "uuid": "9fe7b923-e931-47bf-ba25-08a2456abbd1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03f2540-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479094, "uuid": "c3298144-7cc0-4499-85a0-394b6165840d", "comment": "Malware payload (RustyStealer)", "value": "0919e23941fc3253f600fd2db4f47eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479094, "uuid": "4298caf1-570c-4020-87d9-429271a33041", "comment": "Malware payload (RustyStealer)", "value": "53d0f41053bead4d050c6de1dbf0f11d82c847d8b22cc489dbbb58a82cecfdf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479094, "uuid": "32247eed-1644-494c-b3e3-003183b30d77", "comment": "Malware payload (RustyStealer)", "value": "25e7a1336d22162d5259896d4d499b2f400d0a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479094, "uuid": "4487415b-36bb-46a6-b616-290f26316bf7", "comment": "Malware payload (RustyStealer)", "value": "a0a18cef3dc2d0d2253958df3699b7ce03e1e61811e4ef81de1a4b15defc55b294f871c23d5e7ea531ac002fc1bf1c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479094, "uuid": "3d1423f1-0afd-4e6b-8247-88e57928ded9", "value": "T1EB168D03F6A581E9C49EC139C31B9233EB72F88D5624B79B2BD44A212F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479094, "uuid": "59e28b2e-3932-40b3-8a38-60b41633e562", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479094, "uuid": "93da0825-95a3-4be8-8934-ae28ccfa208c", "value": "49152:9FXlq7LYMS3+e70b5dsEiFjI53gkqQ5YL5T1ogsLkqZ7Dsp36ZsaH2LmXxAwPKjS:9FVq78ACkjraL5hoL69Lex5Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479094, "uuid": "612c933b-8a07-4f70-8a38-77d442824edd", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479094, "uuid": "857bda18-0383-404f-a88e-d6e33f7f252d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479094, "uuid": "77f6c1f6-1fbf-459e-b4ed-9d2203c39fb8", "value": "53d0f41053bead4d050c6de1dbf0f11d82c847d8b22cc489dbbb58a82cecfdf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c5bdd0-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "cd57079e-b5f8-459c-89f1-e8270e07a410", "comment": "Malware payload (Mirai)", "value": "3449d2e3e032dbe973c5caa2dd434554", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "e29d2f76-e5bc-4afd-8a08-d7330605142b", "comment": "Malware payload (Mirai)", "value": "549c1cb15e4d52c758a9f24949bdf8290977ce87358e76374e7583d1f682f5ab", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "27b26269-aa37-447e-998f-8ef7b5059f0f", "comment": "Malware payload (Mirai)", "value": "4492accd9638f37aaa8070ee2a885f7147184f9e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "863b3f63-2134-4c30-8568-5379cfeddd1f", "comment": "Malware payload (Mirai)", "value": "108f36aa1aa63d3a38f256f79ec9b930f6be26b80297b03d1d9006c610a476ecae674ff0d1a00e78bd23179ca52b21bf", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "c4b0c3ae-fd19-44e1-8f57-2c570cc2992d", "value": "T146D31886FA03CAF3D45700F101FB9A394B31FD3A8C32D595E7697DA4DA278C1A616368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "22a71092-6998-418e-94c9-0baf2c99a455", "value": "1536:XsQ+NA429pMwuF/YRyTx3WwsoTnTIQSPNFaEORngacFS2LeSIyd4pg:XsQ+eJp4/Ys0fqTIQSPUga3CWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493094, "uuid": "2ac1b2d3-1289-489a-997f-bb3c392d99ad", "value": 131080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493094, "uuid": "8c15abdf-b028-42ea-b1c6-340c84a52b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "e5ea71f6-661a-4250-9674-0230f28583fd", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a350e8e-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "946cf121-2bf4-48b1-8c9b-a3d54282c522", "comment": "Malware payload (Mirai)", "value": "28390cb9f4944e21c8f1e05fb7e63aad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "865f971b-a564-449f-860c-d996156507de", "comment": "Malware payload (Mirai)", "value": "550e104d1524df406419816817cf3055c7fe64efbf551cc19dfdbdadd77ccd13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "1ee40591-cd30-461f-9a52-20c4e1e30183", "comment": "Malware payload (Mirai)", "value": "73efaf53acbef93845e110331692154bd6075977", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493097, "uuid": "9f479b84-04ca-4f56-b20f-5e445ef6473c", "comment": "Malware payload (Mirai)", "value": "0079f7b2a239c9e060bc7ff120b11ea31c32469cd77514eae2cb0cfec2b5eec350e678a1480f1552840cb71df9ca163e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493097, "uuid": "0fd68787-e10a-4516-a489-71a9fad36418", "value": "T1ACF30AC3FD01DEBBF40BA3B6489309157130BBB648525A72B21778AADE391C52477F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493097, "uuid": "0e617a4a-e9cc-4d5f-be44-46561e56b58c", "value": "3072:CusuyDsqBDIhyTEHhfOZKOFR/xFZVVjbi+LkuM3042H:gW2qyTihfOKO/xFPLG2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493097, "uuid": "b57d4601-5d9d-4927-b45d-f23dffd72062", "value": 166460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493097, "uuid": "fcfce0aa-928a-46e2-be6d-d26e8b0267d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493097, "uuid": "a85890da-130a-4c71-88b7-e134cf10e931", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab181ee-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478951, "uuid": "8690464e-0d99-4b93-82dc-73044cf7c1d9", "comment": "Malware payload (RustyStealer)", "value": "caeddfa1b0347b727632ce6275652c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478951, "uuid": "3b9f63e3-f648-4350-8b4c-0628b74c9a20", "comment": "Malware payload (RustyStealer)", "value": "565500125bdfccacdee564cac4cfef786c2f361a75efcff0783c37368e01af72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478951, "uuid": "bb070a89-0cfc-4eb1-ba9d-74989ab848c4", "comment": "Malware payload (RustyStealer)", "value": "da0dc5e7d41eb8308b06c1430035de228e759619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478951, "uuid": "20c97d92-696e-4b38-8429-c7fb9bbfd8c9", "comment": "Malware payload (RustyStealer)", "value": "e58754a20083c9427ffe30fc4b0e1cf146decb6d0354e593feaeebdd8ce864136dcd85dc1ec4bab370fa30eb71b3af39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478951, "uuid": "0c64facb-7337-4394-a950-59874ac61db9", "value": "T1F8167D43FA9541DBE09EC378C31A5223EBF2B88D1620B69B17D4CB612F53B605B5D398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478951, "uuid": "4cefb9cd-716c-4ba9-8398-050f742e54a9", "value": "49152:LMhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jreSNK4i8o2:L5w3u+vBoTheSioTM8jSSNe8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478951, "uuid": "84a0dc2d-4f12-4578-b478-fe29d0524bf9", "value": 4258304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478951, "uuid": "ea37847f-710c-4424-940b-b2a9244da87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478951, "uuid": "d7a57d90-0a14-41b4-804a-c486e2dc9cb7", "value": "565500125bdfccacdee564cac4cfef786c2f361a75efcff0783c37368e01af72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfd0a4a-715d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782478339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478339, "uuid": "8c67fa58-1e30-44d7-aed9-76b260689a6c", "comment": "Malware payload (Mirai)", "value": "84b690716f5dcb75f6569db6f43b6545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478339, "uuid": "ed6d73ae-a3c2-4f23-8ad1-18d0ec0a126f", "comment": "Malware payload (Mirai)", "value": "5704d7c94a19b040ef9230f642909590326d399bc2d8fcfe690b8741bb5532cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478339, "uuid": "ffa44f6e-7b4b-48f8-9a50-d333518cfce3", "comment": "Malware payload (Mirai)", "value": "062a4fd9f800cab7e31a3e1c09ab0becdaae3e92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478339, "uuid": "70f89d66-59d8-4428-a442-37cce39fd3cb", "comment": "Malware payload (Mirai)", "value": "b0cf76afa5e8ac48f0870c1e51d43b7e78668257969c2019741353405df0741785ac6ca6ac84f9b0bf87e3f20b250e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478339, "uuid": "fbf0f507-d5b0-442a-85f9-3d6ee54a6e43", "value": "T1A2054B16F8809F72C5D0267AF76F42A8731347B9C3EA720699189B343BD791F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478339, "uuid": "06bbbaed-2a6e-4298-9887-31eead50faf2", "value": "24576:fwZ/IzIV4AdRyajsBES17Sj5CkxPPP6TpYQmugtzc:fwa2TxsBEqivnP6TpYQmXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478339, "uuid": "12b30b79-ebbf-4597-90b6-dfafe9ebe967", "value": 826924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478339, "uuid": "0ab70523-591b-44b9-88b3-9d5f52b50e3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478339, "uuid": "56be34ff-93aa-4b54-8dfc-0d5d1eff1ed9", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d0bec0-71b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782517703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782517703, "uuid": "c1bc997b-b358-425a-9b3f-debe1a5854de", "comment": "Malware payload (RustyStealer)", "value": "3fc4a02f1bbb142af490bb2d0d046cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782517703, "uuid": "cf256a5c-3e74-4c7e-b01a-40265a07a451", "comment": "Malware payload (RustyStealer)", "value": "576f3ff7e34e66f6298efbb5b9ccda4d2c27adeb9040ba9c85012c9f555f2d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782517703, "uuid": "cd4ecf36-b711-4794-9580-96c3bdb3c18e", "comment": "Malware payload (RustyStealer)", "value": "c8ade7c35ea5723eeef0d517fbbda2e8847f6479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782517703, "uuid": "348bb778-79cb-401c-8045-2d1502428802", "comment": "Malware payload (RustyStealer)", "value": "62704c4ef9bae831febaad8e62d80eaff0803b7a6eb223670115511b76f520bb3f55c3352b846295c1b81fd31bfc510d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782517703, "uuid": "1d42c917-bcc4-4b6c-aa62-07d5110158a3", "value": "T13E863302717614F8E66BC138D3499B529B36309D0F364EFF225516282F36BE92D39F98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782517703, "uuid": "30f9f4e1-1cab-42e4-9c2a-2fbe52635178", "value": "532cc1f671bb30c461b49580820593c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782517703, "uuid": "954cc0a5-02c3-4ec4-87b1-ef05d52dea2c", "value": "196608:N2ZxifyYl4j7L+iwJ7/8aRYJ+YVttiq6fIF8+SJDMIFgW:mx+Xl07twJ7/LY58TIF8+SpMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782517703, "uuid": "2538fa93-62c3-4e7f-9b9c-eed3e0d1a5d4", "value": 8455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782517703, "uuid": "f7aa611d-cac4-409a-aa68-56ea9c32192b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782517703, "uuid": "ec635150-801b-44fd-a203-54297662d716", "value": "SecuriteInfo.com.Trojan.GenericKD.80634618.26841.10932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25832335-7134-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782460420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460420, "uuid": "7e8ef852-8fd0-4321-8c26-482aff3e1243", "comment": "Malware payload", "value": "1f67a904122c7bda5d393187f6e5dbe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460420, "uuid": "a70fb293-ca56-48e4-b490-72dafae6c010", "comment": "Malware payload", "value": "5819834f61295926fc68010aebbf69a42d03e168ed20808de2727c5d328daebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460420, "uuid": "17865ef0-942a-4534-9e43-e779ba014cda", "comment": "Malware payload", "value": "1c56485579fa421ec5ba1b82e7cee78164915f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460420, "uuid": "35cc840a-c10a-4c8d-8e72-dabeec1dc7c4", "comment": "Malware payload", "value": "5d8a77c0f399244004eef9c4c39d8f92aa8caff4404503c381e03f3d844494c16185ce39e296e251da4a921bf02524ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460420, "uuid": "06740fe6-0e08-4b42-8dbc-803805368b32", "value": "T1B417BF21B252C07ACC4111F09D3DABBF473C6F6907B446E7A2E81D686E714D2373AA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460420, "uuid": "b60af172-6d29-45c5-a59a-a8a7d67b2098", "value": "2d6a37e90655d8ccf0d51fa6971900c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460420, "uuid": "bef4b263-2546-43a6-90e5-054c2c1253db", "value": "393216:HL25b0IPKra0g9M+x8vO7VE2tZqipu5j9rqNX/zt:Eb0Fg9MB0hpujS/zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782460420, "uuid": "a49e0010-9f25-48a3-95db-d8820e303c86", "value": 19059544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782460420, "uuid": "a7604ef6-ba05-426a-8b9a-29b6d0f7c77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460420, "uuid": "61d738f9-fad0-4983-b1ce-b55a5fb8fac3", "value": "getscreen-388015028-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391a833b-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "0358047d-80f1-4214-92dd-1d69d67dd95c", "comment": "Malware payload (Mirai)", "value": "529437102e513e16201cac27675fe965", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "80886105-b2e2-4acd-b59c-14edef525c50", "comment": "Malware payload (Mirai)", "value": "583a6634565f810654222501558ddd8f932aa71fa224cbd66a3f2979554a7a2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "8699a876-4bab-489e-a375-3564f77f9e2f", "comment": "Malware payload (Mirai)", "value": "e56bef392498dd3144c48097a566501630747d39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "d4a6966c-c88c-4320-816a-145d6cbd9cbb", "comment": "Malware payload (Mirai)", "value": "523e4c824799823b3f140099cfe2fea577971acc638d1dd3f55a4933d8c589bfd81c7cfd829bc569cd61f490c9389f87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "50c9a1c9-697b-47e0-ba3b-97209a106a47", "value": "T1DB242A027B0D0E07D1432DF4267B0BF14B9BAD6138FAE681750AFEC957B1DB1644AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "9254e492-f0f8-4e72-a270-e6629149f727", "value": "3072:ZUEdJWfJNUaqrJVqNWZMxxN99iRFDYJrMhgfNj3gnGuA:ZwJWacJJZMxf99iTDY1MhAjKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454011, "uuid": "af9b7bd3-2938-405e-91b5-e8339e917a8a", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454011, "uuid": "6e727f94-1a26-40de-af8b-bf6ecc5ce096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "c5620a4f-b75b-454c-8286-b416061a89fc", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9bae14-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782511809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511809, "uuid": "6ee84903-2392-4c5e-b3aa-a352a948e3b5", "comment": "Malware payload (Gafgyt)", "value": "1ae65d11269d3c5291111c042e52b4b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511809, "uuid": "70482433-d928-4ca9-9744-24ef43b59aa6", "comment": "Malware payload (Gafgyt)", "value": "588da75109cfc5a82d79b7433218e0a891e7e987d0ab30549a348dcacc029b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511809, "uuid": "2663165b-61c5-41c2-aa8c-ebc07683d167", "comment": "Malware payload (Gafgyt)", "value": "5325beddc072ba188325748c88b5d43932ac88c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511809, "uuid": "3be8b712-1931-4862-9dd2-852cadddec41", "comment": "Malware payload (Gafgyt)", "value": "a609948a33fbd13c8160e374c8fbac8540a42ef87769e664fff7f918e246076d855832e77d7d7dd35947c21b8fd4f720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511809, "uuid": "f9cf1537-dcd0-4f3a-80da-e555b7ea22fd", "value": "T11FA33927B242C6BFC08752B52BDB99A19473B8F81B32721B73D47DB52B168C92D19B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511809, "uuid": "6a84985a-b4e1-42cc-9675-2cac68383512", "value": "3072:0t9+V3oPXrtxswdkMjhMnficLwNhaOflUmrxppXFZYZrgo:4PXRXkM2fx2a7mrxppXFZYZrgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511809, "uuid": "9009fc4b-05eb-4c5b-b8b3-20b3c244dc46", "value": 106700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511809, "uuid": "d5b7e95f-3a4b-4799-aae7-020eaa020b06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511809, "uuid": "956aba11-70f5-4e83-a3d4-9fb26e6a62bf", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4c0836-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782478923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478923, "uuid": "118dd764-e037-4232-bb5b-f70829fc5e4a", "comment": "Malware payload", "value": "106156c492cb1cc1d496dc9e3380c382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478923, "uuid": "27b71365-fd04-4131-8495-bc366945d692", "comment": "Malware payload", "value": "58a6a23a9ba0ae141655444bcb54901e68c00eaa4eb0d7c3e6f25a4dcf8d3cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478923, "uuid": "37d820de-69d9-4292-bece-b0fc2f72f763", "comment": "Malware payload", "value": "e7730e79140cc0f40a515ec6734a8e5bdfa19876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478923, "uuid": "24f4ee36-32a5-402e-a5c8-2c9b45d7a5bd", "comment": "Malware payload", "value": "def873c7b8c9378207d40b68d3ebf438da233f1d57a159de22b960c5b8092da9485ce7e53fa0fd8094595572d2e43eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478923, "uuid": "039fb17e-9a3c-4955-a3a0-6f5a4a485bcf", "value": "T179167C03FBA581E9C09EC179C71B9233EB72F88D5624B69B1BD44A212F57B601F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478923, "uuid": "1b4411f2-533d-4968-b71a-4aca09838a2d", "value": "246058360039e7c35c50b7abd74372ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478923, "uuid": "432d30e9-f75f-4314-a619-063f3a3d9c50", "value": "49152:WXC0H4lhyBM065jYjCAx55pBzzsCM0O2aZe1ogsLkqwTQz3R5yCUSFiwJgRuu+I0:W+fyBEe5zgeXaZwoBD3gYuZ2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478923, "uuid": "97dba00c-b64b-43f8-81c2-9b8a60076bae", "value": 4217344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478923, "uuid": "3a067575-112e-4119-a7db-20aa2e8c4006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478923, "uuid": "69df9f81-1ba4-4a25-9851-db3755f3290e", "value": "58a6a23a9ba0ae141655444bcb54901e68c00eaa4eb0d7c3e6f25a4dcf8d3cad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a0003f-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478966, "uuid": "e456ca26-f3fc-4ac3-aeab-d64fd8062dde", "comment": "Malware payload (RustyStealer)", "value": "a5e250adea3405bc5ef99ff0162333fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478966, "uuid": "5355c873-f081-4a64-b90c-bf90508971c2", "comment": "Malware payload (RustyStealer)", "value": "59b2c511fb6d62be0df6ba272c4697fca9ee92d38e55b5a937792f6f3de191a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478966, "uuid": "97806b1b-f105-4e65-8606-31dc52327a7b", "comment": "Malware payload (RustyStealer)", "value": "37e8ddc66cf923c42658f18c35590bd85d901ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478966, "uuid": "f98eb5cb-b971-456f-b789-907fd96b638c", "comment": "Malware payload (RustyStealer)", "value": "80818318dda100b94b731d8b08aa6e990eaf05867b53a91031246db570a4f84a17a926f57c41c62d39457f7c2020b33d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478966, "uuid": "593e72de-402f-4422-8b0a-3dff99d03dde", "value": "T13A168D43F6A549E9E15EC038C71A92B3EBF2B88D1624B69F17D4CB612F53B601B5E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478966, "uuid": "c3891d18-071b-442a-bfb2-9c45f3e085cd", "value": "49152:kyUSUEczSeKTxMqfvuNp8RV5/N/7iECHIMdSEq37pD1ogsLkqwD/avR6/egNgiqt:kP+nZZwvcES7pRomtJqSWM/Tl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478966, "uuid": "fce16d37-6669-4eb8-9a02-6bdb586b47aa", "value": 4251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478966, "uuid": "b67f9ab0-489f-434b-a7ea-2a3945975c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478966, "uuid": "304c16fe-2764-4621-9cef-188c8f41b0f9", "value": "59b2c511fb6d62be0df6ba272c4697fca9ee92d38e55b5a937792f6f3de191a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8df1af-7134-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782460405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460405, "uuid": "6bb2bab5-19f6-4ec6-b1e6-74e73deca3a7", "comment": "Malware payload", "value": "22951707c2e866d2963a78bb5e30325b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460405, "uuid": "6ef78afe-7830-4f10-a658-1ca6b7bdead6", "comment": "Malware payload", "value": "59d7669d35b5ab90a327d7fdd4b2b4b51d2327432a40791643cb639320bb0500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460405, "uuid": "ea0ec306-0db3-4c19-b465-8f1008f83d9b", "comment": "Malware payload", "value": "f638a4785c93764e09e7464a487cbb2753b13f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782460405, "uuid": "69bf3a2a-a4a0-43fe-91a5-0446cade0e11", "comment": "Malware payload", "value": "fce93d4f350da2edd587968e96c369ba722cf38abc0311e6f047dfe1ba0b5454a8f18eb247b486adf7bb45e13a7283ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460405, "uuid": "737c9aeb-946c-4499-97aa-946f1aa67a55", "value": "T1FE7633AAE5976C40E38DB67E3A3B7B36E26156130541D4CCC1ADC68294B0FC2B7F191E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460405, "uuid": "7d323edf-f3cd-4258-8136-f729cd2fb053", "value": "8f239649a3771ae6e34f7738a8cb846c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460405, "uuid": "d153b600-8f8f-44ab-9946-2f3c62027a7f", "value": "98304:/KFoeLzGapeyagOteH4lVKg3IZuX0PcNrr9c18a9/unv/Qt3wu+0HywfZVWI9QoO:CJmapeOOtJX4YX121L9mnAt3TDZVHQoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782460405, "uuid": "11b5a68d-5359-499e-bf7b-9866906c6348", "value": 7284056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782460405, "uuid": "9b7e5ad3-f40d-4750-a817-3c80a8772390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782460405, "uuid": "bb16117b-fc1e-4441-badf-42c8934df477", "value": "getscreen-388015028-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39f4036-71a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782510453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510453, "uuid": "3cb1862e-648f-4f0e-8a98-246249fe13d8", "comment": "Malware payload", "value": "950e2246d5e9c966e57cdf6cad96e21e", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510453, "uuid": "21590fc2-b82c-4eb8-80ec-e65227d7120e", "comment": "Malware payload", "value": "5a478e3305d575ebd2e29ec4bc8c5981c7e5abdaa717cd3a694b2637323516c3", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510453, "uuid": "949529d3-3e66-4a11-a8b1-6a8b8682c1fb", "comment": "Malware payload", "value": "8b77f1b4ecdd1db1089bb86ff3681c12054b71e4", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510453, "uuid": "727c802a-293b-475d-af2a-5a001a1450a8", "comment": "Malware payload", "value": "8128b4b930e864a491d82fbd922c4629cf916e340ff31f7209b67693b42701e5f5c69770a39bf4509c4312cec7ac37f9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510453, "uuid": "19817454-c1bc-490e-8f76-2973f48ad909", "value": "T14484F12193D17C84114B8FA3B71AE3E8EF0F3F3C7194099BC1187D64AAAD61C9994B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510453, "uuid": "53fa2ced-675c-4631-aca5-91f217b8035a", "value": "6144:TSR3GUrNcqwjgODj6sixBqh2Bo/rRlukQh6espJsxiKTn4OlgoASiMG:TSZGUrNWjfj6sixBqh2BoTRlujGs0KTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782510453, "uuid": "8afb3887-abf2-47a2-bf6a-4df0102c5a17", "value": 378180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782510453, "uuid": "9794d263-e09b-42c3-8083-b5968ed66fa9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510453, "uuid": "71dcd0a5-9e4b-4e9a-8779-fd6ef2f5be34", "value": "hFObmbDTio.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1554adea-718b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782497759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497759, "uuid": "ec59d40d-e954-4461-bc9d-c68f40f5433a", "comment": "Malware payload (Mirai)", "value": "508604a1ac0553df5e15593a5b04c25a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497759, "uuid": "6179a579-fbee-40af-94c4-81ad198566f5", "comment": "Malware payload (Mirai)", "value": "5b1cd0bd500ca70ae871d015ea1c11b0720056a9da86b023a06024ccd6265543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497759, "uuid": "f9bd906c-998f-44cd-ab25-2d844f708485", "comment": "Malware payload (Mirai)", "value": "e66b7c65ffabb4688f95d30c54aabed392f50cfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497759, "uuid": "11b79368-bbad-4ebb-af5d-92325cb7b9d5", "comment": "Malware payload (Mirai)", "value": "269b09f9eac349fbbfde3f2e222e20bb45f7d25f4bb58cca72406e2b2e7c70db3670bad7b20fa205cac0ec8f3504fa92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497759, "uuid": "6acaf241-c916-4d9c-9897-d6dd81d26d01", "value": "T1C7F3F981FA43CBF6E44706F012B7A7335931FC3A442BE686DB65FE7269619C0E609358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497759, "uuid": "9621382e-8fc6-40f0-9a1f-5f37af67b81b", "value": "3072:UZHN8qufevAmuBkgjJ2SCyUeIdqrxGglK+EImxWpTiIknXKTA0IzF3mrm3iiGNTE:qt8qufevAmuBkgjJ2SCJeIdqrxLlK+E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782497759, "uuid": "063ff12c-a2a8-471f-95c5-60b53c7538fd", "value": 163248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782497759, "uuid": "0d4f28f2-160e-4c1b-8ce0-9219dbc46fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497759, "uuid": "3fe47a81-94f5-4322-b82c-f1cc3888b4c1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92834107-71af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782513431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782513431, "uuid": "91fbcd32-1b20-4476-bd3b-d0abc31cb75d", "comment": "Malware payload (Mirai)", "value": "f64e532da7b7571b2990dae8d7d5212b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782513431, "uuid": "f13b19f5-1f3a-4d4f-bd9d-deca7cee758e", "comment": "Malware payload (Mirai)", "value": "5b834b5dd162fe166bd4bf2d4b41515e4b7a902566b39905c9d8cc1f89a742b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782513431, "uuid": "0a6a6393-f60b-42df-9abf-88a789ea5fd2", "comment": "Malware payload (Mirai)", "value": "8080ff4a0881be026cbbcfb8bfeddb6e62ba9c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782513431, "uuid": "435743dd-bf3a-4f26-9ade-08120d7076ac", "comment": "Malware payload (Mirai)", "value": "0c4448ed71ac4ae30f4aff23a769fd546ff95ba8bc1d88ca28b76fe14b35c506e64f962f1d9a315b1596a3513fbb1805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782513431, "uuid": "ff11a5d6-18a5-49ef-a148-3ccfd7ae53d6", "value": "T1F523F981BD829917CAD84377FA0E42CD372573C8E2ED7227DD226F11B7CA52B096B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782513431, "uuid": "f82c1386-a2b7-47fe-b004-c1ce5fd35f84", "value": "768:NuPLlmwT3+tW2u0t51oM5y6w+sEdp+9wnDX2FGXo1XuTCt1o1Nfyt9wfC0wbZn:4TlmA3+tW2u0t5aGs+BnDmgo1Xno1xpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782513431, "uuid": "ac699c3f-d462-4593-bb78-721c0c4c024f", "value": 48768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782513431, "uuid": "79a688c0-62db-4491-8738-8af2dc8b01a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782513431, "uuid": "e871197e-7916-4147-8c10-1bee0099bdf5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9283911-710c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443515, "uuid": "37f5419c-93c6-478f-adc2-1ac43299f366", "comment": "Malware payload", "value": "5ef196e37f60b027767c34fe866b0aa2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443515, "uuid": "0f4c3be1-d9de-439b-85d1-96af8a5eb89c", "comment": "Malware payload", "value": "5b86fde4bb6f7fa46aa39d658f5b9f764d0908463607776f848cc2a219cb52e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443515, "uuid": "c174b9f4-921f-4efe-9f6c-4cbd56c454ae", "comment": "Malware payload", "value": "508dd47d014b3d2ae67077368ae00141cede2f7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443515, "uuid": "d16027c5-d6c2-4ab5-a5d7-eff0080bd3ad", "comment": "Malware payload", "value": "bdad0fb5b22532b91fecec4ca62a2dfebd7c386653fc14d7bbba47cd4244853d50b26a060d36ca1962a2b50a382e4a7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443515, "uuid": "e70250e5-9488-485e-912c-4733dde24d6f", "value": "T151E29E985FAAE272D3D211FAEDE201E4E9E8F4E609CE10DC775DB2111D85A94C6B7830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443515, "uuid": "6a05993a-5f98-430b-b5f0-9b056f7dc788", "value": "768:hn2DtB30rFuglmCBkAvtAEtMHGYpRchrfjgmVQIIqJQOzPRvWzbt6MNl0tU:hn2DzuTQw1AjpRcNfww3dMf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443515, "uuid": "1aba8980-542e-4f9f-9986-2d23147913b8", "value": 33210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443515, "uuid": "d7140bc9-1f3c-46e1-93c3-a61c45e8450a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443515, "uuid": "9fd8f210-9f89-424d-8d5f-12688e49983e", "value": "ufino(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3545e298-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454004, "uuid": "59948a5c-4631-493a-b040-615546b2bfde", "comment": "Malware payload (Mirai)", "value": "f47ea9c9e04547896a020562d688ede5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454004, "uuid": "68c783f3-3efd-43b3-bf9b-5c8ce30d3b50", "comment": "Malware payload (Mirai)", "value": "5ba2f5f6713d786b9a8957ead54404900f93c56b3af3ad933f08a3edfa16a48a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454004, "uuid": "689149c1-0ac6-4235-aeae-f24cf9a801ee", "comment": "Malware payload (Mirai)", "value": "65598a94fa33374dcfe5fe7b1444859edc11d48e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454004, "uuid": "e874fe45-0ec5-4e76-bcfd-44c4da62a7bd", "comment": "Malware payload (Mirai)", "value": "e554684467bc8d8e0f2f8fdd10c86b14e93931c172afd16265cf8cf094bf04fba0464d5c3845917ff03bba5f87211678", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454004, "uuid": "ecba2a7c-9d2c-4573-bc9a-0b5eda058f19", "value": "T1C0241990BA59EC32C05E1D3667FBDB593B0369D14EA39104C460EBCCBB875C0AB6857B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454004, "uuid": "856e6452-ab89-4087-baa5-7d790aca31c1", "value": "3072:fDbXY3kGL71D5oItsE4meiPuBzdWdIAV547OtEmjZ7nGGL72+:fX1G3HoISE5PuNkV54svjPL72+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454004, "uuid": "9bb9377d-edaf-4a8c-acda-8ef29cf752bd", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454004, "uuid": "52da4d4d-45c9-4ef5-b1a3-cb616e06a60e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454004, "uuid": "e63ad41b-6577-4461-b8bc-752ccc3f5f2b", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13f28ae-7150-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782472734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472734, "uuid": "5815a9f7-5396-446a-b1f5-d7cdb199f168", "comment": "Malware payload", "value": "ee80c74b1cbdbbe0a1590fe3666f9054", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472734, "uuid": "b588103a-51e4-450e-a624-d03ce866beef", "comment": "Malware payload", "value": "5ba8e0109fbf8198e49ec8ea7877c3ec34aba8c6748120a6a9ee583adb2433b1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472734, "uuid": "41a1ab99-6f13-4218-82f1-af92ba4a85fb", "comment": "Malware payload", "value": "41d99b1853a7e6b99f10bcc61939635dcb836222", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472734, "uuid": "8d463978-9e56-41db-9ac3-064c06e31713", "comment": "Malware payload", "value": "903b2563e8cafa785acbd08b7fb85e4983031426560679e16bfb6b2e1949f41e47e67fa08b25f09bf45c655190ce7805", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472734, "uuid": "c1276e4c-bd3a-4804-b34f-89d3c789073f", "value": "T161B633523BEDCD3BE38E0832847B47A92621FE14671081CB3748BC6DAD712DAB975B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472734, "uuid": "79ccb4b4-9895-4488-a1b2-09e75e61f815", "value": "196608:E5LmCKBWJxONXVy2SxI4BYU1gVw0gSHC7JwMPBkCE8i1msP3n4uFZEOhExa:E5L/UVyfxBBYU1WwtSUPy8iN/Hya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782472734, "uuid": "e038bcd5-580d-47da-9c9a-45c44b243ac4", "value": 10706944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782472734, "uuid": "0629603e-e12f-494e-9b99-a7177984b45e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472734, "uuid": "a44d7524-9799-4642-b6d6-254027b767ce", "value": "MT4-Automatic_MAX_BOT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f11bf1e-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479066, "uuid": "7c96eb68-c5e2-436c-a203-a92cbdce2ff1", "comment": "Malware payload (RustyStealer)", "value": "4108abf102718acbb7fd311e85254a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479066, "uuid": "9e2db6e5-5e8b-4081-bf55-481bfb2ca8ff", "comment": "Malware payload (RustyStealer)", "value": "5c216d28d26f5486f4e57104378134ec54564c23f312de17b6c3699bb8afc5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479066, "uuid": "ce39cbff-2631-4848-89d5-d14d1e91449f", "comment": "Malware payload (RustyStealer)", "value": "456352313684b55dccc544cf7c1b34ef28c877d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479066, "uuid": "240d7aca-9247-4433-b0fa-0b299b28c3bd", "comment": "Malware payload (RustyStealer)", "value": "a69121be9651ab96d1df5f0c5cf692cfc6645c7fe914b9d0005da14d09af9fc327736606ffd8e0687a3678c90d6e0f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479066, "uuid": "c4c4515b-0611-4feb-b083-97ce0b003a1e", "value": "T167168C03FA9581E9C0AEC139C75A9233EB72F88D1624B79B1BD44A212F57F605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479066, "uuid": "bc7f1061-5d1d-44dd-b216-54cfca35ac63", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479066, "uuid": "0c543944-4486-472d-8e21-c8c96a20e600", "value": "49152:8/ZP9U+uXvw9urPEk27lUzp53jzh2wXiyfQU1ogsLkqcDaHPYC1jxqhyAHdGid6C:8/DBuRVfhP7fQqo0CkyIGFiQHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479066, "uuid": "af2e83a3-4965-43e7-b1b7-70e48fb22f7e", "value": 4210688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479066, "uuid": "b3e82fc6-5121-4bcd-91fa-13e3d4d0ad76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479066, "uuid": "deee44b9-1862-474b-8702-575faac5388d", "value": "5c216d28d26f5486f4e57104378134ec54564c23f312de17b6c3699bb8afc5c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2152ac5d-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478882, "uuid": "7d6506db-843b-421e-bb6e-8b572a2b88cf", "comment": "Malware payload (RustyStealer)", "value": "4b248d55ae517ac46c0d2ea215fba348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478882, "uuid": "70ce9f96-b694-431f-89f2-d8f8110c06f2", "comment": "Malware payload (RustyStealer)", "value": "5c59483ca6ec22fa2181ea5c15de7fa36d4d69e80ceaf92230d2d85768b96624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478882, "uuid": "65867343-7f7f-41bc-819f-dbac66f5cc13", "comment": "Malware payload (RustyStealer)", "value": "1455004b2657a35ff4e7d9118109b33260567042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478882, "uuid": "425c3aeb-494e-4c0b-a7a4-984f687cc54a", "comment": "Malware payload (RustyStealer)", "value": "1a606e8a17fc92dc0c4481c8ef484447cad3ac219c547f0c209f8fcc993906262ec239b08df4fe57d3fbb2f30b9251dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478882, "uuid": "1182740c-6101-4368-9f4d-1c0f8d787ee5", "value": "T1F9168D03F6A581E9C49EC139C31B9233EB72F88D5624B79B2BD44A212F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478882, "uuid": "61a67275-9da5-4eea-b30e-078523b53a0e", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478882, "uuid": "bcd187e6-52b4-4112-bbeb-d6aaf6d29d49", "value": "49152:bHSYxnvUT7lq7Yutzt5ns0W29cW1mI/HL5T1ogsLkqb4yz26ukMGu729+JkGPgvF:bHzvos4Sn//L5hoqpGd9gk9vgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478882, "uuid": "188462da-ac91-44c6-90ad-bc5619efd36e", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478882, "uuid": "96e0059b-9498-4f96-a4f2-827e28c13b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478882, "uuid": "b0e19b5d-d508-46d2-9554-c71d876afcc5", "value": "5c59483ca6ec22fa2181ea5c15de7fa36d4d69e80ceaf92230d2d85768b96624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a416a-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478838, "uuid": "dfe79b84-d515-4a77-952d-743b353edc5c", "comment": "Malware payload (RustyStealer)", "value": "f6d811e5e564b528eadd6bd2440d4ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478838, "uuid": "563fc7fb-a624-4954-b8b0-53f3f103c228", "comment": "Malware payload (RustyStealer)", "value": "5d6e64c2e229f0c18bedf78483cf6560539a87a31fec009a205cd369fcc7ddb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478838, "uuid": "fc8bb602-443e-4929-8e62-801913dee3d4", "comment": "Malware payload (RustyStealer)", "value": "cf580e95d3f29da1f273166bb2b341105dcf163b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478838, "uuid": "4fe00695-dae9-45d8-b1fe-c2876ec692e4", "comment": "Malware payload (RustyStealer)", "value": "2dec8beffc3142c12e49643176ead2d538e2796d0da692c985bacbbe57df29d0c690efd2a013e84adc155612f3ce08db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478838, "uuid": "e4981884-b764-46f2-8480-b03b0a51f1ad", "value": "T1D7167C03F79581E9C4AEC139C71A9233EB72F88D1624B79B5BD44A212F53B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478838, "uuid": "577c7e9b-a819-43c7-a9bd-6b2eb340f24b", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478838, "uuid": "2950104d-6dc0-49e9-be7b-f07d39f1a948", "value": "49152:2ae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uuCRZuXLrf:2rcb6qUgJIfQqoKX151CKXLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478838, "uuid": "2a096956-7f4a-4138-8b4f-dad49bbd5651", "value": 4209152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478838, "uuid": "d28d86b8-658c-4873-b9b9-eba179e00725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478838, "uuid": "56718821-5665-4023-87c6-26f0a335ca77", "value": "5d6e64c2e229f0c18bedf78483cf6560539a87a31fec009a205cd369fcc7ddb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d56985a-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479090, "uuid": "e3b6fb3d-1f53-4894-b397-e13356067d3a", "comment": "Malware payload (RustyStealer)", "value": "ffd07b98c369a9b381e5e84c147dafd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479090, "uuid": "ee0d41ce-8b2d-4d45-95ec-753693fb7251", "comment": "Malware payload (RustyStealer)", "value": "5dd680fe24cca11f4b082a57d44c8ab03bd4d11ef338ca348d8a2863786dbdc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479090, "uuid": "b24776f3-f1a4-4416-b2e6-ce162892e43e", "comment": "Malware payload (RustyStealer)", "value": "04e8683cb31804e309d83b3137219149ee78e0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479090, "uuid": "7b1e0469-2972-48c2-be89-1ceb2570ad12", "comment": "Malware payload (RustyStealer)", "value": "9e921099f8bb5eb11a04d508da8c0d4e6f6c1e93ad14a062f49b39c44b9f32b1413d41cc87ba42e61ccb1f27f51442c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479090, "uuid": "aa3070d1-c2b8-4095-8b3e-1f28d151e1ca", "value": "T187167C03F79581E9C4AEC139C71A9233EB72B88D1624B79B5BD44A212F53B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479090, "uuid": "ed167fe9-a7bf-48e7-a802-1f9d3ae98ef1", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479090, "uuid": "0749690a-c715-4526-8d06-4b36f2677140", "value": "49152:Zae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uukRZuXLFf:Zrcb6qUgJIfQqoKX151kKXLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479090, "uuid": "bed23162-74c8-4fde-8128-e5402ffb09bc", "value": 4209152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479090, "uuid": "9cab9d7c-2535-4e81-879b-242938f101e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479090, "uuid": "bf75a900-88db-4031-8e7e-d24c47cd8d77", "value": "5dd680fe24cca11f4b082a57d44c8ab03bd4d11ef338ca348d8a2863786dbdc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a1be11-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782452042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "234de3f4-0e89-430d-be48-879ad0718c64", "comment": "Malware payload (ConnectWise)", "value": "cc942ec648f33d00e6f699fd498c8faa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "13b0d094-4f87-46f8-b357-58248f9fd7e9", "comment": "Malware payload (ConnectWise)", "value": "5eba37d5c72b71290c26f18ca0c6e7b9fafb0c9ce55471778c61f661cb48f048", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "36b1fdee-72a5-44af-bf85-2061974bec8a", "comment": "Malware payload (ConnectWise)", "value": "53914b7af16e903426bb4a880f3196b255aa1ac4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "a05c07a1-c1a0-4eaf-84ec-3d82436f20a8", "comment": "Malware payload (ConnectWise)", "value": "78ee57c425a1ed3a1f6077c857b72e620c4ebfcb0086a659f6c24a24c61558171d158e9cb75c1014353d837edd5f94b9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "a3ea8624-5b95-432e-a166-47e8561cfa10", "value": "T17A46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "d234b026-397b-446f-9a8b-8548d46966b1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "41bc398b-cb81-4a3a-99c5-ac70f1161c8e", "value": "98304:yzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:yhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782452042, "uuid": "7a111b0a-cc13-456c-85f7-896d65685188", "value": 5641488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782452042, "uuid": "492b0ff3-23fc-4871-9c99-b0f59759f9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "43b5080d-ccfd-46df-a151-8dee0349052d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3768aae8-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478919, "uuid": "c0c70c92-51e8-498a-a9c6-ebf69478b2e0", "comment": "Malware payload (RustyStealer)", "value": "c50df4af20305dde4ed6a420bff2ebc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478919, "uuid": "888dc96b-2e67-4f4c-847b-28029c03416e", "comment": "Malware payload (RustyStealer)", "value": "5f5747a210165a60979a95841a602c2758947fb47e70a96a31949b71665a7645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478919, "uuid": "cab69fb0-f07d-47df-a71d-08873aa8811a", "comment": "Malware payload (RustyStealer)", "value": "ed38c8f779fb57139a10e931662482c9c579f078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478919, "uuid": "4448bc3e-eb23-454c-9fe8-e51dcda4b03a", "comment": "Malware payload (RustyStealer)", "value": "ca9ea997c522982ee03621780cf5d9cf6b21627925bd575418d11ce3eff17a3e4f4d91c665d823846a971ebc36074d1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478919, "uuid": "d83f7613-34e3-4d75-ab86-03323e6c7ad9", "value": "T13A168D43F6A581EAF05EC078C71A9273EBF2B88D1620B69B17D4CB612F57B605B5E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478919, "uuid": "f10565c6-06be-4687-b86d-4a69e3e22ea5", "value": "ac24c75129de769cfd950785b3c3d496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478919, "uuid": "9ccc32ea-c2e2-4518-8dfe-4454b91ae5bc", "value": "49152:zSBYLTMG1PKWkQS+a1hbv5Fs26w5tP5sZ1L5T1ogsLkq4UvfrzMJisWrCtZr86GM:zBMPvUwba/L5hoxvYZth8ydXuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478919, "uuid": "d094df47-49dc-4ad5-ba32-0459c7084bd5", "value": 4259368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478919, "uuid": "3e5a8296-b666-4bdc-9685-da580e8c89e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478919, "uuid": "05b73487-de09-408c-b6e4-bc3aa53800f9", "value": "5f5747a210165a60979a95841a602c2758947fb47e70a96a31949b71665a7645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039c4b13-7138-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782462081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782462081, "uuid": "dc8ad19d-e4da-446e-b174-bf49a5f2d019", "comment": "Malware payload (Mirai)", "value": "dd6e3432f893903bbf91e8e48ea44fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782462081, "uuid": "bfb9e065-fbb2-49a8-94cf-388485cad206", "comment": "Malware payload (Mirai)", "value": "60ded09de33be52020e12548982c9ddd52b74e159628fdebf422d56b14d7ee8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782462081, "uuid": "4f7e4128-aa71-4958-9a5d-f8303afe992c", "comment": "Malware payload (Mirai)", "value": "5b6a07df2c56318a0f91e959529ec8d47244a4bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782462081, "uuid": "42786521-6a34-402c-9a5b-10fcf2074297", "comment": "Malware payload (Mirai)", "value": "ef77126ba96e3c18c40eeb8cb48c6ab2a67c72d23d908d01e685406e07c082ab92ab4af24e3f46c025034bc2e147a706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782462081, "uuid": "f9e1af71-ac7b-421a-aa0e-3bdd505edbb3", "value": "T13EC39E97F24F6592CC2106F40BCB5B9C6E6322228F6BC4E76D0D667729B90DF49063D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782462081, "uuid": "16cb905f-7933-4368-a2ed-ae9d2f129c33", "value": "3072:EN6FRIOPClpQcXDw2TU1/ELsG7gy/w9q:EH02Tmys9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782462081, "uuid": "8d94b828-dd4f-42c4-aa2f-be066974354a", "value": 124428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782462081, "uuid": "46ad3a63-fde9-44db-9d64-1effd2d9cac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782462081, "uuid": "361d73b3-4bd5-42e4-b44b-65b6a8dc0490", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f96d4cc-71a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782508245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508245, "uuid": "e6d71b88-3057-4551-bc73-05b4fd1cc011", "comment": "Malware payload", "value": "7167e8aabfd40846e1e9d22f2878f2ea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508245, "uuid": "87ea5003-aaa3-49b8-9bf6-61efd55a07ce", "comment": "Malware payload", "value": "62ae6518076f30d48eebc7a111f2cf7df2d0f29f8a7e82d9dea57141b18fa24c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508245, "uuid": "0685c496-41c9-4dde-8d94-d3c8bcff97dc", "comment": "Malware payload", "value": "e7e16c034e6ebab9512e0b73f92a953dd41411e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508245, "uuid": "e4fa04fc-1a85-41c2-ac39-c409cde80656", "comment": "Malware payload", "value": "03bf8a709000f9f71bd375cfb8cfbb1774a2b74f51d0b66edee5eb3ab981ab3e2ca76fc107885afd263dce90d70c0523", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508245, "uuid": "0b8e9a40-43cf-4aa9-a00d-67c72cd95942", "value": "T1E5062706699008F6C09AA23D94B7519A7E25BC0B0B3DE7D7EAD076782E763C0397573C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508245, "uuid": "4c46e10a-2902-4ece-9ffe-69bfbba6d0cd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508245, "uuid": "e6bff17a-93fc-4414-b164-7389a9fa4913", "value": "49152:KD3CWAKPTbmBa66/mWP8N/cbCDkwYqLd6QfSdYfz15jAxNa:KB9PiDkwYafSdQGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782508245, "uuid": "79c14de0-178b-41ea-8f5f-20d05fd91671", "value": 3810168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782508245, "uuid": "3b7ed42e-fc28-4374-b094-c55c1655a513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508245, "uuid": "0f83f526-ea34-4b11-af23-80f99b51e9a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d09bffe-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782458258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458258, "uuid": "73ca4d53-66f8-41ea-b801-f220b30f4979", "comment": "Malware payload (CoinMiner)", "value": "d73740325c106a3f146f3427dba647d1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458258, "uuid": "1dc7ce93-054c-4fb5-b07e-1346818f77f0", "comment": "Malware payload (CoinMiner)", "value": "62d857ff3063ded20fdab8bc4587d8d03c9873bfe2b68d31da9aff888bde76ca", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458258, "uuid": "fce53d28-41ab-4c56-ac18-5b1e918e0194", "comment": "Malware payload (CoinMiner)", "value": "25d26aa4f781883101bfcc02b5cac40d8b364740", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458258, "uuid": "65261b04-b7e1-4abc-9b67-245ba7a3ea2a", "comment": "Malware payload (CoinMiner)", "value": "07c25c09cd6bb4ebd6b31e999a0bc0b009bc40e11efa82fb63e6750602f65ed708d022fc65c2dcd25647917aee0ac66c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458258, "uuid": "df846c8e-af7e-4698-9eae-55c1d4ef60f0", "value": "T1453418A9BC40DB66C6E427BAFB4D429933134F74C3DD3509C9241F2936FB95B0A3A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458258, "uuid": "ee7c5e02-78b4-4dd3-8f65-140fa0dd3777", "value": "6144:u2S8MtFP5jZ+mPnCpyAWUr2xnMew7ou1VbY3Ed0UZO:NMt3jIynYdWUr2xFunjVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458258, "uuid": "903743eb-7f7a-48d3-b38c-2c2aed7553c6", "value": 235336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458258, "uuid": "344dabff-81c9-48e4-9fef-13828dc4f5d8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458258, "uuid": "9d8c8152-4647-423d-bfa9-6f64e26d44f0", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c9dfd4-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479057, "uuid": "19f8d0bf-ae3b-4d87-8791-ba17be7ec39d", "comment": "Malware payload (RustyStealer)", "value": "4aa2ec181bfe0f1203f864b02479f378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479057, "uuid": "35c77d7f-3195-4478-89d0-4290b3a2fd16", "comment": "Malware payload (RustyStealer)", "value": "639a967478596859c4f728c7e9683dbd76de1120bc17ef1dc33a2e3e613bd7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479057, "uuid": "c545f241-2fc3-49d2-a598-301997dc5394", "comment": "Malware payload (RustyStealer)", "value": "2bedbd69f4208849df3131e053bfe2806bdf5101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479057, "uuid": "b2555a3e-a233-4e38-b482-35372acd8c64", "comment": "Malware payload (RustyStealer)", "value": "c64b24ae5c668661895e5f5386eaef1a9fff80e57416a7b7e0680250a6961ed13ffbbadf352724729c6c97a330d559c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479057, "uuid": "7912b932-c1e2-45c3-b25f-ed45e38f0cae", "value": "T134167C03F79581E9C4AEC139C71A9233EB72F88D1624B79B5BD44A212F53B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479057, "uuid": "358679ed-3152-4bc7-bb96-61ed4c63dd4a", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479057, "uuid": "65b988c8-b0fd-431e-8a4f-97fcc3c67d00", "value": "49152:Sae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uuQRZuXLjf:Srcb6qUgJIfQqoKX151QKXLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479057, "uuid": "06716b42-3a41-46b1-bb71-4690f7189655", "value": 4209152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479057, "uuid": "f0ba9aeb-8b86-4cb0-af50-50855a964615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479057, "uuid": "bbbbc390-4a3a-40e1-897f-dd8968283f9e", "value": "639a967478596859c4f728c7e9683dbd76de1120bc17ef1dc33a2e3e613bd7e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1c6b9d-712e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782458124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458124, "uuid": "b6308175-3ba2-422f-b2a9-83812c30e590", "comment": "Malware payload (WannaCry)", "value": "05bc0b688aab214473001bc5eab65e9e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458124, "uuid": "90a97bce-5adb-4ba5-b082-3a417b46b8e3", "comment": "Malware payload (WannaCry)", "value": "64448ea4838e0ab0dcd9de260b0d09c7f9c4f6d6068e051c3f580cf4465fafed", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458124, "uuid": "85a65d56-f06c-44b0-bbd2-b112233de654", "comment": "Malware payload (WannaCry)", "value": "b120a997c406475a3c32bf9d2da3a26a21ad11f0", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458124, "uuid": "bee26d99-5ab9-4a96-815d-c1fe608064f2", "comment": "Malware payload (WannaCry)", "value": "50b9c2b2dd14aff055101cefd2246ae7e3546e6868bbb4590bb1e053218e35add6592cc21c741a4fbc9118ff1fd8940a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458124, "uuid": "d1f4019c-d73f-4984-8a52-9a54e06bc846", "value": "T12B36239932BC91FCD10619B484B78E12F3B37C6A12FE5B0F9B40857A1E13B56BB60752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458124, "uuid": "26ba77a3-4bda-4412-b4ff-a96880dc228a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458124, "uuid": "37d8e13a-7f8a-47be-bcb1-bc2586153386", "value": "49152:jnXnREMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DXSPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458124, "uuid": "1b26f3e5-2e52-473f-9415-5faf4661071e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458124, "uuid": "bee468f1-1f44-43a8-8b65-c32588f91fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458124, "uuid": "ab95efd4-580b-4a99-82b7-d5d950e2d055", "value": "64448ea4838e0ab0dcd9de260b0d09c7f9c4f6d6068e051c3f580cf4465fafed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094fcda7-712a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782456078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456078, "uuid": "cb4f9cfe-fda3-4c81-a89f-eaba3946b4ea", "comment": "Malware payload", "value": "253c4c2aaccfad760ee3fd925ab95ce6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456078, "uuid": "53f6a856-94c6-4d2d-bdca-fed690eb2e85", "comment": "Malware payload", "value": "66a63f93b3e724c3fd519efbfdca8edaba385f95f6ff32af9162828d63e2869b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456078, "uuid": "39b0e522-2d80-4e91-b762-e9c74c334126", "comment": "Malware payload", "value": "26543d9adb5418920259449a32859d04938d1e47", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456078, "uuid": "e6f4e7bd-f2c3-4d22-b373-c046d5b137e6", "comment": "Malware payload", "value": "5332e37cb775afd86dca658bd94692a0ced603b2baca5406b7d90fe97e8a070bf2becf7926803c4b1f24d9a8edcd02d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456078, "uuid": "eae55bdc-4ded-4ea8-971c-7d2a761381f1", "value": "T16E136C6526953C25AE99883B5C7E2F0CBDA983E2304491DDBF8B3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456078, "uuid": "1be3b4a2-6e5e-4762-b9d9-0e359cbc89ec", "value": "768:Kr9NyXsZztCN9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:0HusZvco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782456078, "uuid": "bde84576-7de1-416d-84e7-901b5a62889e", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782456078, "uuid": "27a5fbd4-6261-473a-9160-fd532c9c2c50", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456078, "uuid": "1ef14756-1185-4106-9ea5-29e6929e88d0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2600881-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782486426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486426, "uuid": "4f7fa406-1b0d-432c-9a2f-3a26140dc6d3", "comment": "Malware payload (Mirai)", "value": "765c75f296339130e8afaa3f791d76d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486426, "uuid": "4e0ae5a5-dbc2-4bff-bae1-d9bf0134f761", "comment": "Malware payload (Mirai)", "value": "66f7e71e7d3d3fb3b507f5d53c80981898db834efb3d17df1bde50aa055918f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486426, "uuid": "a75ad3d7-8875-4b10-befe-ea9e386f906e", "comment": "Malware payload (Mirai)", "value": "a9a7af51914f05a96d0211c7d47a75a98cade4ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486426, "uuid": "e18833de-71c6-48c4-9ae8-6257b1632419", "comment": "Malware payload (Mirai)", "value": "eed7581071b1b8643dd678a8c0961642d9de6845563d4e7d7c9e757b61197f53de318967ea2332e83e588897849b1234", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486426, "uuid": "e9c20481-fe45-44ef-8b1a-4e99630da7f9", "value": "T1F5C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486426, "uuid": "695d317d-14a2-4611-8096-66cac5cbbe82", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3n0j:IaOulLUUogcQ9BvMEWSWC2h3n0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486426, "uuid": "b99c1818-526d-4248-bcb6-f29d08034210", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486426, "uuid": "f37cf172-2683-4535-b022-a970340bc692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486426, "uuid": "bee936ca-ee1c-452c-a5a0-db17b7de93eb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a57da8-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782441764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441764, "uuid": "5633d8a3-413c-44b9-9ebc-cf94c25001fc", "comment": "Malware payload", "value": "ec6552d0b72d70dba3a0d762d56288d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441764, "uuid": "e085c54c-a216-498c-8b36-586b930bc4d6", "comment": "Malware payload", "value": "68578e5b282998f83fab1a93178a2a2868ae451e114245de902322de44c798ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441764, "uuid": "fbc7843f-d500-4e4a-bd88-d53c204e61df", "comment": "Malware payload", "value": "5894bd3f74c9baf006e26245e2fc9d376956936f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441764, "uuid": "115ca690-b453-447b-90f8-100bf5b717c8", "comment": "Malware payload", "value": "323f7aa19767d0050f15930a35241f2653b295630f471e2b0abf479b2ae65818278ffef23eb88f1727e7415480f96ba1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441764, "uuid": "38b4f1e9-4f1f-47ab-82e9-1dd0c7650e6f", "value": "T189339E29B21FE136B2C31C6A81F709B1AB2468F709A49BDC4B05722D757D70EA4F58B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441764, "uuid": "4ff3aa6e-4ffa-46a6-b38b-4a8ee768c791", "value": "1536:nNLjZ/Ba5iUEyJnSMVp3GDNVlf5GfJL5MF5:N/upnf36N/5GfJL5Mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441764, "uuid": "12a2cb08-ea5d-4bf2-b0f9-c4ec64a0473e", "value": 52834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441764, "uuid": "bd3ea0f6-57ca-456a-b736-c43488d36bf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441764, "uuid": "5e11a20e-715c-4a8c-8657-7e8710f406ba", "value": "ocafa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3591caf4-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "99ee340f-2c75-47ab-9821-fcd3d8558e4d", "comment": "Malware payload (Mirai)", "value": "3e4570398a68a17b7a822c3a6a3be265", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "a053d507-7fa0-4a61-b22e-87d069002c84", "comment": "Malware payload (Mirai)", "value": "6a25430af4ecd08d0583f407e2fb64f4fd7367939b24a149305d2767621ebd78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "16cd14d2-8f11-466e-abc8-81d696af99c3", "comment": "Malware payload (Mirai)", "value": "3713bc70b22984274f70acdef0feee1a8a9bbd4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "b8d1b6e5-4fd2-4ad4-8784-2a7f3acc9f64", "comment": "Malware payload (Mirai)", "value": "c6da3b5d9a3f8136b928dd26d7ee72be78e7f1395e5d5d9509f1773199fb08a2ce050484ba9c0209598c6ae2d99f545e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454005, "uuid": "540847d7-fb60-4083-8ed7-a83f57e847d2", "value": "T19114E946BD518F23C5C311FBFB9E429C3B2667A9D6EB3102DD256FA437864DA093B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454005, "uuid": "169b999b-e3f0-4d73-9470-3073f9a86580", "value": "3072:e+CjkHBQMdrMUTbAj71scdHTKTVlTVrERaCAJh8wUxKKjI7nGPdL:2eB5HTcH1xFWTHTFERaCAX83KKjDdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454005, "uuid": "dfececca-42a3-463d-a6b2-25b4df95d043", "value": 206172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454005, "uuid": "9db23bb3-de7e-43bf-9ebe-88e8915cbb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454005, "uuid": "a802b03e-aa86-4ead-b24b-7c2087b2e22e", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b9b865-715d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782478141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478141, "uuid": "76f42e64-c52c-4d2b-b05f-e28e9b545b55", "comment": "Malware payload", "value": "c559cc68986933200fd5d9e4388e2f58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478141, "uuid": "324afac9-c38f-4d7b-8086-dcbf079d10ff", "comment": "Malware payload", "value": "6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478141, "uuid": "0528a2be-a093-4f4c-ad47-0fb9e78c69e3", "comment": "Malware payload", "value": "23fd50b3bcc06f5adcbd0122c32260786ec3b98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478141, "uuid": "312e492f-780b-4351-92b6-fd23d9f67f8f", "comment": "Malware payload", "value": "52e48a0f211eb1faf4836b49f270961220a7061b9863fcd5a46e27ac2a8241b4c4d2a14597198bffd703cc47d253be25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478141, "uuid": "f45bf311-4056-48a9-84e8-9df9ae394898", "value": "T1084723966AEC50D4E8E9D079CA575A1BD7B2FC601231925F00E57B8FAF733110E2E392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478141, "uuid": "635b613f-1563-4ee8-8668-2f805f5bcd9d", "value": "fbafb810c876b44d3c17f95c3d57cec3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478141, "uuid": "26bf5dce-f110-4051-a061-8f23f13f9c14", "value": "393216:I7w3GcyVXOCNcZ7g7HnmoM4YIPT+pBrvBTcpbYUx+7xQxzCau010Y4F:tAXcJgjm+Y+iB9w6UxKxbaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478141, "uuid": "d361fea3-f018-413b-afbd-446b4613e42b", "value": 24626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478141, "uuid": "fda7107b-0897-4df1-96c9-cd7f9598c0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478141, "uuid": "c35672f3-8a73-4402-8948-ddbb4a02a7ac", "value": "6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350c1ecd-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782458299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458299, "uuid": "274be42d-c919-4b01-ac94-575ea50096d0", "comment": "Malware payload (CoinMiner)", "value": "6797f4fc6b7c6f8d9b13537177a994e0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458299, "uuid": "9f42057e-64db-4868-bd5a-1dbf6d5e1e0d", "comment": "Malware payload (CoinMiner)", "value": "6a681f9ae099ea9150a1b4d4a9ed82f814ca088e133bcdb59b6ba6ad44af3f66", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458299, "uuid": "4a7c275f-7f55-429c-9137-95c19eb5429f", "comment": "Malware payload (CoinMiner)", "value": "8025b3f0b0d2acdb0942b558c43ced55bc5dccda", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458299, "uuid": "86dc9712-23b8-47c1-9c6d-40e2ac9a14cf", "comment": "Malware payload (CoinMiner)", "value": "a6fb837778455d950d164cd682bdd194338b28c1c405a828a307c59834ab675b71f12a44e323ec3996339dd5b156be8f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458299, "uuid": "0d8030f5-0b14-4ca2-8d5d-0991d4487595", "value": "T127B312B1443C8528D13678B36D21EEA86B930E75341D983D2FF0785224E6C49B8E4EBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458299, "uuid": "e268d695-d2b4-4a79-822b-d579c9a0087f", "value": "3072:KYe+8aomTHO6/wHz1S46WNM4RzH34u+qgw+41:91THO6/Szs4RNM0zHg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458299, "uuid": "b85e6f39-517c-444a-a712-9be18007a708", "value": 110908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458299, "uuid": "a276a43d-b782-435f-9b38-ce4dabdadfbc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458299, "uuid": "48e43435-249c-4bfd-8aad-5740bf677122", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb32619d-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782441773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441773, "uuid": "3f3dc2b5-ecdb-4840-a499-fa592d9e246a", "comment": "Malware payload", "value": "96b437b124df80c47304a9532c407690", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441773, "uuid": "c0f769b8-a674-43f4-8e31-3a98cb53a43b", "comment": "Malware payload", "value": "6b4bf5836cc3e974466e83a1e739d6ad9df789578d1f14a961c20b3f026f4802", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441773, "uuid": "86069ed3-13cc-4c99-b2b3-0cadd060b999", "comment": "Malware payload", "value": "9327bb64b4577a7f84bee17f78506086ed62dcdc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441773, "uuid": "4620c2e1-80e2-4469-9f26-986381de210f", "comment": "Malware payload", "value": "069b3c8faa7d7cf30ce12979c55e62e57b01c46fa9e3730ef5526e9e43b3a4719ecce1ec05e3efb7a10437c2a50fb26e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441773, "uuid": "90ba0e93-aedc-4e4b-9118-4b06bd75787a", "value": "T1E6E29E6EF241FAE943535A82B95E0AD1EC6CE9F7EEC19576C340A415AFCC82400E94FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441773, "uuid": "933a3b94-b989-4ecd-9ecd-9339f5ae41b6", "value": "768:zlKzWDCsNbacUgKKSChJzXstdWz2ERLR3FEl2YqGDJjubtpMN60tg:zlKzWDJ5acvPhdXst62ExRGp1DIMol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441773, "uuid": "00cae846-8819-4f97-8e47-ed25de1107e2", "value": 33250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441773, "uuid": "1bb644ed-d973-43e6-8e3b-e9b5dd0b238c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441773, "uuid": "4a1676e2-757c-4216-87ad-307a35c0db8b", "value": "ufino.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e15e2-718a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782497711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497711, "uuid": "94710921-9ef2-4ed1-960f-35202fe7f145", "comment": "Malware payload (Mirai)", "value": "c6b4d0f0acb7f902d6ee8e31b792dcb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497711, "uuid": "45904bdd-c423-4e68-ae7f-680b939d9334", "comment": "Malware payload (Mirai)", "value": "6b5feef2f1ca3e77a5b1f8e066ebe820e829793d3c4b8c68525265bfe6fc888c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497711, "uuid": "12435f35-e85b-4fad-9456-1581e3a55f67", "comment": "Malware payload (Mirai)", "value": "e4cfc5cfbe0e25cc97d05ac4c26b104b5815f16c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497711, "uuid": "497f1001-ebb4-464c-978a-d75c93eb6599", "comment": "Malware payload (Mirai)", "value": "f7f7c7a32b85ada448e280be27d542bf2d08cd10b678457352c8d805dd6f39710065609ae84aa5b40dbafc1e2be1b940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497711, "uuid": "f5146637-b4ba-4ccf-a2ef-fcbd68600960", "value": "T1EC43F1EFF7FE84929034507D4A6D36358C103259B2D1FB9520B8922B9CF3F46699E07A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497711, "uuid": "0aecda65-5b16-4db7-ac05-15e32bd0479f", "value": "1536:RmFliRfHS00OpeD2U3XVS7P0YNG/bnEBmYHy3tZ2JxLs+nouy8ou:RVS72U3XVIP0DnrYEgoeoutP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782497711, "uuid": "6a3a880a-6c28-4176-a3ed-b1c1fb4c872d", "value": 57640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782497711, "uuid": "1b987d5f-bcd4-4b7f-a707-1b535de6e29e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497711, "uuid": "cc6e9bb7-0d50-46d2-91e5-87b5dd30d109", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a6569a-710b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443076, "uuid": "e3c36cf2-25c4-4c6b-854e-3c5b9a55f2bc", "comment": "Malware payload", "value": "d1ec66578091c23fa1d273a74fb28b20", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443076, "uuid": "3ddcac25-ba0c-45ce-a458-b83920b96a49", "comment": "Malware payload", "value": "6b69bae086f89e934ebb648c027786743299d26dacc44a1e2b2470826df29a8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443076, "uuid": "ff7b44d0-e48e-41a9-bd58-5b4e3b96543c", "comment": "Malware payload", "value": "f02261d448a79394daabae235b9ded64d1ad4d41", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443076, "uuid": "1366ea62-9dbf-4bb9-9633-637850694a80", "comment": "Malware payload", "value": "befcc0cd15b625be74799636bd419f846e0379ee1667fa2bed4b8c09aaefdb2a174bdaa166486d3b19f24ae9ddd7a0c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443076, "uuid": "63ae4333-c544-4ee5-9c30-cedcd9e90380", "value": "T158E27D01FFC4EC2A429DDE95AF2259EAF695A4E24EEFBC02C33466D51C50521E71D1F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443076, "uuid": "a0cc3b34-f820-44a8-a253-5a50342fa4b5", "value": "768:XDYe5MWrwY/zENPJR6Xn8aCHOj6MEOQbtpMNb0tb:XP5qeAG38aCHOtELMVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443076, "uuid": "4aefdb90-19e7-4810-b771-472461151a3b", "value": 33198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443076, "uuid": "67bb9d35-6e9f-4c81-a647-bc395465b210", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443076, "uuid": "a7aedade-7218-44e1-bc35-31854443e4cb", "value": "ufino(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969f6dc4-70fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782435699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435699, "uuid": "1c0e6de9-956e-4b4d-be7c-d0042de82a08", "comment": "Malware payload", "value": "800b7838365729a2b94d6ba97022455b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435699, "uuid": "097ba866-a316-4503-9467-7812bd843e5e", "comment": "Malware payload", "value": "6b7c1278dcf4374d7c59c0162adcd92d938c0f1e53e2dc5a3628e82a91b9bf42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435699, "uuid": "07663130-80c0-4d82-a539-4e39e6c4c85b", "comment": "Malware payload", "value": "32e2378010f64e62658d8d328dd4fcdcca386dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435699, "uuid": "1002213a-135d-434d-836c-8031d1e5f320", "comment": "Malware payload", "value": "6adbd4697197974f273929c91d8a318c26c07184d1a9ffe2a7cbfff301076acd0309062c6c66e7abb7d26e943e04ebdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435699, "uuid": "90adf95f-9279-45f6-8c98-3415caa1a9d8", "value": "T1AFC7BD0773E60095E9B7D2388AA75507D773B8634731CADF329D06152FABAD09A3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435699, "uuid": "263b07d0-4b15-4251-8d07-b222a16079ae", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435699, "uuid": "3fefab23-5e08-4bc1-a0d5-46737ede7426", "value": "1572864:siAQIHmkH/9zTOnGCnkP/hN5QGeuBhdeI:WmkH/9HGGCnkRNQudeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782435699, "uuid": "98a0e058-dacb-4ace-aa6a-59f0867ff373", "value": 54108811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782435699, "uuid": "96464f30-7f9f-44bb-ae8c-8f6246effe77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435699, "uuid": "72c52625-7434-4743-a96f-40067f2a091d", "value": "SystemUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bc001c-711e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782450923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782450923, "uuid": "6eb49d79-3b6e-4c01-b83a-c640862ddd72", "comment": "Malware payload (WannaCry)", "value": "c07b63592f8dc5a0ec4d827ec738a643", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782450923, "uuid": "992130d4-a972-4ebf-bdeb-f37499fb4e48", "comment": "Malware payload (WannaCry)", "value": "6c4ff1e13fd9657078d5b55dbc5ed341ad1a0e674dfaf39d850b4823ca09b814", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782450923, "uuid": "418ad0df-684b-4687-8bdd-f4c32588362c", "comment": "Malware payload (WannaCry)", "value": "4b8064b9489ac9815b6befb6f02560752ff495c2", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782450923, "uuid": "0b2d0b83-86dc-45bd-8e91-d22b0e8b8b25", "comment": "Malware payload (WannaCry)", "value": "db731b36b72565ca97f90a49a6c0f7451420fd7ce9235569ebc26dbd09181e88fc8aed70449636f79c4e60679c49754d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782450923, "uuid": "610a22bd-e1da-4c9a-885b-9cb554ce8208", "value": "T154362309ED18827DD56A0AB400734F19B7B238DDC3BB190F875C5AEA0D933A67BD264D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782450923, "uuid": "fafd9933-5aef-43d8-80da-f4d9993712a9", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782450923, "uuid": "e821e807-595a-487f-aa78-a932c9f6dff1", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593Rk:DyDqPe1Cxcxk3ZAEUadzRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782450923, "uuid": "9b6a8d1e-ba14-4502-b2d1-4a0660d0e3ea", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782450923, "uuid": "8b4531fa-c83a-4c8e-b603-ea084799aa9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782450923, "uuid": "f39ed0e4-34d2-4275-9335-0d19bff09223", "value": "6c4ff1e13fd9657078d5b55dbc5ed341ad1a0e674dfaf39d850b4823ca09b814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87114bb-70fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782435729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435729, "uuid": "13e0e767-b28f-4117-856c-51a503da6306", "comment": "Malware payload (Mirai)", "value": "0431fba4f562dae5691fe3833af2413c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435729, "uuid": "1059fa01-5475-4fd9-bd3e-b513f81ecbf9", "comment": "Malware payload (Mirai)", "value": "6d95be925f16dbe7cdd83de323b9a22659c2754718642c34947d15034f704b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435729, "uuid": "f089e747-94a4-4709-aab3-f60bd309ce44", "comment": "Malware payload (Mirai)", "value": "3a84b8edaf1b15df237a02cd90c0829476a53907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435729, "uuid": "de39961d-d245-4dbc-accd-02048c91c988", "comment": "Malware payload (Mirai)", "value": "ea00e6aa6dffd7de38a83a6f17a4c220a515e3ded1462c08132cec50eaf10825cfdbe654544de45a3b8ca79fe1a3e49a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435729, "uuid": "575e57b5-741d-4c4e-beb6-0058355476fa", "value": "T1CAF3974A7F228F7EF369877147B78E21975977E616E1C680E26CD5001E202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435729, "uuid": "6af7944d-ea9b-476e-98ac-98c38dba8070", "value": "3072:6MoIGae/lkW0e+RNlrQoVtqp/33PLKf0c+XDYJEOAY2:foIG7GWTMfbt6PGfosJEOAY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782435729, "uuid": "1839659d-7183-431e-ab2c-d95ac4039733", "value": 161988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782435729, "uuid": "082fddf7-ca46-462c-a6a0-1f90c648ae2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435729, "uuid": "94a86546-b1b5-40a0-861d-f9e95c29022c", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b584a1b-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479033, "uuid": "a74c3138-0ea0-4657-a275-4707d2108688", "comment": "Malware payload (RustyStealer)", "value": "5b356e439cc173fc59acb80072432154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479033, "uuid": "bf65d85a-9675-4def-8ab7-f05f1d71886c", "comment": "Malware payload (RustyStealer)", "value": "6d9895fc54df40b3823deb7ffaf83754f00ce9085ce7788b735a9d18c4be7442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479033, "uuid": "1abc082f-ba4a-48ec-8716-f0f66d03f4cf", "comment": "Malware payload (RustyStealer)", "value": "e5048317d58f489488c62eaaf0c42ecbb31062a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479033, "uuid": "f2baf4d1-3c9a-4ebd-9496-db72b41df50b", "comment": "Malware payload (RustyStealer)", "value": "e8a0321b1331fdba3af686fe095d31050437b9d3cdd30364db5f2eaf9cbe1ac75ee27382a2b2e546179cd85adb250840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479033, "uuid": "0adbc5bf-7f6a-4928-8d84-41289658fa1b", "value": "T1FA167D43F69591E9E65EC038C7165633EBF2B88D8A38B69B1B84CF612F53B601B5D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479033, "uuid": "a4317770-e7ab-4408-88db-5c57eb51dbac", "value": "49152:rYqGJaLNcwf/KVVff5ONkVSyGSq0M+PAE1ogsLkqBW7eaok40dKtJoDISlgD7ZE:r+av8VztvVPAaou1UJcI/HZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479033, "uuid": "66e55441-69e0-42cc-afa0-1da005863b83", "value": 4218880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479033, "uuid": "85e8eae1-4c02-49d2-9630-580a145e4deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479033, "uuid": "8e21eb32-57ab-402b-8d22-4928391373eb", "value": "6d9895fc54df40b3823deb7ffaf83754f00ce9085ce7788b735a9d18c4be7442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb603dd-70fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782435793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435793, "uuid": "9f934207-415b-47c9-b1b9-f91113d5e225", "comment": "Malware payload (Mirai)", "value": "5b54bc12bcd114a68b5ce7cd23fad680", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435793, "uuid": "bae5e077-f744-4a49-9a79-2ad8d6438e40", "comment": "Malware payload (Mirai)", "value": "6dbbc710a4b25377fd2ff447e82d754e5e51c49ed224d807b04d275e53bcead4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435793, "uuid": "48cae66d-c02b-4a4e-87d2-e9c26f8c5fa7", "comment": "Malware payload (Mirai)", "value": "c870d5d43cd47384dbb2847316199cd8e7386230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435793, "uuid": "8c7cebb6-6033-45d8-84ff-9b8405e52221", "comment": "Malware payload (Mirai)", "value": "8cab7131ad278fcfdccb700fc9729cf5c19f85fd1d8a76dee6a32d362a28e7d2d13435c37557522d739b5588aaa46695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435793, "uuid": "ba1249d1-498f-444f-9d1a-59b60ac7c81d", "value": "T15783AE93C4A62E88D19566B1B0B1CF799B13D06156930EF7659BC6BA408BCCCB14F3BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435793, "uuid": "8468d6be-94cd-40dc-9394-ca866d86ebcc", "value": "1536:xJAPLVLYftV2BOFyYNRnUh2RRKgcb37gOuc2C/cv4q:rQVaIOFyYnUh2R4goTuc2Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782435793, "uuid": "de747560-0620-4f64-ab86-65e64db8f3f8", "value": 83712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782435793, "uuid": "73e1f35e-d8aa-46ac-823f-a562523d2d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435793, "uuid": "43f3e8d3-aa73-4fad-aa26-5e8ea2844668", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3734d0a6-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493092, "uuid": "4ecea6f5-75b0-4ab8-be88-4e4fb0ccf3fb", "comment": "Malware payload (Mirai)", "value": "d2f5c234435f003636bdfbeccd8f2d98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493092, "uuid": "84f3d7a5-84f9-41fe-8f0a-857dbad96511", "comment": "Malware payload (Mirai)", "value": "6e262857e6fc5b50a397b602c34c7104706d4edd83215e7fc53ef5fa4b061e5f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493092, "uuid": "f2503485-9b7b-4134-a88b-154678f1a27e", "comment": "Malware payload (Mirai)", "value": "54d74a1ae3c46ebc54762f50f886dd4bc3087e15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493092, "uuid": "3b3536a7-4bbb-498c-a0a8-3472ee934801", "comment": "Malware payload (Mirai)", "value": "b12ab72b049b4722db846167dc39796d179c377972090849e08f116bb0eb4614d2d847b178ae84a37984b94132e0dccb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493092, "uuid": "40dcd1c4-fe2e-4e48-adc6-38ed1ce1cf95", "value": "T1B3E32B03B981C9FFC497D1F44BEBA5359D32F82A4935716B6394BEE11A0DEE02E1D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493092, "uuid": "0ffd2911-7662-4efd-b028-de2ac20761e0", "value": "3072:aYQhfcVySDSq4T5ngXQKPkBowkHmTwWz2Ad8Mts:aW4axXA1xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493092, "uuid": "36515e52-557a-46ea-a6bb-3dba53360902", "value": 155992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493092, "uuid": "58deab7c-5170-44c2-8642-cc7072e65d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493092, "uuid": "05eb240e-5311-467b-9548-4e532e6c58df", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a21a6a-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "f62b8dfc-bb00-4e18-9c64-0da60657f121", "comment": "Malware payload (Mirai)", "value": "b60401943e830fddfd58c2355fc7bddf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "c0b0dc96-8ac0-43df-b942-487fda0dcdc3", "comment": "Malware payload (Mirai)", "value": "6f7439bf79e3d927d6de47c15da095c182e2a8a0455ff04d5c0e3fccbbdbbc67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "afbd2782-f68b-4ea6-bb79-a640996a21da", "comment": "Malware payload (Mirai)", "value": "f52e80aeb3b931eb78ca48f5f5e72d651afd64a6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "34f77f82-fbb1-414c-8dbb-a2ca285a7632", "comment": "Malware payload (Mirai)", "value": "f9ab1cadc256afde79eb7249290e82175996e5bdbef393b2a5c9a97f5114e91ad8ea4122735e2bb2117e08525e462ef1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "d44e33f5-d055-4da2-b4f9-64dda12a574f", "value": "T172045B22DD25AF8AC416A1F0B1F18E789F12BD2548470FF9A5B6EAF44143DC9F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "ac753c64-a91e-44da-885c-d5b3c7e2aa01", "value": "3072:NHihj46GE7VHjcMLjuvAfztkWzJW7kfco0yjz7nGw:NHihj/GEJHjcMLj314Ifwyjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454011, "uuid": "1e48f85e-d030-4f64-abff-c2433abe5b71", "value": 189492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454011, "uuid": "8040e447-2431-4f54-bcb1-ca9c78520f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "6d9a412c-bd94-47a0-9047-6523be696456", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b807ebc9-710c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443486, "uuid": "52341bb7-0aed-4688-87c6-1feab73335cb", "comment": "Malware payload", "value": "455996485a6e84601910f28657e3a7b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443486, "uuid": "89f84b89-6e6b-47bf-8f0d-221a0a8acd7c", "comment": "Malware payload", "value": "7151e925a0dd22bbe13d89ffa527fa87cb2cad798e30f3f621d0fa14d8792cec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443486, "uuid": "37aacb1e-d65c-4df1-b20e-306946506783", "comment": "Malware payload", "value": "098d494a73e908fd1beb2f83b2bfec45042c4591", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443486, "uuid": "3644c6b8-e8c1-4c3d-aa62-54487fd961e3", "comment": "Malware payload", "value": "2364b32574bddbeb53dfacbdf50cf1a7a89bb9e3800b1581c8d7a0636e7f673d1ed96b46bdeadaa11bfc3d50252809a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443486, "uuid": "ba4e9ef2-6599-4793-9a75-a3de3e676bb7", "value": "T187339E09E4D6BC9A4EC15ACB65F13B41E6621CB2C31DFB78470CABC72E9A32191E4D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443486, "uuid": "5d95d23c-1403-4273-8bb8-1cb765c1e8fb", "value": "768:kZKkCoiDsB1Y/IUpwSQkBiDhPhkcnMeCAp5pS3NRXVRuQojhVbt8MNs0tb:kZKjoiY1YzwOiNPhnMej/poRUWMee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443486, "uuid": "1f02fd0f-87c0-4f3b-87c7-fc900c98ad70", "value": 52574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443486, "uuid": "baac18eb-1e44-4225-bc99-399ddf47f48a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443486, "uuid": "ef45810a-9975-4cca-b40a-39eb9f6869dc", "value": "ocafa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c888b988-71a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782510945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510945, "uuid": "b65c0849-f531-4b22-b0ee-e4dbade8cb0d", "comment": "Malware payload (CoinMiner)", "value": "a30a24b3c6dc7c581c964840c3ea0d40", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510945, "uuid": "2c9920df-0462-4f8d-a19b-9e17984830cf", "comment": "Malware payload (CoinMiner)", "value": "722cd9ed22abf4871c76f928fde01ee5b649905765afdce51f6e56bad1d757ea", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510945, "uuid": "7dcb52ac-2329-4005-a3e2-c55586699bc1", "comment": "Malware payload (CoinMiner)", "value": "3f1d08bb570aa77b31cf560928f39c5640a53990", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510945, "uuid": "7469dff8-7832-4c5e-9abc-b3ac0f1f4c41", "comment": "Malware payload (CoinMiner)", "value": "58d99f600c3d47e8762178572f6c8c2a67a7df6cc935ec1262aa553f469f80db5063992a89ec5929e29b9b0dad8e7f2e", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510945, "uuid": "b99c2a50-55fc-4f7b-ac98-8668e3f9c6ed", "value": "T11856E103E5F78EF4C21BE67D46629332AD2474881E32B11C6995F36B5FE0938A19DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510945, "uuid": "99170b85-f96c-4a94-8091-2deb505d7b36", "value": "6929002bee55502723db77da3b156a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510945, "uuid": "c7f9b0bf-57f3-45c5-8c0d-c0d956dcd86b", "value": "98304:NENOtZdFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:s+Zvdemyhjpu6a67buEjcmUInErzvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782510945, "uuid": "01ed8303-5327-4982-9695-c5453ba89209", "value": 6451200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782510945, "uuid": "7a07bd3c-678b-4b04-97c4-7546eedad023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510945, "uuid": "14d757ed-004b-4b09-b12d-cfd9813894af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6948696-714a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782470086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470086, "uuid": "efb300d4-db77-4710-abc6-158904d53f87", "comment": "Malware payload", "value": "f8d9dd10001778e982bb93e0e227383c", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470086, "uuid": "785f2a18-6c0b-46be-a085-976fe0a058fe", "comment": "Malware payload", "value": "73a36bb36ea6e4c879a47474e065e8f2dddcdac1a01ed3a340cb5ea5b6ea4e34", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470086, "uuid": "24272316-4aeb-4dcb-8153-adf802b83a4f", "comment": "Malware payload", "value": "abb07f83219e7f0c1ab7bb9eefb204a90f541c6a", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470086, "uuid": "b2ce82c2-5498-43bb-ac3a-a5d6e66de509", "comment": "Malware payload", "value": "5d35dc1329f5cb6c238dce4f0a540f671ac279ab1c7e2d049dd4df4aad273c6a66812d8367eb69d9d23ea69c9844cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470086, "uuid": "8155ac27-5a8c-4336-acc5-c61af87aae3c", "value": "T117222F4C3DED71AD427EB374633A8420E9067913D091D3A474AFD0B8AF7AA21F671D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470086, "uuid": "3f8be67a-0b3e-42df-ae32-125e0eedbcbf", "value": "192:a9WlsKFZc0JOMbHea2wVdrfz/PlKnu+o/ZxpSOGVwWR3W:a9mby4taCauWR3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782470086, "uuid": "2c7353b1-3c60-4f85-bc47-9f10c9e02be3", "value": 10610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782470086, "uuid": "856f9b69-1376-4579-9a12-d0b88ad8aa2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470086, "uuid": "a52a02c5-4b61-42a4-861b-106622ed4f97", "value": "script1-from-2nd-obf-script.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9d7f06-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "598c0071-fec0-4f7a-a459-6be21ad230b3", "comment": "Malware payload (Mirai)", "value": "254524991f1ebe3f99bc561585b40944", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "6c3d9eae-89f0-4351-b8c2-0ca55180117f", "comment": "Malware payload (Mirai)", "value": "73a95aed2041bf4be2997d939858fb4c10cc3afcaafeb8bc84d0b420e2e05633", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "14aee9f3-4606-413a-b9c1-8ede1611ccc6", "comment": "Malware payload (Mirai)", "value": "2f93b138154fd7a01b28d94d03ab4df285a612b0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "3e80a2e5-4e42-4e45-94a4-b3c7f88a89bd", "comment": "Malware payload (Mirai)", "value": "9d5327f700bb388252b5822b862c65c32072c236f1fccfc2b7573031ec8622142059dc0b5165f100323abfe030219ea2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493099, "uuid": "d97c81b1-46da-42ad-bcac-5744a0ff400c", "value": "T1A4D31963ED229F5AC116E4F0B1F18E791B53BC2A48570EF9A972EAE44143DCCB6053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493099, "uuid": "4ef2fdae-be24-402b-b13c-fcd3c91303a7", "value": "1536:5xKMAdhSKDijWxRMvDCAKkkY77ciNn8t/Hhz8WfHpBvj8vqvQzIHDHF:5xUd4i0vD2khf8tB8W/pN8vqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493099, "uuid": "9a4eeb4d-9041-4887-9a09-89f9ac600202", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493099, "uuid": "bfd754c1-f4e4-42e0-8e87-79b2610c6093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493099, "uuid": "f0777e4b-a089-4e7d-acb6-e1b4bcb23c6d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82e0dfe-710b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443057, "uuid": "534634b0-08aa-4436-83a7-ac2658a61c95", "comment": "Malware payload", "value": "61465cb464e017e802e944257574aeab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443057, "uuid": "a36716fd-fb76-4a83-8d5e-593221d4898a", "comment": "Malware payload", "value": "73a95d572f8246407aaf60e06378fe7075f6e245f78df941b519ad4e034207a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443057, "uuid": "b438c5a5-55ed-4d42-bc82-f385c46d896b", "comment": "Malware payload", "value": "bf760e45c219e039e6d4835f973cab1f7d358ce2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443057, "uuid": "d562f99f-4226-455d-b2bb-52dc1791e8b1", "comment": "Malware payload", "value": "9c8442c92b031903ce54885a18b27ab209eea7420d3f04b948d175d32353ffdf369b2f7c1e40311316e6d4d5856c8e45", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443057, "uuid": "b3844984-07cb-4d9d-82da-d6af14617664", "value": "T187536D22F353EB55A5E794C3A55604604C27FDEEC6F88FC6DB8222390A0EC69E3B4475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443057, "uuid": "54873f3f-77da-4f87-ab72-49514cdcd2a3", "value": "768:uIsH2BigEMdlpOjeN7Ssv2H3eRA92JRjaSUtXRMrfFRdMh0v2+DJ4feQZ4qPdv0V:M2IHaN+42H3eyorbdmLM64wfByc54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443057, "uuid": "15606cad-e666-4868-b261-91693786ee20", "value": 64396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443057, "uuid": "30c791fb-66aa-468b-9ad5-87fdc6805279", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443057, "uuid": "c376569b-d204-42dd-b7b0-1863a9ce5436", "value": "enofa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dca32b-70fd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782437010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437010, "uuid": "329cbe7d-3a54-4ee4-ad58-06b744fd5529", "comment": "Malware payload (Mirai)", "value": "093d0f8ae230d2bfe320f35208784add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437010, "uuid": "da4fbdf2-b7ea-47e0-b9f0-b538eaa6820e", "comment": "Malware payload (Mirai)", "value": "758bfd53af3403244492a07a78388568547092bd62207b48f8f438a3afa9cb3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437010, "uuid": "1651f5a3-2ba3-41e0-bf50-d8851b0ec30f", "comment": "Malware payload (Mirai)", "value": "8ce423b1a9e18920f424a47993c8fd74f4532267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782437010, "uuid": "467c579f-672f-4b26-b5d0-35cde65bf9f7", "comment": "Malware payload (Mirai)", "value": "da064f0d65a6256cb89925872fa2ebdb42f0d5a24854ad3e370fe83e532faaa898a39bac2244fe14d551322b74e4e37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782437010, "uuid": "d412650e-5800-45a5-b3d0-ed5f61214942", "value": "T15B844B52F6A228FDD952C930835D6213E638345943129EFB27C8EB753E16AD06F3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782437010, "uuid": "3653fff4-296e-4017-9f2f-928b0a604d51", "value": "6144:6QVz1G1+NFru5PgDPO/VZGLRFNC1jxPIqO+sZNi8LOiA9DquMhQuhJHE:6SxGA65gqVZG1SJZOf5LOioDZ83H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782437010, "uuid": "9db253e3-6236-4339-99b6-18bc017a45d1", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782437010, "uuid": "9515547b-b113-43ae-8667-9a355f32313f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782437010, "uuid": "3cfc6c5c-be5c-4079-9980-115adbf3f03e", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2065ea7a-716e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782485322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485322, "uuid": "429c504b-e337-49b0-8ef7-4d93f966a036", "comment": "Malware payload", "value": "cd42bb49d88bb17316fd05909f1c7fa2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485322, "uuid": "4b3672d2-fe51-49c7-ac70-8e27a716013b", "comment": "Malware payload", "value": "76a26f4ae513a5ca4c75f67fc9af2fdecb7cfb85ea495b6483db55af4f8ada39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485322, "uuid": "06f93158-09d1-45ae-a440-1054be8acb71", "comment": "Malware payload", "value": "793c8056c8a951c6b23b9f827590562746df23c8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485322, "uuid": "fc1adab4-3571-4dd8-8933-5f7c4faa3a9a", "comment": "Malware payload", "value": "aeddb400af8d36047beb428b65d4925ba3cb64e7d0054f13f750f1467b06d69d721f61077e0efb2b85a42f13f91f8e45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485322, "uuid": "80902e6f-8ec6-4229-b744-7784036e6ec6", "value": "T17756D013B285743ED42F1A790827A660A83B7A612556CC5FA7F41C4CCF3A7807F3A667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485322, "uuid": "560282b2-252c-432f-afcc-5fdb35181fd6", "value": "a3979f3bea909dc8b2cd85c87303001a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485322, "uuid": "694052c6-2731-43c0-9fe0-0b32b62d5985", "value": "98304:K361Z1oUscTBQpBUGcUnwbHmK9HLS2h45sARq8C0:K36SbUGcUwbLVSI4298C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782485322, "uuid": "b2ee9c6f-c8f1-46c9-b76a-18bd043c5296", "value": 6136832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782485322, "uuid": "14107196-a6cf-4443-8960-aa76ccd4d584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485322, "uuid": "fd7787e1-86a0-46fa-9824-c4850492cf8b", "value": "mapistub.payload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50116c9b-7194-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782501723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501723, "uuid": "294db9f7-ad5a-4a16-9abb-7d9e3ff208b0", "comment": "Malware payload", "value": "47e9ce5f4a20a62b4061a5291f0f11fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501723, "uuid": "80740dd6-5732-458d-bff4-0399375ee929", "comment": "Malware payload", "value": "78b674dc41c0396a6a0fb9777155259d46509e4370ebcab97a4807f0ddf2d539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501723, "uuid": "55e7f7b1-f5ab-49d6-a1e4-5567b0407ab4", "comment": "Malware payload", "value": "d4ce7701d4ffe67a96a39434c3b47cea82f837ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501723, "uuid": "5f8b6e87-d2a1-4116-af4b-99b01e8081a6", "comment": "Malware payload", "value": "7beaae7f2a87042c3a15363d3d3f80d0c92745b4fc2ed83fdeb15ae257816d66b91b6e041564b4f7b713476acdcb2203", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501723, "uuid": "ed6fed4a-5e3c-4467-a890-4d4608f4216c", "value": "T1C183022DF61AE65AE42E94F5362F5BD0AF25D430590A84F10F6BC83C48E6AD44C2DF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501723, "uuid": "c02b5c03-508e-456f-bf93-a95a25282550", "value": "1536:Ud4nI6PZdUyFVYTxcpI3R4qC2bbtktAgHyIr9lEO8ADp8:7vdUS1I3Rs2bbcA6rLTN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782501723, "uuid": "3c4d4696-7f7c-4e78-85ce-91b3fedca3b6", "value": 87772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782501723, "uuid": "ba84b267-d2be-4f45-b60c-3977f073f34f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501723, "uuid": "ef073be1-4167-4a21-8c62-e0921ffc5f7c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407cfe8e-71b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782514153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782514153, "uuid": "4d46dcf2-2d9a-4522-8487-d7575fce1694", "comment": "Malware payload (RustyStealer)", "value": "d2af7fda2a30959173439302db23a1c5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782514153, "uuid": "1a5f2693-b815-4275-a75f-e2f0abc5aea6", "comment": "Malware payload (RustyStealer)", "value": "795dc62407f9db38cf3aa0f70313c14776e2c8d656b5c6ca859bc0b346a204f9", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782514153, "uuid": "2b9d7878-e0b4-49f5-81b2-11105b883069", "comment": "Malware payload (RustyStealer)", "value": "d89316c61ccbfabf695f792f94632b100db27aa2", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782514153, "uuid": "26525b74-a390-450f-8d62-622749ea27e6", "comment": "Malware payload (RustyStealer)", "value": "c9a096b15d1eef16f04e7adb54d92da1ea3e566f6670a9dcf3a21cdd69f6e8606d57e2d77d954ace597dd54d823cb441", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782514153, "uuid": "a441c44a-f570-40eb-8ff9-fd73c0e8cd58", "value": "T186863311B95592F8D016C0B447898FB16D36B8A15F76A3AF0261437C1E3EFEA5F39E20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782514153, "uuid": "48159308-7ede-425d-b88a-49feb7937af8", "value": "a44f295602e9f29bcf58a82a297b8b1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782514153, "uuid": "47c2efb1-f8a5-43f1-8cad-f89b7f20c69d", "value": "196608:F8MO33oRamROWoze0/mkZG5nYXUw/+raDnCKK77KqZy6j76N:+v33EOWozvrjXxaabCV77TfP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782514153, "uuid": "bb0103d2-4a3c-47e3-882c-d633a080638e", "value": 8444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782514153, "uuid": "67d9f919-e959-42c3-af19-a3277140a55a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782514153, "uuid": "08065919-94d3-48e9-a707-c8f079f03b47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee22b5a-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451900, "uuid": "fd1c8339-a9e2-426b-8af7-11bfbdb769d8", "comment": "Malware payload (Mirai)", "value": "2218eb38f823076329525cccdd5c3b90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451900, "uuid": "60b40745-a090-4aea-9757-19af16b10472", "comment": "Malware payload (Mirai)", "value": "7a17aed8d0069ceb28e9e776327d6a9ee6bc7338273d5a9474c00854782c8730", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451900, "uuid": "fc3d7fd2-7561-479d-8ef5-8de65256539b", "comment": "Malware payload (Mirai)", "value": "a192840af9bb1d2692965f04d8e9211d8bedc34f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451900, "uuid": "ffb826e2-aee1-49de-8f72-9f6666f96642", "comment": "Malware payload (Mirai)", "value": "923c051edff7397267f8495dd75e7e9f8e8fe503ec6ef8cfff073cf2a5b8a956d2110aa0bc08da8f6df17545e89e6037", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451900, "uuid": "ff2e0bcf-6257-400d-ae7a-bc6df404e9f0", "value": "T1C4530747B44180FDC149D03447ABAA76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451900, "uuid": "89fcab9c-ac18-4c2f-a2ec-9b2a44e14a96", "value": "1536:anF9U0FferGtOW4/RWo48z8kkRqwMhJOlQ5M7WR:0FK0UrUO3JWvRRqwMOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451900, "uuid": "5a8bcff0-40ad-4393-923d-1b72242236d3", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451900, "uuid": "2dcb0f5c-20b4-4b21-be6b-0c43f69f8a0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451900, "uuid": "8d178667-0750-41a3-a985-c60ab51d324a", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c198e887-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479150, "uuid": "28680160-836c-4d35-aed7-2a99b208dfae", "comment": "Malware payload (RustyStealer)", "value": "ee023c4bc2c9e6beb6c17bbe8ed695ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479150, "uuid": "28248f17-a650-4e17-8548-7f4c72b741e3", "comment": "Malware payload (RustyStealer)", "value": "7a558084441e0bffc41b8bfba66caee553d9b24e5d18ed93136d440c61c09d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479150, "uuid": "eb2ecab8-397a-432e-9649-03d6745ae6b3", "comment": "Malware payload (RustyStealer)", "value": "ab0413e53280b1abe727765e2342c5f42bcebb83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479150, "uuid": "58d268d4-f91c-4a97-866d-6469e3404891", "comment": "Malware payload (RustyStealer)", "value": "58614b68342eedf3bf24255478e0e1d570fd1ef63881d933147729eba5b15a13f0610f123a9f151aa32d21f393b18cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479150, "uuid": "86266b73-dd25-4561-ad7b-d627c24ca266", "value": "T14B168C03FA9582E9C0AEC038C75A9233EBB2F89D4620B79B17D44B612F53B606F5D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479150, "uuid": "0fe876d7-e209-458e-b440-b03a62a1437b", "value": "365b3332bc60e2f464e4388c1a08a403", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479150, "uuid": "bb817018-17ae-44aa-96fd-4c52390874e5", "value": "49152:MhRI8CvjuQ8UYQXrN5RmUiZhRVr99mHE9NXDCyeB9LBhPG/qkUBWsXPn+0ANQThX:MXc2VTzcHln+4e2UaI2hyRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479150, "uuid": "9ce6340d-d099-4a04-a6dd-8240d925417d", "value": 4386816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479150, "uuid": "69da85fc-0377-45dc-9482-4b284573c753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479150, "uuid": "b94ca84e-44fc-415f-8179-4af38f59e759", "value": "7a558084441e0bffc41b8bfba66caee553d9b24e5d18ed93136d440c61c09d31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2829b11b-717e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782492207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782492207, "uuid": "7f2c54ac-285d-4e95-b73e-d2953e4e44a0", "comment": "Malware payload", "value": "d2b5dac1c1ecc4a6eb52e8d38e9260c7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782492207, "uuid": "41347a1d-d796-41f6-8b5d-8c70c2d05ecc", "comment": "Malware payload", "value": "7abea0a092454d66f8179c54393d9ae1aefb8a680547f76a6cac09b046777f01", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782492207, "uuid": "5707b8a2-e36f-4048-8a74-e11e5a8a0954", "comment": "Malware payload", "value": "20001412c1fde43dd59886d8be2d7212ec5499dc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782492207, "uuid": "99ef7f5d-e5f5-4cad-9006-a91e7aa3ae67", "comment": "Malware payload", "value": "a48a7fe23af89042b1cbd86c09beb1bab7f4f0580ee4f4158093abf50585e0aed248f676c1a44ee380743a775391c9fb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782492207, "uuid": "fba544e7-463f-4e11-8ee0-74dd9799c69f", "value": "T17831CD141BF61B09E7F75A3DA8BA233086BBBC00FE659F9E024095885C64621DC60F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782492207, "uuid": "e96f6c1c-7d90-4d18-9774-868cfca8caff", "value": "24:80GgDBzF+GKUiWDSnJBW2+/CWz9FHi4S4WkiHF05izHF05iiab5Egm:8kNz5jyJE1S4gZaaOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782492207, "uuid": "d742621f-c9e2-4372-aba1-0f9610964a05", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782492207, "uuid": "2a478d99-6ea7-481d-af68-32ff30006d25", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782492207, "uuid": "75214b29-bc0a-44e8-bc75-92bc9370afca", "value": "ZWfmBDEGqkBL.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d376371c-7199-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1782504091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504091, "uuid": "d50ff45a-d13c-4c34-8ce0-772188c9ab5b", "comment": "Malware payload (Amadey)", "value": "993f015fc9f5a9f683c32541e0039627", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504091, "uuid": "f9ea744e-39e3-482f-8a4d-284707edee06", "comment": "Malware payload (Amadey)", "value": "7b7cc6ddaaf7883d131dcf43677381da5707ca6d534b5b2aaae4ec9033a69ec6", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504091, "uuid": "a16559f4-aebd-44d4-b467-9e013375e606", "comment": "Malware payload (Amadey)", "value": "ebdf48efba35c32ff7bee9db6897aa2d98591a17", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504091, "uuid": "395f35cd-638b-400c-81cf-b10a69531ba2", "comment": "Malware payload (Amadey)", "value": "b10f116dd7bceda5ac55d9695319c964bb55eca19a58146d4b98d97f9f5b6630ad68d33046aeac66e37f4ae52b6c7694", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504091, "uuid": "ec86833f-40e9-4d4d-b2ab-5b8954b3a29d", "value": "T198D54B41FEC744F6E9031672D5A763AF2339AE050F399B87EB407A79E9372D58822305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504091, "uuid": "f4448588-0aad-4198-a52b-74ecc638b1f9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504091, "uuid": "076d66f6-0fee-4a7c-9ccb-9986600ce747", "value": "49152:druty7BFNsjotSJhushpCTLYZbsJvJA2HmH1v:Rsy7XNoqu3eNJLGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782504091, "uuid": "1cc0bb9a-a32d-4671-b8b6-58b829bf71a6", "value": 2770320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782504091, "uuid": "4ca87e62-b5c2-4783-974d-36edb5db0a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504091, "uuid": "5911cb85-6486-4465-b7f9-d008ab1649c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f52ddc-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479018, "uuid": "f6c1bc23-2627-4dad-8f54-e67eb2d3a7ce", "comment": "Malware payload (RustyStealer)", "value": "44615fb0e87e5fe90052e5d48c2ba35c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479018, "uuid": "017c64d9-85c9-4b9a-a99b-1829a5a930df", "comment": "Malware payload (RustyStealer)", "value": "7bc03b5dc106037cead7d885cfdcd7ae485d2fcdc02e457b220687b28754b007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479018, "uuid": "44012e98-f88e-4421-a099-27ac66cde49a", "comment": "Malware payload (RustyStealer)", "value": "db87709ae289c246a58f71308956f037e0fb904c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479018, "uuid": "787d48cb-1fc8-488e-9ca8-f6d723834bdc", "comment": "Malware payload (RustyStealer)", "value": "1b0872b699588b1d77cad0139700d833e188b37dff5010011d1e3dca0d87fbdb162b3c9a758ce2eced45197650895b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479018, "uuid": "68a17488-f6df-4773-8035-72feb1d16589", "value": "T139167C43F6A5A1E9C45EC0F8C31A9233EBF2B88D5621B79B17B44B612F57B601B5E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479018, "uuid": "d054937e-988c-4f51-a844-bdfadefce239", "value": "49152:CyUSUEczSeKTxMqfvuNp8RV5/N/7iECHIMdSEq37pD1ogsLkqwD/avR6/egNgiqV:CP+nZZwvcES7pRomtJqd+cCt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479018, "uuid": "9ab9cf10-345a-4877-b9f9-b2b83f55f77d", "value": 4251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479018, "uuid": "c085bf0f-8eb8-4fd9-9d84-551b2a926fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479018, "uuid": "44bf8b1c-237b-4605-b0b2-d6bbca33ed60", "value": "7bc03b5dc106037cead7d885cfdcd7ae485d2fcdc02e457b220687b28754b007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4886681-70f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782432850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432850, "uuid": "e5c2e3c8-00b2-487e-a733-6839e1d18c1b", "comment": "Malware payload (Mirai)", "value": "50b83d7a0fa6a494d7280c1f481f0a42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432850, "uuid": "d8d40718-ae06-4918-976e-2539279bb339", "comment": "Malware payload (Mirai)", "value": "7cb98e74bd2710be1e515ea8d1a54f7608c4d026230076faef5e779407544b47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432850, "uuid": "4ef74d69-7831-487f-afcb-a81c0c3acb38", "comment": "Malware payload (Mirai)", "value": "38ac879af454400e932616fa4d93ed2b4622d209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432850, "uuid": "711a4508-6d50-439e-874d-aa888d30a261", "comment": "Malware payload (Mirai)", "value": "85f10b07cc4348d38ef0f5103c3fea9bbd0b7b3c9ef60a0d5472754520fd031726e5c8e0b74b457c0f7853237dd71d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432850, "uuid": "1add614f-eaa9-4172-9857-f999158c5512", "value": "T131C33902770D0F43D1232CF02B7B1BE08799BEA219F5E984751EBEC652B49B22146EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432850, "uuid": "49f122a6-5551-494f-85b0-f1361ca59a2f", "value": "1536:jFyTpzJErKEJz90oDU6OEClKrlfMCTQZuEh6/KqGa/6WN3MAAp/rO4LKnC7lkfqv:jFchJKBDUCnUTh8gDt1rO4mnCk6qssCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782432850, "uuid": "2ee464e0-357a-49d9-a8f3-fc1ec4f9ff0b", "value": 128740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782432850, "uuid": "04e2cca5-4ba0-4903-a0fb-fba56c7e318d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432850, "uuid": "798b90e1-9e08-4a00-9b79-4f9c32f65bfc", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d7fe0f-70f4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782433173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782433173, "uuid": "79dad42c-053c-48fb-aa7a-c5452de30559", "comment": "Malware payload (Mirai)", "value": "6e39c2f4c67744f73f33171284a4c98f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782433173, "uuid": "c01aba3d-89b0-4238-a802-a6aee1096fb8", "comment": "Malware payload (Mirai)", "value": "7cc6bffe4402d553bb262c06a6e531a50962c756b667740dffc1f6595a57d45d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782433173, "uuid": "7ce8abfc-c577-4f2f-be11-fa4e512a5a42", "comment": "Malware payload (Mirai)", "value": "49dea3b364476aeaa23534e34a710ba5dcecfe35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782433173, "uuid": "6d4f3542-b2a0-4e36-9b01-f60e4111410c", "comment": "Malware payload (Mirai)", "value": "5ff6fc13ae0a79305b2117eed5b2d93c12a6862ac04444b7e0384f75eddb47bec3c493eb3b3e8c8c9655ad4f9676643c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782433173, "uuid": "be7d5966-5efe-4f96-96f0-3edd6aacc635", "value": "T1DFF3F70AAF610FFBD86BDD7702E90B0129CCB85B25B53B797534E818B50A18B59E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782433173, "uuid": "d7bf25c1-1939-435a-a92b-8acae524e8cf", "value": "1536:bIw1ZzSdOEoHn9h9dLXj8ZeeuvdylK09+Rszzxoox+DxezfgJwRy6RZrXGvkNZVG:B1yBinUo5XMzfQ6RYvkNZjflYnEl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782433173, "uuid": "9a5f2d6c-1d0b-4214-814f-6799e8584e07", "value": 166084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782433173, "uuid": "7ef8fe2a-717d-4ea2-bdae-d15f2e7e3d89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782433173, "uuid": "31d8b11d-7203-42e5-abc0-e94d0e6f5e08", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19973bc-7196-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782502800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502800, "uuid": "f6344b8c-8aa8-4ba4-80ce-42d7d1a05875", "comment": "Malware payload", "value": "61a351e533854888892aa1b9654020d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502800, "uuid": "e712c032-afbf-4188-8e04-75e63bf3aa75", "comment": "Malware payload", "value": "7dc478626946985d859ed3ff34ad2804fcf456fcba03edf43668a97dd091bf8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502800, "uuid": "9e64712d-5738-44d4-9d9a-f4c9e0a71cff", "comment": "Malware payload", "value": "237d107a05b1c826776b198a10cf75c28df114d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782502800, "uuid": "8bd51971-98ba-4ca4-b368-1ab538cc8feb", "comment": "Malware payload", "value": "e28e98b140a16231c7e0a080f3fa76f8b7958a407737e4fd04c039655848a7e94d2e3d54d8866dd180cf6519cfe985e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782502800, "uuid": "cc6421fa-e30b-47ea-addd-773a23257911", "value": "T13A53620AAF611EF7EC6FCD3716F41B49308C641A11A97F397A74D928FA0A21B05E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782502800, "uuid": "50c1e20b-c163-4e07-bb84-74f4bbcbd4d0", "value": "768:1KgA4byLC8MW8dexXYu1IJNg5rR3YTqGaremed2ePMIN6y2XiPo+Oz1lwbZn1:1KgAKYb1IJN4R3dBw2oMiffObwbZn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782502800, "uuid": "eb8c9bf9-2baf-477d-aa6e-89d99f900d64", "value": 61028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782502800, "uuid": "361047ca-815d-42ce-9114-bef2d4ec0fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782502800, "uuid": "07863889-9bab-428d-9e47-b84a212e7657", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3150c5d-7199-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782504144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504144, "uuid": "f6058c0f-b1b5-4cd5-be5c-ec4f7b7bb809", "comment": "Malware payload", "value": "d3fe4942c16f07f67e1ff70b2d10fdb0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504144, "uuid": "8a261345-bcbe-4308-bb0f-f9c4b561e96e", "comment": "Malware payload", "value": "7e3432eeefe91570948db274d03fe6e0e73afd31592f5ce7244ba000e9d816ce", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504144, "uuid": "694bd495-00ec-438f-bc27-55caf979def6", "comment": "Malware payload", "value": "e6472a4ca66e1dd8c0a6777950d632c827d4eeb5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504144, "uuid": "ef5f63cc-50d4-4972-baa2-d92ce53beb78", "comment": "Malware payload", "value": "11c9388d47e6f41474acc86e630ac26b4652d8ef36de917a870fa8e9fae3e841bc53b38b9566ba61d22cf4c4175908c9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504144, "uuid": "408bfd13-c578-4472-8579-17442df7d769", "value": "T17D853B38ECEA402EF173EE698AD879A7E95FB663370E545D1091034B4713942EDD223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504144, "uuid": "18c84c46-3ebb-4e78-92b1-3b32435538d9", "value": "24576:B7B2xw0xgoXLu0iBxoAfnGIdGFpLzknX6A160dINq3ffw:BlqT9dAGbodjdKiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782504144, "uuid": "6c1ddf77-ac80-4466-a82c-be38813cd461", "value": 1858414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782504144, "uuid": "36f018b5-bb6f-41ff-8aa4-2d4c8a406d8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504144, "uuid": "b846bb73-43b5-4197-9822-e8183f15c4e5", "value": "Request For Quotation. #IMESA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c93772-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782458480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458480, "uuid": "cc1916a7-6d87-454e-910f-3d1cf3ebc9c5", "comment": "Malware payload (Mirai)", "value": "c289d25ca06e0c40c4e018554cb2b317", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458480, "uuid": "9984625b-139a-4dbf-8cf4-8d6d476d8217", "comment": "Malware payload (Mirai)", "value": "7edc8dd9c0c4423687c83bab1dd78b2aca50a180888440adf6b57769f2dc6128", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458480, "uuid": "57e1f892-e74b-460b-99c1-e54a14b09edd", "comment": "Malware payload (Mirai)", "value": "3e88ea030e0f7f8cc22765a7769c35d1d72a68f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458480, "uuid": "02aa1743-765f-4cd4-a7e5-282c9692c635", "comment": "Malware payload (Mirai)", "value": "2ca058b83412432905791626e06c2ed2a34da69efbc585e66b8c282c8809380c6d171989b165f0099c3a8a4b39b47ab5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458480, "uuid": "f7be2981-302e-4a76-ac6a-5ede9733fe98", "value": "T165F012B5412008C80105B46976CE8511A1E2D788138BF70CBEDE2A3A4A8A044B86BEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458480, "uuid": "57523927-f895-451d-ba70-30be8fb32524", "value": "12:mphviRuDMvzphviRAX8DMvzphviRlDMvzphviR9DMvzphviRIWiDMv4:mptyptbXRptvptnpt7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458480, "uuid": "5e276308-a8ee-4504-b91c-eaa9cc22f9c6", "value": 450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458480, "uuid": "55848d9a-c6da-4864-9f2c-ff98f07e0ed9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458480, "uuid": "7f4e5e56-b840-494c-9aaf-8229f665a952", "value": "fuckall.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4806dc6a-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782511588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511588, "uuid": "1a3dbbea-3aa6-4c04-a8c5-b8791997883b", "comment": "Malware payload", "value": "cc2bd784448979a036a7e9e9a8db02c6", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511588, "uuid": "30eae0eb-07b4-4208-a02c-ac2b05875ca6", "comment": "Malware payload", "value": "7fd2a7e4824e8865bfc506cd3895719ff68d082910b619917fd09941ab96542a", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511588, "uuid": "4a022908-acba-4c58-a9f6-a19dcc34a0d7", "comment": "Malware payload", "value": "ab0e7ab2806f9c2df4e42520c6cb995e63621d1c", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511588, "uuid": "5d620d32-dfa8-4907-a1ad-256885da0280", "comment": "Malware payload", "value": "eadc7985238b723b0144168edff5aede45753895dc6403f11d739ed352e56971287fe3d1bddc993dfa49fb2bd7976a22", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511588, "uuid": "412fdcbb-a51c-47f0-b58b-c370c395abd9", "value": "T12542B98F604F52F989FBCB636906ED79D23C411392601404784DC1A70FB6BE6927A6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511588, "uuid": "5d62d593-67c4-4b0a-9fba-374f4fda3131", "value": "96:obFCybiC4bFCpbFCpbFCpbFCpbFCpbFCpbFCXlYdJj/DP8x7TzMa/RUhRO0G6ini:2OJXPKYa/RSHinAdLjcgqJQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511588, "uuid": "bae8828b-44a8-41ff-842e-d6194e3e543c", "value": 12506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511588, "uuid": "512c0e6d-7927-45ba-80c4-deae29256e95", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511588, "uuid": "63b9585f-73d3-45cb-b217-2629509ef778", "value": "Check.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e0c378-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782511871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511871, "uuid": "6487b90f-0cce-4ea4-9427-5d3247a1444f", "comment": "Malware payload (Gafgyt)", "value": "c044c9606a6c263d32d0e3545317b0d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511871, "uuid": "d38245c0-792c-4b29-8461-a98563f5d326", "comment": "Malware payload (Gafgyt)", "value": "8016af3ff04c12e7c43a36aa11dce4fdd6fedc171b2e069bf625ab144f44063f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511871, "uuid": "79337309-3fa1-43bf-b6c8-0c339da404f7", "comment": "Malware payload (Gafgyt)", "value": "56cc7f23f1225df43c350447eb11fdf70efcb988", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511871, "uuid": "d4e5918b-a5d0-477a-87ce-c0d0d7a30dba", "comment": "Malware payload (Gafgyt)", "value": "d297795b9fc5ed8bc0d000c8e2e10817cdbcd9dafbf26701bfdfea20100bdd85ac5b8040e6e5e46655894fe237321b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511871, "uuid": "d2d92f28-ffdb-4aed-b403-7e4d58aa81e5", "value": "T1A2C30A44F941872BC2E327BAE78E438D3B355A9497DB332569386EF42FC17982D29530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511871, "uuid": "7569e25b-5592-4045-8241-c7b0efbedbd6", "value": "3072:0mTe1c/r2e7rC8fVhhin3b0BPz5bNmbAAQVhPRtXJfo:j/r2e7rjfBinGrmbAAQVhPRtXJfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511871, "uuid": "17cbbe82-b821-45db-8b19-ed1b9f2c19d3", "value": 123914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511871, "uuid": "fad5d80b-b8e3-4243-ba6e-6f4db3486fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511871, "uuid": "2677e28e-386e-4e7c-bea6-76614233beeb", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4b099-712e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782458208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458208, "uuid": "12de0055-17eb-4d46-b9c1-f2aaf9e088d8", "comment": "Malware payload (CoinMiner)", "value": "67c2b9da374b20bf3bf092c5fc308cbb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458208, "uuid": "e7ba561e-0b72-4af0-a9ab-96927f453b3d", "comment": "Malware payload (CoinMiner)", "value": "8039da31a8e91d0830858edf53738592f499e24612cebb172cca018ee14382b0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458208, "uuid": "10c3e649-d9cb-4f94-9b70-aee3e4d7a0b9", "comment": "Malware payload (CoinMiner)", "value": "d3c8ef9ff1b86ee7c4123ea6d0d14183eaca7888", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458208, "uuid": "78118893-dab3-4f2d-8ed9-be27272aba0d", "comment": "Malware payload (CoinMiner)", "value": "950e52bb5c3e0e99d29ea8707ed5530966f83eba3b4ce4f8bb5ff5d57415f86d585727916db7a56626fedfe9b63ce783", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458208, "uuid": "db49c127-05b4-4053-bdd5-036b58e38f8a", "value": "T1E3A31240402014A2EA895DF2757EC9CA986A0A74E1FF737C31BE018693AEED137245B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458208, "uuid": "21ba13f7-e54f-47fb-9486-2ab8c663a36c", "value": "1536:Hl0hxzzaXup/kmkyPVSYQvvEIkhbrHSPsySFBg5S7F31u6RH5+HZ5oi3XNJAewoM:F0hJ595aHEIkhbryE5FP19atHkcMTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458208, "uuid": "f7a16759-c7f9-40f3-9e62-b6164db77d0a", "value": 101988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458208, "uuid": "c7af0fb9-f314-4e3e-8f13-61491740afa4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458208, "uuid": "7782c5e2-722f-4c01-9d7f-e8cfacd77e14", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6132de-70f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782435143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435143, "uuid": "7453087a-3e5a-4fa4-9b06-32f0e7ed3faa", "comment": "Malware payload (Mirai)", "value": "cff27df5799aa6f88475b78c1d9a4d35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435143, "uuid": "d62b34f1-e81a-49e2-8275-cd9f5e78607c", "comment": "Malware payload (Mirai)", "value": "80826c175e9ba582279f1f5b14e4aff7540aea8c8d125ae029dffdeb1235de08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435143, "uuid": "d01d5560-08fe-4cf5-a5de-5d62d740bd8d", "comment": "Malware payload (Mirai)", "value": "87e28a3d22f66e9e3a89b448574e74605d3d64d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435143, "uuid": "3c7f867b-af34-42a1-9f0b-96884d7432d8", "comment": "Malware payload (Mirai)", "value": "e7333c90fc85f09f01f531a5fb7e202c8e3392628cbf03ff380c11891d19510bbb0ddd57c9aaa3f5f4813c211eb0ab06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435143, "uuid": "d5c54cbf-a508-4013-9b52-a997bc73cfd8", "value": "T1C8D32B56B9528A12C1C321BAFB5F514D33136FB8E3EE72129D14AF60274B8DB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435143, "uuid": "f6098ab2-e474-4d6d-a67e-3254b4e6a1dd", "value": "3072:dG2w+FyCF8FWZTZys2lG7t9wp4Ub9a+qHs0kl3hxxOnFJyK6:deQO8ZTZ4k9wCUJaTH8l3InFJyK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782435143, "uuid": "6344f7d7-b38f-475c-9b05-35fff7a85e4f", "value": 132808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782435143, "uuid": "1afe819a-e3be-44af-aee0-4563f02996fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435143, "uuid": "7e329ec4-3ffd-4f35-8789-7784f8687a4b", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfbc255-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782478982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478982, "uuid": "d1540d5c-50ba-43cc-a1a8-7c5090040d6d", "comment": "Malware payload", "value": "40e5c72bc6483fe5ca472ca8e9d39711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478982, "uuid": "61ef7b5a-4366-4444-b917-ff4a1b3d0077", "comment": "Malware payload", "value": "80d72e517a683d7341b3833a6f7cc076c16db3889ec7350350126da642da89e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478982, "uuid": "c1082ea1-4c1d-431f-95ff-eebb6316f68c", "comment": "Malware payload", "value": "8bf61ab5760fec2b3dbcf0761b38e1e479fe8e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478982, "uuid": "a995d2af-df70-481b-986b-f2e0e8ecfca6", "comment": "Malware payload", "value": "926e9061cbdf15d72a5eeab259395a47d8dd7dbc662b92feaacf798a3a37540dea361750fb372e70b33f46eb6be92eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478982, "uuid": "0a048ad6-2a52-473f-b9c9-896ad9b9682c", "value": "T164167C03FAA581E9D0AEC038C7169233EB72FC9D5620B6AB67944B213F53B606F5D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478982, "uuid": "699ea4a8-3f04-4eac-b9f1-93cec8203d9d", "value": "d975bb2e9c38533c67d5a0b98ebe19e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478982, "uuid": "d208101a-57e3-4c5c-8267-2028c8d4eb66", "value": "49152:AbNEpgqnSivS0mOCLx5SikViDV4Er11wimrEwgY8fRX2oWvQod9g+HohT7PMp4OW:UxqnSp0eiAHaimgw+Mih3PWu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478982, "uuid": "5027b748-0338-40f5-b406-7d685accb52b", "value": 4335468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478982, "uuid": "3faac3fe-cd32-4689-8b9b-0bce300cd0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478982, "uuid": "902dc631-3b47-4dc1-9860-ed778c98660c", "value": "80d72e517a683d7341b3833a6f7cc076c16db3889ec7350350126da642da89e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7646ce6e-7163-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782480742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782480742, "uuid": "261b006e-6c3f-4cb7-8fd8-b6bf915f6959", "comment": "Malware payload", "value": "579e5b488d4853ec4091bc3dc95434f1", "object_relation": "md5", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782480742, "uuid": "173def29-4fb3-40b0-8c2b-40f840b96580", "comment": "Malware payload", "value": "810ed7d47bca28d6b94b86b53a66e866aaf99314458341eaf085f2b89f4db37c", "object_relation": "sha256", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782480742, "uuid": "6df3a289-f58c-446d-8eac-85b114fe1258", "comment": "Malware payload", "value": "710eea63f0759d1b4696cb270b1a87e13f0d8fb5", "object_relation": "sha1", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782480742, "uuid": "e7936cb4-8f87-4821-aebf-243a5378dae3", "comment": "Malware payload", "value": "5c28fa511720cb1986b35d3f446f7f92314ef147132ec9edaa16821be305230cebd27e30cdf4724d9c702d7d7bded6b1", "object_relation": "sha3-384", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782480742, "uuid": "09c7cc47-5611-45ce-92b0-8514734fa9eb", "value": "T147460221B687C926E55D02B3F939FE0F547EADA7073042D776E4B86A58B08C1A27D703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782480742, "uuid": "0771bbba-a8f9-44f1-97e4-baa33929e5b1", "value": "98304:RoUwXXMIrjDNvj9ej3z6olun9p609FYbYU+RwM1KTBld:6UwHMIrjDNvj9ejl8X609U+aM1KTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782480742, "uuid": "dea867d0-bb3a-4cbd-8fcb-0a418115f64e", "value": 5680640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782480742, "uuid": "ab0a1ee7-3013-451e-9530-392b15978903", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782480742, "uuid": "24da7880-7d14-469e-b2c3-2ee3826cbb0f", "value": "LYDeN2Uq4D5WHqkB9WxLS.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ef1b5c-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "6e368e09-1f45-4089-80f9-f881db6c6324", "comment": "Malware payload (Mirai)", "value": "0341e97980118c280cec54f389640df3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "e2f208c9-60ae-4cec-a4cd-4db8abb663f1", "comment": "Malware payload (Mirai)", "value": "81acfec257f5d3143694e280c81100771ebabe6f8f220c3e377f61c48732e962", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "7b3d9932-1288-49b9-aee9-6934ea59ac89", "comment": "Malware payload (Mirai)", "value": "1cf9af50df93a7bb4a4ca8668914ec0cd0f0e2d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454009, "uuid": "777d80bd-d405-41c8-b5c5-af82a82aec8c", "comment": "Malware payload (Mirai)", "value": "f3a3171caaab32222c0e6dcc3b84b1fc4d2d7b9467be9ba5c556f92d8079b4e4b6650834b48cc234572b3be2101e3a45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454009, "uuid": "6265838d-4858-42ed-b246-feab03c5cffa", "value": "T1FA043802E603C9B2C41301B112F7CB765E31F9B7AE25D452D3FCEEA0ADA56D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454009, "uuid": "711bec34-5584-4d13-8a6f-47170be782d8", "value": "3072:6pvxSRDkCQZzYsjRV58c5aiJE7/CNDh7mU83Zlpy8X:yv5dRqc5aomu7J8Zy8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454009, "uuid": "6111c14a-9b08-435b-a7ca-27d3930d9213", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454009, "uuid": "580e2f57-9915-4102-a1db-5589656cad14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454009, "uuid": "221a348f-cbe7-4919-bd6f-0c9adb6f95ef", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ce3f25-7151-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782472881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472881, "uuid": "37feeab5-d47b-4a0e-8e5c-60521965157a", "comment": "Malware payload", "value": "cc77c5033d3c4e0b31cc7235d1de4f4f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472881, "uuid": "61f8d73d-b0fe-4e6d-82fb-6a877fb4701e", "comment": "Malware payload", "value": "833eb2907cbf002c325356a4025a572e84fcc01504708f6328d154dd57c3b42f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472881, "uuid": "dd6b155e-b6a3-439e-a23b-bf72a33d2308", "comment": "Malware payload", "value": "67fc7beb351d24db09f696c4bc27ce00d59ec388", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472881, "uuid": "48908a2b-230d-4677-bbf8-238c7c964d37", "comment": "Malware payload", "value": "5deacd8190f0bfe0157762356d8d37a41b6262999246273eac7d0e14d8d060adafba1f2f3acebb80925aaaa4489fc82a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472881, "uuid": "7ff7136e-9f17-4e3f-9012-3ce40d11701d", "value": "T16C070E673A871B4F1216B58A61BA7935FAEE89BAA17E0B161DE07535F00CF00D737342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472881, "uuid": "720598dc-e9f1-45fe-96fe-ad3ab7a6b1e5", "value": "192:XzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzsXzse:bP2vjHqvh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782472881, "uuid": "c6b36d1c-09a3-4225-b07e-dace92ccf901", "value": 17536795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782472881, "uuid": "a4f8652e-4621-46f3-951c-6af4e64f06dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472881, "uuid": "fe7e1566-5da2-4206-a1b2-1798c5550bcf", "value": "Documento3132.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab0541b-7189-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782496909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496909, "uuid": "5f9e5c2e-8b4c-4b47-a888-3eac8c4c350f", "comment": "Malware payload (ConnectWise)", "value": "c8394b6b5b743b2754617e284bdeed23", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496909, "uuid": "94aaae9c-f6a4-4feb-a6a6-a0fe46abafab", "comment": "Malware payload (ConnectWise)", "value": "8369bca0547312a9ba1fe95848db1387a1191c8d91e91cee137c94d9ae888644", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496909, "uuid": "9acd1c2a-fdb4-47e5-8ca8-bfc77f596c42", "comment": "Malware payload (ConnectWise)", "value": "4899938950f416eb43ad8db38133b0f622764922", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496909, "uuid": "9331ca5b-6988-4155-8f35-78675627fe83", "comment": "Malware payload (ConnectWise)", "value": "b359e89aa36ba5d01956b141e0ae07bdd0b44b4d4b4b4848c2d7e80fc759d1ccd895fe58ccfea4f9f7a80f3a33132c52", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496909, "uuid": "e17b883b-ae62-4905-9861-aab174123f41", "value": "T1BFA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496909, "uuid": "67ba7b20-5ec3-45d0-a95c-af1c865aac56", "value": "196608:VnCtVYqI5MvbWEpKkqZIJqKKnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqcnCtO:lCXvI5MvHx1JwCXvI5MvHx6CXvI5MvH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782496909, "uuid": "a3f995b3-73be-4f6a-b8d1-cc2f85cc43ca", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782496909, "uuid": "7f2fbf40-8243-4bf5-9c91-d9e660aab9cf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496909, "uuid": "76d5e2a3-47cc-4fc9-88d8-dcf4ed141e6b", "value": "~temp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36de8520-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "f65cd39e-16f9-4fde-967b-fe153d4c8a99", "comment": "Malware payload (Mirai)", "value": "bb45179779aa56893d0f1c8300b38714", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "78193df3-2ed1-4798-9402-6b4ccc63210f", "comment": "Malware payload (Mirai)", "value": "83a5fcf56c3579a3cf36c0302c826e0363eeefaa0b14a8bd59e70efac710bd88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "5de2d994-6845-4a07-ad49-4d4a068f6492", "comment": "Malware payload (Mirai)", "value": "13e5acede2cb8f2e141e894cc920cd1ad14a62a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "a85473fe-213b-4ef4-a5d5-8bde18439f74", "comment": "Malware payload (Mirai)", "value": "7acdd6a688d1ba92e1f7f29d505f70a9c1ffb0c29b3c56775ba2191bbf9529acfc27592e761119b07b9993c961ad465f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454007, "uuid": "4c0210d8-67f7-4f30-8c95-86592579ce90", "value": "T15924E947B991CF12C1C111FEFE5E418D37136FB8D2DA72029D24AFA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454007, "uuid": "64120a09-79d7-42e6-92fa-ee3c33c51d39", "value": "6144:xoMWDAzSf4sXLCloq+RaPiVv5L5FWe9bmhSjBr2:x6Dd4sXGlgRaP8bWetmIjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454007, "uuid": "94f3f3ae-4abe-46cd-8bca-382297d4d3aa", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454007, "uuid": "e40d547b-cd84-4715-b4c4-3f3123ced5e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454007, "uuid": "ed9f1bf0-fed3-42b3-a763-086c18cf5fe2", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaccf85d-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453020, "uuid": "dafa03df-4d5e-4690-8954-c833513c1355", "comment": "Malware payload (Mirai)", "value": "d1e344d55872261c108ec5966352fcda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453020, "uuid": "924f550b-98aa-48a8-945f-68aeb7b0e0cd", "comment": "Malware payload (Mirai)", "value": "86138ccca13b067e4fd9b19ee3994ce6036d5b6d91a10f030cd0abe64c43f56e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453020, "uuid": "5e3692a7-9bbd-4889-bf73-0ead6d44c26a", "comment": "Malware payload (Mirai)", "value": "fcee3f11ffa7319d7a4b1d769ba4d07f37c8f723", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453020, "uuid": "b7fcc1fc-be2b-4510-b7eb-3412cfe5d5e6", "comment": "Malware payload (Mirai)", "value": "f06c72ca012f13a3a69da981e823d179ac0587fd187eedec596d5dfe27ba0f308d3abf9464faaa022215d94bac6c1b1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453020, "uuid": "1952c325-c65a-4098-9599-c7ee45786b99", "value": "T14C83F680B942DA1AC7C2177BFE5F018D3725BBDCE2DE3212DC252F9437CA55A0C5A266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453020, "uuid": "8548badd-65b5-4615-b1aa-34741bcd233b", "value": "1536:y2hyDlkLAaOSTLqwM4LkKDybbkzRU+QTeEw2etYbJ7yUPy:yBDl+AaOSTLTM4XGXARhE5et8J77y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453020, "uuid": "2572b592-03eb-4fa9-95ba-862de042f7eb", "value": 81284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453020, "uuid": "702cc8f7-df1f-4b88-9ed9-9f50abc33254", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453020, "uuid": "78d74c78-9e0e-470e-a4c0-8fe2e419fa7a", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9187b325-716d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782485083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485083, "uuid": "f0626e9e-6e0a-4d6e-bf03-2012c765ba75", "comment": "Malware payload (Prometei)", "value": "2219a5e9013168e6238b071ee8ca14c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485083, "uuid": "eeba58c3-0786-48ec-ab0b-73b5aa3114a2", "comment": "Malware payload (Prometei)", "value": "86628f5f0cd9960e9691e0b6594591b144b4365f8e2e85c54a90bddba9a19e3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485083, "uuid": "cc67f33f-803a-4f53-ac73-1dbaacf1364d", "comment": "Malware payload (Prometei)", "value": "2f65514b79316edd2cf69840e294f0f55a40e66a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485083, "uuid": "7366f2d7-bd26-48ee-b2ad-6a430ac1c0f8", "comment": "Malware payload (Prometei)", "value": "571a509e2ae28de6ffe5d2cd6a61d8345d0dc9312d6e0e0233745d9d06d8c55101ad48f00efaa3b85879fc58273f84fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485083, "uuid": "2af4e5db-da9e-4f17-a530-b8fbc6021f5e", "value": "T15534BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485083, "uuid": "2ee94a41-303f-4233-bf85-fa9c2e39344b", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485083, "uuid": "b976846e-c02f-4aaa-8e1e-95055fcb5fb7", "value": "6144:LGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOw:LG60BpL8jk1FGjDc8GVdOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782485083, "uuid": "25fce14b-fd2a-4ca6-9750-ba90051368f5", "value": 245868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782485083, "uuid": "b2e2ca1d-74e2-4f60-9fe9-c9874792d64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485083, "uuid": "87360a9a-7503-4383-b628-d87e7f451509", "value": "86628f5f0cd9960e9691e0b6594591b144b4365f8e2e85c54a90bddba9a19e3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92f0425-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "64ff44de-b9c8-4b71-ab6b-90b37c25a936", "comment": "Malware payload (Mirai)", "value": "f8c5c413d741c9beba6cc40430049547", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "b5040c55-d21a-4999-86cb-3c8558821be9", "comment": "Malware payload (Mirai)", "value": "8718f3eb5708fa33c9e3d7925f9dafe377fefffafb106cf2c6f8158949abde72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "ea1bfb1c-4bc3-4b1d-8d81-9340cac33bcb", "comment": "Malware payload (Mirai)", "value": "8073c350a5e71ca7639cb61024d785baff73fc69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453018, "uuid": "73b186f8-c7f7-49fb-bce9-515a7adc07e9", "comment": "Malware payload (Mirai)", "value": "9bafcd235c40d8dd11314cc3f6d7aa8330aaab8493fb23e1c057dfa09a76fe38941961a7be77a30992bc5aed7b812ee4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453018, "uuid": "abd4b4cf-4613-4240-aa21-713e1f6a361a", "value": "T19793F786B882DE15C6C2177BFE5F008D3312BBE8E3DE7213DC245F9037CA59A0966566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453018, "uuid": "222f1eaf-e60b-40a1-83bf-df6f5ff1d836", "value": "1536:AFnQT8KeQdg5r1wjmzjDDg3bqksxFZPz0yYdGzKIgiMQ+1mmwU4+:EK1m5JwjmjsmjxFZPeQ+1mm2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453018, "uuid": "927ed601-9381-4b60-a1b7-55f33e19f1ba", "value": 93944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453018, "uuid": "6fcbbdd5-f91b-40a9-aa1a-a4be06af1bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453018, "uuid": "0bc41787-1110-47f6-96e7-ebbb66da78c0", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c620a566-710c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443510, "uuid": "ef48bb80-81d9-4b36-a19b-4bdd503883b1", "comment": "Malware payload", "value": "0a4a61ab87f4d702555bafa814d41e70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443510, "uuid": "80829437-b0d5-4e36-8d35-ecdf196423a3", "comment": "Malware payload", "value": "884e659a48fde8d06f389d1d07a5e987dd42055e444a8c9acb362cc16a3a6d21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443510, "uuid": "af534530-7fee-489d-9823-bcce1acef682", "comment": "Malware payload", "value": "dc6f1a30760c34243d648a10e10a827fb07b4d09", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443510, "uuid": "a4d6ef4a-a399-435d-8180-42556371fd87", "comment": "Malware payload", "value": "ec9654361d65dc3685191850884e84aaf0d6e91f628b3d7d24cb34bf7587adb9f6788a6e5b887dac40f592f9d8fd393b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443510, "uuid": "290afb64-f9b0-4a37-9b80-36dfa6d7cdc5", "value": "T18CE29F02ADD4CAEB57C67AFABD32C8E1CE9CA49704D5400E23EC965C7CD9C5F64662B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443510, "uuid": "a537d4b4-3dff-4c0c-b070-a2b14788fa22", "value": "768:PNX8WV+THAr6mfHOg9bg3JWJPQPrgA/QCckjizIIOjbtWMNs0tt:PNzArI6mfug9YJKeBYCEVMKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443510, "uuid": "a9c54891-4f6d-4416-b98e-1d4bfe9dda91", "value": 33138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443510, "uuid": "2bd1e429-4210-4d43-b70b-0588a14cc3c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443510, "uuid": "5dc52edc-86bc-4617-9114-fc5c989551fa", "value": "ufino(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b3eca8-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478894, "uuid": "8318c557-e7bd-4a44-9219-f782fbcbd7c8", "comment": "Malware payload (RustyStealer)", "value": "fd0d176de0f31f66122db5f06381102a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478894, "uuid": "7f6fc518-7fd0-4ab7-aa4a-5e87436185da", "comment": "Malware payload (RustyStealer)", "value": "88abe5b4abf3d7449425adbd40e6e4ca5c219d91b22556d5dc37fedb3f69fda2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478894, "uuid": "be9ee95a-2378-4982-9d39-bec47ee97b62", "comment": "Malware payload (RustyStealer)", "value": "1b0622a874f848caff03627ee3007b631181d03c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478894, "uuid": "6e7ba1c4-7493-4ad1-924b-b845f55e755d", "comment": "Malware payload (RustyStealer)", "value": "1c0105bf6347d42cef75b6127ddb3687e1acdd5c6482ee28c07359124e1813509070bc4b94a802fceea932afc32235e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478894, "uuid": "a510b95f-e2b8-4856-842c-fd41b7f3bafb", "value": "T1CE168D03FAA582E9C49EC179C31B9233EB72B88D1624B79B17D44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478894, "uuid": "a8ae6e79-ef8b-4c12-8215-7b2b69b54848", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478894, "uuid": "f8a781d6-a80a-4f72-9e3e-248b927e395f", "value": "49152:ESBYLTMG1PKWkQS+a1hbv5Fs26w5tP5sZ1L5T1ogsLkq4UvfrzMJisWrCtZkIKDd:EBMPvUwba/L5hoxvYZt6I/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478894, "uuid": "4bf7e21e-9aca-44a1-8292-13d000f6f77c", "value": 4215296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478894, "uuid": "e3936163-e69e-4b95-8bc0-ea8277feb9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478894, "uuid": "c4c05d2a-2f61-4d09-b1ba-efc86886dea8", "value": "88abe5b4abf3d7449425adbd40e6e4ca5c219d91b22556d5dc37fedb3f69fda2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0098858d-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478827, "uuid": "b4d8327d-6ab8-4225-a843-71364b113446", "comment": "Malware payload (RustyStealer)", "value": "a65d0888e130eac4d2f7e160f52df4c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478827, "uuid": "11a0f6f7-3269-4434-a8aa-1b1b5ced70e0", "comment": "Malware payload (RustyStealer)", "value": "88c9d78237aef1714c18d8c9a02b53f3c22165171071bae7c8bea99dc875c3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478827, "uuid": "13b1aa0a-aecf-4893-ba33-fe79e105d785", "comment": "Malware payload (RustyStealer)", "value": "6288f79ca523a8d8897356fbd357daf467116d8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478827, "uuid": "bfb3294d-4a21-4965-b618-484540179813", "comment": "Malware payload (RustyStealer)", "value": "80c4d148605895dba638d9dcd465a75a192e656e5bbf8aa180e1696b58c74bf702586917b1a86bfcdb66f7eb37548535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478827, "uuid": "ca1430b1-b725-41c1-b0c1-5f02b8ddfc50", "value": "T16C167B43F6E5A1E9C05EC438C31A9237EFF2B88E1621B69B57944B612F13B605B5F324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478827, "uuid": "2422ebf1-5fb4-4b48-aa64-a9fefc69863b", "value": "49152:u1Lt565iDowdsDQ7unCZ5IpXTyoqxsekYGbZ+Jf/m+OZF4qRb7rGzckcBA6Ppeup:u1j656BVoaZGb8JdgvJB3oR4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478827, "uuid": "9e1cc202-1c98-4615-b1de-30fc02de1592", "value": 4242944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478827, "uuid": "e04f7766-9162-4b67-b09e-ee46aa40b052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478827, "uuid": "7ff12cb7-4826-466d-bed5-23e06f9b3601", "value": "88c9d78237aef1714c18d8c9a02b53f3c22165171071bae7c8bea99dc875c3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda67ce2-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478822, "uuid": "6025b0d6-993a-4e62-b946-1b712243fd96", "comment": "Malware payload (RustyStealer)", "value": "e407d70eb9f90af6103fc71519a0d454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478822, "uuid": "91731904-1973-471e-a902-28aaf24a4691", "comment": "Malware payload (RustyStealer)", "value": "893ea837583c9ad2775a5f907b817cb411dfd12057846ad09360d38c59edb39e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478822, "uuid": "03e78ad8-738c-4c90-b19f-4dca95eab38d", "comment": "Malware payload (RustyStealer)", "value": "38da022cf8af1169cea91fb86fa7ab5ca2e512f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478822, "uuid": "b41e95bb-4804-4a4c-9ad0-00eabbbec9a9", "comment": "Malware payload (RustyStealer)", "value": "212be5033eb2a62fc0d54b434e8d2a8478c5294e570aef5f8a8c218d56c1977e21bc31a2e4e6212d3dabd81e05a31ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478822, "uuid": "f00014fa-7d32-4633-939a-5155e454e700", "value": "T175168C03F6A581E9C0AEC079C31A9233EB72BC8D1624B79B5BD44A213F57B605F5E394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478822, "uuid": "b62be5c5-f53e-4fbf-ad2d-f35e91252e49", "value": "f6d92901a03a7b46c4d2cce54121729b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478822, "uuid": "b3ed2e20-3972-444d-be59-bccc87162e16", "value": "49152:41Lt565iDowdsDQ7unCZ5IpXTyoqxsekYGbZ+Jf/m+OZF4qRb7rGzckcBAHLGHQB:41j656BVoaZGb8JdgvJBIG2sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478822, "uuid": "f386dc95-7878-4036-be79-f17a78d27b02", "value": 4208128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478822, "uuid": "16bda2a4-59eb-4e91-a8ed-e842281bcf6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478822, "uuid": "2ac77980-3b7a-4451-a74f-c25426f26990", "value": "893ea837583c9ad2775a5f907b817cb411dfd12057846ad09360d38c59edb39e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be5d751-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "dced8de8-e71d-4fdc-b0b3-6b8fab921ee7", "comment": "Malware payload (Mirai)", "value": "89821809504494fcbe79680314b9f209", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "12c2fd04-d090-444d-a3dd-3d7e34d6a339", "comment": "Malware payload (Mirai)", "value": "89d568141345999ba9ab04d1224092a53ec0802238db01ff74030dc857aae9b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "8233d862-b30d-4b27-a224-957a629e8b4d", "comment": "Malware payload (Mirai)", "value": "57b7580b4411f770e62d45a86a0fa67f1027c1cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493099, "uuid": "32c0fc71-7b44-49eb-8f20-80e4bf4b679f", "comment": "Malware payload (Mirai)", "value": "e838089810b013b9220075bb54b2f7f8d2a8ab90ba07233d2d93c805f2e4558674b057a7ee5e39f46377b0f81e7eb4ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493099, "uuid": "09d55262-444c-44c6-999a-9e4e16fb2b3a", "value": "T19E059C627FF20126D1D08A35CEB6D360B51B96ED60E4070B9F58CEEADF962240E85CF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493099, "uuid": "ab0935ec-f078-4e76-8e2a-6747b187fd07", "value": "12288:6gqnHoa/I5qNHxxpXU7rMPVpgAiaoadLV4FXstKus5uUhlMjLT8c4Pl:tGp/IwbZU3MSsETOLIc4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493099, "uuid": "810c0579-6b0b-4bb2-a6c1-6fb00aaa93c4", "value": 855512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493099, "uuid": "c161d55b-799c-4b14-b104-9f69d493972e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493099, "uuid": "bd46716f-d684-4b00-bb3b-e9d5a5fbffc7", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d5bbb6-7192-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782500926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782500926, "uuid": "471ccd36-1cbe-44f1-96a8-b61b84700147", "comment": "Malware payload", "value": "2a67f1bbfceaf2a8a16944f71a0e1e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782500926, "uuid": "aa83f73a-2121-447c-971e-1e71511b4055", "comment": "Malware payload", "value": "8af73d551cab2ccbb5843aab342f9094fcd76dc3aec22b97532c1d75cab0bca3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782500926, "uuid": "9c551ac2-c00c-432c-ad2d-0cab74aaf7f2", "comment": "Malware payload", "value": "24b4ecf86a5e1a0aa006603bc1554f57da6afe30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782500926, "uuid": "6d648cc9-4515-4ebc-b822-a20679e5b921", "comment": "Malware payload", "value": "322e1ea24dfb5f5374ddaf8c69aa7425dc16dce5cf43d8cc47e6d07d8625cf930e8d9d66a39cbf317f188247d93c655f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782500926, "uuid": "3fa025b8-877f-4631-b4f0-7c9bb1fcfb44", "value": "T16F17BE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782500926, "uuid": "aa170bbd-268e-4a65-a291-3a4bd8ec8bce", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQm:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782500926, "uuid": "bfa9b9fa-98b5-4870-abbc-e4b50aae6fac", "value": 19988480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782500926, "uuid": "d100ea57-8f7f-4c9a-8771-14f8e7dfa91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782500926, "uuid": "c45aa887-26d8-4b8a-bb89-637731ab66cc", "value": "8af73d551cab2ccbb5843aab342f9094fcd76dc3aec22b97532c1d75cab0bca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217e5980-714b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782470292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470292, "uuid": "aff7a9f6-cb63-42ca-966b-1af4dc40826c", "comment": "Malware payload", "value": "8341b91c9ae8094f4bf261c49ffbd389", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470292, "uuid": "a88a205d-763c-4be9-bfc0-a694f52a4411", "comment": "Malware payload", "value": "8c3413fb335c901dcfe40dcfe8b7bc5390df7d8d879ed1e7969c4b898bf96639", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470292, "uuid": "810a45f6-3df8-4fed-b7d4-7220afa02b82", "comment": "Malware payload", "value": "157d42a5ca3ffa3990a512d7dab2308470c3486f", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470292, "uuid": "6ba0bf1b-eac9-4529-9bb3-003c39c3beb7", "comment": "Malware payload", "value": "44603dddf078b3a9aebab0bc88cb7b0cb4454118dcc72bd1e15fac1da1b17b562611d8671fb089862cdd4e5124782e2b", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470292, "uuid": "2468301e-504c-4964-a0c4-5db30f6bac73", "value": "T16B92DA4C7DEE606C827EB77E170B9915E0064623E541DBA67D7C90386FF2214B2B2E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470292, "uuid": "f56b6bf9-f0ef-41e1-b7f9-6a46e06e027a", "value": "384:FFzCAwEP2WEvMcgAxnRkUZRdpNh0Yg1l+agRzqQBbEL:FtCAwVp5kUDdpNhtg1l+1Rr9EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782470292, "uuid": "ac909353-0f2b-4961-a5ff-075c191adf5e", "value": 20906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782470292, "uuid": "c0e0e859-1cc9-4a9c-95ae-3f0f9d02a170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470292, "uuid": "c9bdaedd-5f36-434e-85e8-edd7d92a2976", "value": "script3-from-2nd-obf-script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e951b4f-7131-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782459281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459281, "uuid": "9d157c58-fb32-410a-9fe2-1242bbf28ee3", "comment": "Malware payload (CoinMiner)", "value": "05fff20209607d0cdb1bf61fc60eb355", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459281, "uuid": "1c5ba687-5468-421b-9508-0bcc0718abd3", "comment": "Malware payload (CoinMiner)", "value": "8c869f9982c38d7f0cbfc5ddb1e489d3a8c94ed0cb19b8d9af27e329dd6a61ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459281, "uuid": "75726c99-948c-4d34-9ba0-ec7fb2b8f80b", "comment": "Malware payload (CoinMiner)", "value": "1b0bf3b5c91df03ccd7136807f296e20fc81e36d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459281, "uuid": "ce90fc74-5519-4c4b-a946-9dd2b0f96cbd", "comment": "Malware payload (CoinMiner)", "value": "7f882cf2eee294f170aa93d2ad56c4938692dcdac3c3ded908e3d01524e15c340937a78e7852bf995b33f96113eb53f0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459281, "uuid": "7b471574-95fc-4631-9192-c96b4fb3a4e0", "value": "T123A31278936F2E30C424D27DD12F8332398D532579B5DEA8AFE256A94CB93CE44C4E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459281, "uuid": "d7204592-4be2-4f1f-a4e5-a1a9c9fa3e70", "value": "3072:17rlNRsDDSNcgQ5mDM065B8MDzX1Q02/qXF4VU:1ljsD2bQ5mo0Q8MDzX1Q02/qXF4VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459281, "uuid": "d079d1b6-c013-4339-80aa-654a7d24967f", "value": 105452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459281, "uuid": "35e6ca46-3de7-4aa1-b4b3-656be3959dba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459281, "uuid": "6743df6b-ea44-46e5-8900-5723986a1810", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea038f67-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453019, "uuid": "6ab9a8d0-4382-4a2a-ad1c-52f5522d2bc2", "comment": "Malware payload (Mirai)", "value": "dabaaa9eda8a05cbec4a3efe42c94805", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453019, "uuid": "e733fe12-2aa4-463d-9707-ffe7047b8b40", "comment": "Malware payload (Mirai)", "value": "8cc8ca692f1ea1eec468334a53776aaaf96708da2f5c7d7a01f84d1172afe293", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453019, "uuid": "51781775-351f-40c9-8220-c3d8099ebcf8", "comment": "Malware payload (Mirai)", "value": "bb38b3c0b7b6e1cbf5a59891ab35dbcded7da41f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453019, "uuid": "8df0ad02-b410-4fc2-bbe9-d4039b0a0459", "comment": "Malware payload (Mirai)", "value": "5ee0b8b7950f48e0b991c8fe08b70843d6b6938eebf5d7e5a8a8b7188993be86374017b0987b218e5810a5cb27cf970b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453019, "uuid": "a629faeb-8406-4f45-ad00-5fe1ac065111", "value": "T1FBA3F885B9829F11C5C626BBFE5F008D3317BBD8E3EE7212CC245F9037CA59A0E66552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453019, "uuid": "10f793d5-7632-4dac-9231-ed96a35f6c84", "value": "3072:5HX1rB2oQk4OR2jZ5CIyQPPpmloL3Etucf:TBvQk4c2jZEItPPpmloLE9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453019, "uuid": "99393336-78ed-4558-8d19-bfa675371ab6", "value": 106308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453019, "uuid": "fe8e059d-b9d5-4b8b-bce2-b64a1a8a6abe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453019, "uuid": "b176dee8-6b9c-4595-be95-11f73935b756", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78bb4c4-7124-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782453766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453766, "uuid": "cf51f021-b1f5-4b2a-8c78-82bcea2b71d7", "comment": "Malware payload (ConnectWise)", "value": "3c6a7d5ab760f921933b7816cd9a6bb2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453766, "uuid": "d6583139-e1de-4d1f-bce2-eecae0732d41", "comment": "Malware payload (ConnectWise)", "value": "8d29365c000fadce7c72e480bc9976d583e726c1ce0b2dd73548ae3e32f4d4e3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453766, "uuid": "6c3788ea-2869-4c4e-8a13-112f3a7e9c1e", "comment": "Malware payload (ConnectWise)", "value": "d0633ff81fe9ba3e795aa07de0b580e0e475b369", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453766, "uuid": "764b8ab9-6a7e-45fe-88ff-f2e385c812ee", "comment": "Malware payload (ConnectWise)", "value": "518101f98a052c7fc19c4d1c24e0fbd3d24cd4819446d766f9a466c855b992f4f7f25d784e267a01909f5de3bae80efb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453766, "uuid": "c2204100-8586-4e2a-b363-c1504c924fbf", "value": "T158646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453766, "uuid": "0c0c2807-fc97-428c-a5a6-2f01b1d1f574", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453766, "uuid": "cc85876f-6065-4659-a6da-88e8fa9fc20a", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9H:51iw7gryNkSV1hy1Z1u2JLu9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453766, "uuid": "5936ede8-ef80-4cdb-92ff-652c734d7206", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453766, "uuid": "53fcd63d-2cf3-4dd9-befa-3a35ea2430dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453766, "uuid": "8cf7d9a2-1901-4d8a-b134-7a3e0b5b68bf", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13b3c0e-719a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782504544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504544, "uuid": "144df205-7c69-4ab5-be44-28e30cbb27b0", "comment": "Malware payload", "value": "74e559fb0e4d3e020f75106cd6d5551e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504544, "uuid": "b5abd9c0-e927-4ec0-8326-47740f632a30", "comment": "Malware payload", "value": "8d8cb1fc6861afc1afe5facdc700272f013abd1b97c3076a309175a730917bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504544, "uuid": "0231c813-47c1-4c6b-8e98-a965b2dd3ef0", "comment": "Malware payload", "value": "abb306679eda185a8a2b578ecf67c3d122db137a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504544, "uuid": "1cb1d1fc-ff78-4d7b-a2bc-a43d79cc2a84", "comment": "Malware payload", "value": "e4d5bd174444f1991df902acd22e068312cd15496bb8d8c279ffbf026964b1011e04e53865b93870918ac059926dcd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504544, "uuid": "f3cbca16-d3e1-4ccb-87f3-dd9efa6d9416", "value": "T13B231813215089FDC959827147BFA52BF932F0BE4135F38D6BA47E22ED4AD310A5E4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504544, "uuid": "27b36f10-f8d6-4584-948a-c1ba2ef98bc9", "value": "768:THrJP0Sgz2doZ+huIjx6jKv/zUbguTVPIJ75zkHTjzgzegMzbgOVEr7eTBn:hcJMuSv/zU9Ta756TYO0OVs7eTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782504544, "uuid": "6dd20ae3-2dc2-4004-ab08-52c56aba2580", "value": 46152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782504544, "uuid": "f8caed6c-a82e-46c0-b7cf-46f4188e9bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504544, "uuid": "38f93ec3-2db6-4f9a-8656-53fd931dc3b6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67355652-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478999, "uuid": "3dc7c94d-6586-4e27-a1f5-637f092a40c6", "comment": "Malware payload (RustyStealer)", "value": "8a543dd478ed8fa843fdc57a3da8075e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478999, "uuid": "274d9702-9111-4ec3-bf20-1ffd5a6b3dab", "comment": "Malware payload (RustyStealer)", "value": "8da0c79f118e909fcfcb9b041dfa584d3687a16b7e197b30164fd4a64100b9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478999, "uuid": "61243fc0-ca48-4ac5-9ea5-2f7f42da7ae1", "comment": "Malware payload (RustyStealer)", "value": "a11560e1adb452bc631eaf498891abbc494919e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478999, "uuid": "5fb295c4-1a74-4e0a-8df4-114a3e6b796d", "comment": "Malware payload (RustyStealer)", "value": "458056cff2b61bab4b650663e8777edec4946615ef2a7ea0d2fc3330bd7a628caeebca252f89f41bc3d8ee0a2e0723a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478999, "uuid": "bfc48491-5a31-4311-a925-7a05d9464af0", "value": "T18B167D03FA9582E9C49EC179C71B9233EB72F88D1624B69B1BD44A213F53B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478999, "uuid": "a368fc32-3533-4f4f-9b33-be6aacc110d8", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478999, "uuid": "3af551fe-1fec-4913-9724-0aa1d1fa8b31", "value": "49152:LMhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jreFGyFZZN2:L5w3u+vBoTheSioTM8jSFGGZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478999, "uuid": "dd7f0792-906a-4bcd-a3d9-e49328465241", "value": 4217856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478999, "uuid": "44c47168-ddc0-4b4a-ba52-2e28e8b7c629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478999, "uuid": "47db3598-38d5-4135-926e-44ef87c8f64b", "value": "8da0c79f118e909fcfcb9b041dfa584d3687a16b7e197b30164fd4a64100b9cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bb53e7-71ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782518072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518072, "uuid": "3127b0ae-2f55-4fed-b66b-fcdf1c477aec", "comment": "Malware payload", "value": "9f98ff4f205de5b49d3714b1114a066b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518072, "uuid": "c0cb8cdb-2001-46e2-90ae-2846e6403418", "comment": "Malware payload", "value": "8da466b43acd48b67e37d1acb3944d966f45bef9658c835d983d2d2017ee7921", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518072, "uuid": "38a7de6b-e4af-4d65-a384-0203e51a694d", "comment": "Malware payload", "value": "7c07949a68c4104c13a1095ae856f026bed131e1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782518072, "uuid": "62a29a9a-a206-4d5a-9679-d643359d1629", "comment": "Malware payload", "value": "346a904484c49299b4b510bcc18684fd689e63943df5d3c01c30913c0c70068ec9211ba3c7deca721571791688199b7e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518072, "uuid": "3ed55276-80cd-4aa4-ad29-fabecf28bd60", "value": "T16BE57B07BDE008E9C0AAA33189B6965A7B75BC490F3227D72E50B7B82F763D05D35B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518072, "uuid": "b480cd3b-fcde-4de5-84be-68e669cf3624", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518072, "uuid": "a07a4c1f-fe28-4895-afdb-7b6d3db7cbfc", "value": "49152:c1NYdPqmN6tlROByDMpz/R2TU2nfh6Fqk5/3Y+9Fg3oTqb:cUcG2TU2fkFqkJ3YTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782518072, "uuid": "0756969d-9417-448a-b65a-5296260104ee", "value": 3254664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782518072, "uuid": "6239f2c7-9f38-4671-9e68-8a7d131a7593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782518072, "uuid": "f9c312bb-d95c-4d34-9ddd-a05801e4a690", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7042b3-71a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782510362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510362, "uuid": "47fa87eb-0e9e-4366-aa97-e78843d34f29", "comment": "Malware payload", "value": "8116bbec6de3e9fe349fed0d0396d663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510362, "uuid": "15067828-e935-40df-925d-abf3dee07e19", "comment": "Malware payload", "value": "8e730cdde5708b2704ac0c67d78b36fd2fcf62d195a1c056f6ee87ca655d5187", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510362, "uuid": "ade58710-c5ad-4eb1-8129-0085fe022335", "comment": "Malware payload", "value": "0c7b61989e17f1c9e364ab887e9f5f2f5b62b2eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510362, "uuid": "a1c6f5b3-8d0d-4087-a0da-566f0014f914", "comment": "Malware payload", "value": "0c37bdf76866dbd488f8dc61087eaa181e86a25526038de7a429aed609094de4a1a09d576aff2fe1601c39decaf60518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510362, "uuid": "deb50688-2759-46d3-bf53-cc202578eec5", "value": "T15457DF7792067CEDE9B94DB4C41015816DA878874778A3C7BAC8B0F666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510362, "uuid": "b8a8f6e6-0c50-42db-b578-7fdbd611edb4", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ4:cqYUQuVDt0TZEAoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782510362, "uuid": "f0b9b343-3d89-4db5-aace-ec8b9c2c19d3", "value": 29655040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782510362, "uuid": "d4ddb726-02ba-4280-b4a1-a8231cad2eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510362, "uuid": "924d3f87-7f09-4f90-8a4e-7b26256b47cf", "value": "8e730cdde5708b2704ac0c67d78b36fd2fcf62d195a1c056f6ee87ca655d5187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe2b612-7159-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782476678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476678, "uuid": "e8942e8d-38da-4392-9f92-62b2a6007b48", "comment": "Malware payload", "value": "427d5b276677ab0cb3c9c49fa836fd90", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476678, "uuid": "ca3119df-e91f-4011-82c8-e2eb2471cd0c", "comment": "Malware payload", "value": "8eeec931993815450ef75aab8d2824c30dd8b4f5b5cc3749b68571ee8faf2393", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476678, "uuid": "5ef92e3e-e67b-4778-8e6a-a0fc6d0e3f81", "comment": "Malware payload", "value": "126a5eaea7c51bda21131656f6de4f1df5373df7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476678, "uuid": "9598af2b-2597-4e6e-8ee1-d9aa34c1fa5d", "comment": "Malware payload", "value": "59bcbc206e67ae3a37176e2a028c12156735c3f37729da7eded422f03595e4d7c3e806fe95fb4c0e14503fdb29c8a5a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476678, "uuid": "72d75d55-1d4c-4ebf-9502-f135f3ffdd65", "value": "T18BC293DE8495A5FC411518B479993681490D2E8BA4F2CE8FD3B70F3E950F0B6B0D8E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476678, "uuid": "542882cf-5b2d-432c-9012-fc485f86513c", "value": "384:oeBpJbxOwkmF24InviEEEJ8B9SyJ6mhhs4IyTIc:oeHpzheqE7Jg9SynhYysc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782476678, "uuid": "c6406c1b-3dc7-4156-aae7-7b2d8d3801b2", "value": 27973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782476678, "uuid": "9e343bec-feb1-474c-9389-9168f4f9ecec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476678, "uuid": "e327d946-2d21-4e93-be98-8030c75fb3a6", "value": "check_bot_m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f903110f-70f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782435435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435435, "uuid": "65bb4f0d-0b99-4e6d-89a4-61473e4a4469", "comment": "Malware payload", "value": "36f8c648245d5ccc8562b2f86b402b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435435, "uuid": "81b96f64-9c82-44aa-95fd-4fa7785c7f75", "comment": "Malware payload", "value": "9005f8bce3ca2681ccf267e105a9eb8fafa444334b0af5f5cecf9e8ef1c68210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435435, "uuid": "38217e21-4777-4aca-8e70-86bff4a7770d", "comment": "Malware payload", "value": "d3c07dda5650d1496d24b77f528034132b38c586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435435, "uuid": "d8a73fe1-0dbf-40ae-aa22-c56daf19d421", "comment": "Malware payload", "value": "a1f2bfe42557eac7f1e57cb36a483fc342f863e80ba2f6f6fe9efa1ca36acbfd996d8e766fdca850256bd9554544d1c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435435, "uuid": "40330ed7-f0d7-49e6-b9dc-452f5b632d7a", "value": "T10CF63385A3C104D7EED7093688E7E225DBB4FD221BA1D5DF872586252E231D2B43EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435435, "uuid": "af5c8023-5a9c-4f9c-80eb-633fe13eccb1", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435435, "uuid": "45cec2c9-56fb-4ac3-8368-302f491ff3ec", "value": "393216:585vzaRBU7vT6nGCnGjbi2bjRoeiKO21lwL+/3PNtzQGeuBpJHXOWdeJ:e5vziYvT6nGCnkbi2nRTiKFjPPN5QGe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782435435, "uuid": "5006b1f4-258a-43b9-a9d2-5ae27f2d5b16", "value": 16368833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782435435, "uuid": "46d0245e-a06b-45d2-8f1f-bfec5aa1f82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435435, "uuid": "5e5b8d57-06b9-4ee2-b32b-15a16a650463", "value": "assets.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95df04bd-71a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782510430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510430, "uuid": "a4ff5034-94e6-4ab2-8221-9764d683c960", "comment": "Malware payload", "value": "508a2d8b4edcdeac5ce9822d61182952", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510430, "uuid": "f2ac60a8-726d-4029-85fe-742cd4446635", "comment": "Malware payload", "value": "903eb1ce068f0d66a2215086b5d1aff18c8472833b74dad47bc5f388aaf21ca3", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510430, "uuid": "e12f8b47-0f21-455d-be81-7fde80c283a6", "comment": "Malware payload", "value": "69ab0cb4f0966683efe4448790b64a5528fb5b19", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510430, "uuid": "c2ef4c91-f179-4fc9-8c17-5bf5a1777743", "comment": "Malware payload", "value": "fc8a3105d50a052cc9250868dbedeeec21710e9f5f4ab178f68f1cefe87fc25c207a5849fb93f88d4f71352881811374", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510430, "uuid": "bac5295d-b395-4021-a8a8-39bb91837fc3", "value": "T1B485AFCDA48F74D4B8E587F16BDA7F6BC5AB10E32C81FD0E702092744E04579AB9E819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510430, "uuid": "718668c5-b89c-44f8-9bca-4facc665502d", "value": "49152:QlvAC7pRcb25oXRKoV8KQWMmrsyUE7Li+ZdCD4:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782510430, "uuid": "80928385-ee3c-4061-b53c-fcf895ee0ce4", "value": 1847199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782510430, "uuid": "2f07221a-02b1-41ba-b4ad-fb893a73d984", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510430, "uuid": "abddec52-116e-4c4d-bc1c-e7bffb113775", "value": "bPQHHcxgbPUbB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371784b1-7132-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782459591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459591, "uuid": "0417e600-8c9f-4cc8-859b-f1de0602cb05", "comment": "Malware payload", "value": "091f04a93d8410ff1875de552962f0d6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459591, "uuid": "3317a213-46be-42ee-a7e0-409727fc57e6", "comment": "Malware payload", "value": "919d6214cad73b37c57a652caa651b2a4d7c2059b40abe79eb9322b5f1558cfa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459591, "uuid": "f684a930-5d5e-47d1-b338-3d83094d0121", "comment": "Malware payload", "value": "c495a957e6b40f55fb6522b7235718b7127c647e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459591, "uuid": "dc49b9a9-049f-4882-a71c-6c2d508bb33d", "comment": "Malware payload", "value": "4960e20efa7885273261f3301f7cb55814bfc17cfdfb8ff7022d68d4bba87603be156f1d06592f584b60192b8b793f1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459591, "uuid": "8fe18258-232b-48bf-89bf-51118d6e40c2", "value": "T1F0136D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459591, "uuid": "1c8531ec-4a6e-428b-976d-38a30f472f4e", "value": "768:yXRWNGxVi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:+lxZco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459591, "uuid": "982230b3-807a-4040-8e1a-9abf355511ee", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459591, "uuid": "c21d105d-151e-49d9-a74f-c9653c076b0a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459591, "uuid": "133d8ab8-1112-4ea1-a6f1-ab721ab08763", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d030164b-7194-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782501938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501938, "uuid": "7e9c161a-0ce1-437b-b10f-24a1da5327bb", "comment": "Malware payload", "value": "d041a2bc3d3ea600cfb91b5b5f140036", "object_relation": "md5", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501938, "uuid": "1c4e1638-dd78-4722-b25e-34fbea18791c", "comment": "Malware payload", "value": "92420aeb6fcb2cbd3f8b4b645f08c9fd7173fb258439f5de6b91dc45dd72d209", "object_relation": "sha256", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501938, "uuid": "e808a88e-3c85-4d6c-ba9f-9ce896e89628", "comment": "Malware payload", "value": "08bd771ddd0b4ed12705e369c6617a13afb8432b", "object_relation": "sha1", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782501938, "uuid": "e966bbd1-75fc-4a92-bdb2-143f213d67a3", "comment": "Malware payload", "value": "363bf8e9079eb21a76d29b3fd83f4924aed1de9f11908cf553bcb93b7d7f40f17035c75ab0f6f6964b8f32f5bae54d99", "object_relation": "sha3-384", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501938, "uuid": "42dfd38b-cfcc-4e34-8458-8d691a910c87", "value": "T117563356BDC76978D0D7C7B5579A212D30297FCA8F688C6B73E87A1C0D72200A4F6389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501938, "uuid": "70df94f1-c0ae-4ff2-8eab-6cfb01716c04", "value": "98304:CQfQ3Vu6lqX9LTEZpY84XSvl4vHguz/LtjHRJSreQkMSQ1xEl/AWug:CBVumqhIt9gAuz06QZ1aAWug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782501938, "uuid": "d2158fbd-3a05-4c12-a96b-6a6a952a1f2b", "value": 6295552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782501938, "uuid": "a91d40e1-d4e8-47e2-81dd-9632c5e12dad", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782501938, "uuid": "0b384df3-0bdd-45d8-976b-e9df80afafd0", "value": "a-software85659014.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0277ba4-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478799, "uuid": "24b23054-6d86-487d-8c15-6a920ec1042f", "comment": "Malware payload (RustyStealer)", "value": "06acc48e71d65bbfe3806548a516c5b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478799, "uuid": "4f266285-ecd4-410e-a5a9-399b1a5e40c7", "comment": "Malware payload (RustyStealer)", "value": "95752f1cd35d41c1b16a36cde5fa89773aed1705730ff3b2a40078c1583a098c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478799, "uuid": "0bd55b8f-2d2d-48d3-bfc0-71516677b7c9", "comment": "Malware payload (RustyStealer)", "value": "ac00c922bd38503e0e6598ee30d5c7182d2ef544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478799, "uuid": "509423f5-44c7-423e-9547-93e2fa3999f9", "comment": "Malware payload (RustyStealer)", "value": "c90287a817eeaefe754ef182853366daa45f0c762bfea4c8b9eba51bc4786edcb1a1053b4224bb94dbd57e81fcf3761b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478799, "uuid": "c2768a1b-607d-4b5e-bd43-7b4eafed6765", "value": "T1A3168C43F699A1E9D05AC038E316A233EBF2B88D4770B69B1BD44B612F13B601B5D717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478799, "uuid": "90788dcf-69df-4e88-a47b-810b78cb6871", "value": "49152:xZp7cq0qjiy70iwC9sO8TE5GfS+4VPoe75+D+bqOUC/dwKnWeEL/UA112lx7z734:xZp4q08IlgH5LjUC/mKbFNtAkf3TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478799, "uuid": "558b7123-1460-4968-a241-8e9d61567480", "value": 4365312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478799, "uuid": "113cd5c8-ae02-4522-91b0-9ab955f21c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478799, "uuid": "3995a4ef-c77a-4d87-81b0-3512fbbe7b38", "value": "95752f1cd35d41c1b16a36cde5fa89773aed1705730ff3b2a40078c1583a098c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e214f09-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479037, "uuid": "602420ec-b326-4000-821c-cf0e338bfff7", "comment": "Malware payload (RustyStealer)", "value": "260657f419e41d92e676a81f660b9403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479037, "uuid": "323cd228-83cc-4dec-a427-a79b1f9f44cd", "comment": "Malware payload (RustyStealer)", "value": "96627dbbb6130d1842b5244f4ca8fbbabee67982d03d6bb05ff0e53a3fbd7ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479037, "uuid": "9fc58320-237f-4ca9-b548-d834fd08e0db", "comment": "Malware payload (RustyStealer)", "value": "7d4c270997349f9a8030217f888a9b901bd92f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479037, "uuid": "156e12c5-80e7-4ee6-b66a-382c43209631", "comment": "Malware payload (RustyStealer)", "value": "de4c61dbe6a7a400c7aff7fc660ae0c3c159eb6153e920e3544c355ee91dfefc29edba102e3c4469f8baa1e0757e027b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479037, "uuid": "62f5daca-1d22-419c-98ec-84a98387bb9e", "value": "T1C7167D43F69563E9C05EC93AC31A9223EBF2B88D0720B69BD7944B213F57B605B5E305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479037, "uuid": "7f158c1d-b917-4d72-9b2c-b4b6166b8504", "value": "49152:1yUSUEczSeKTxMqfvuNp8RV5/N/7iECHIMdSEq37pD1ogsLkqwD/avR6/egNgiqc:1P+nZZwvcES7pRomtJqam8r82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479037, "uuid": "2cfcdca6-bc17-428e-9840-4548f9e1bc35", "value": 4251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479037, "uuid": "e8996b68-05c1-4919-94f7-37f87398a892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479037, "uuid": "9e43a972-e914-4749-80a8-46532acfd834", "value": "96627dbbb6130d1842b5244f4ca8fbbabee67982d03d6bb05ff0e53a3fbd7ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a780d53-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479004, "uuid": "2fa10442-7dee-4dcb-8b96-3cd4a24b4f38", "comment": "Malware payload (RustyStealer)", "value": "39d65662043cedd60aac868773c2c630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479004, "uuid": "6b25b878-1a00-4b4e-b469-8bb9c16a9202", "comment": "Malware payload (RustyStealer)", "value": "96d8ed136e291fcb896b5742307e3ddb6636a22d4492665ecd8fa3542c892ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479004, "uuid": "7a3123e9-0453-418a-ae6b-240e10133c2d", "comment": "Malware payload (RustyStealer)", "value": "15a02d56d3f76c5ce92103ea12b45c4b682cec6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479004, "uuid": "5b164f9b-df66-44e1-ac0b-17332ba99094", "comment": "Malware payload (RustyStealer)", "value": "111a46f3403580f95f0415ad7b52fef797f5edce9573b42246541ab3a485451fd443036b0bb880c31cd0cbfaafcc8998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479004, "uuid": "31197108-67aa-4e9c-bb6c-f2862715cedc", "value": "T1A1166BC3F69541E9F05EC178C61A9223EBF2F88E1620B79B5694CB652F13B605B5E30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479004, "uuid": "ee2cbc30-77c3-4ffb-85ad-2a3aa5477c45", "value": "49152:b8nrfSe5TFlW3YaiK5WsgqdDlPx642vCrU7t1ogsLkqtF473dDLzC6JqqCNyenq:b8nrSq7+dtPgGU7nohkxJ7Cjnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479004, "uuid": "7949b447-d60f-45c9-9e4f-4265111fde41", "value": 4254720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479004, "uuid": "051599ed-3d56-4748-955a-81b5e035f576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479004, "uuid": "8cebdd08-cfc1-4138-91b5-682028510849", "value": "96d8ed136e291fcb896b5742307e3ddb6636a22d4492665ecd8fa3542c892ebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381d87c9-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493093, "uuid": "c677752b-500c-4520-b545-a1958c851dd4", "comment": "Malware payload (Mirai)", "value": "075e70bfba65e74db93688b1ecff97d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493093, "uuid": "f8efd9a0-21b4-4a2d-97c1-9a317db87efa", "comment": "Malware payload (Mirai)", "value": "96e980decd2bbe2a5e929796a5bfd82ebcf251c2c49ab4bd62c9b0c8b855a4c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493093, "uuid": "49d74001-a77b-4116-ac77-348ac6cb2f46", "comment": "Malware payload (Mirai)", "value": "ebd145befbd9c2a05d1e579582a6fb31ff477cde", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493093, "uuid": "e9554fdf-ccd8-4c39-a731-b86d12b5216a", "comment": "Malware payload (Mirai)", "value": "4ec19c2d37cb5b5205f20e75e4239cf4f68cdf90aa3c156c8592bed71cdf15b16698fc9c5c473212806b1a8a7b66cc7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493093, "uuid": "6e2d4782-4882-4ff5-9337-6199b7fdaff9", "value": "T1AEE30846BD418F17C6C321FBFB9E428C3A166B7DD6EA3103D925AFA037865D60E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493093, "uuid": "cc2efa82-fbfb-49ee-877b-cb8944c2ba40", "value": "1536:rkexxqPNGuzns88WIJ4VGqkT0cMUGoD7OijM8pz2qeolkLwyw+BT2xcagttHAy8U:YWXEnsx4BkgcioB1BRqrcAXjR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493093, "uuid": "60a2c160-1f33-4f98-91fe-7ae2cca589ba", "value": 147072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493093, "uuid": "bab4161a-1850-4532-8412-e96eae449153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493093, "uuid": "e1cc18d6-1c6f-4540-b061-9451d6c686f4", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4c468c-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "adbac396-983f-4097-8ea3-bc79bd23dea5", "comment": "Malware payload (Mirai)", "value": "f1f67667b99edfca728bef2def41801a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "a3128961-78ae-40a1-a4c8-e0490b276150", "comment": "Malware payload (Mirai)", "value": "98639125e1b6e3596c3d9e65e79b56390c0cad363f9d2f73150286c7b3b79055", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "5e59150c-0e85-4da2-9e40-8dc4c0d1b95d", "comment": "Malware payload (Mirai)", "value": "760b604be98e2d19858f1ecf11cf3937576da78b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451897, "uuid": "9f00329d-4c40-4309-8fd0-c1bd122134b9", "comment": "Malware payload (Mirai)", "value": "1b12ffa0698200c4f036646b2e538c8cfaae2319001cc503543b1e046c4f4136b47f86b321433d475cf5f5fff434ed83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451897, "uuid": "226be142-0658-4ffc-917d-479b4d152f01", "value": "T152D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451897, "uuid": "e4690e46-8169-4e3b-af0b-6d58e22ba74e", "value": "3072:f0DvinprSHrDqtVubB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeuLJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451897, "uuid": "62280e52-521f-49cb-849f-a991f52f9567", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451897, "uuid": "26642b45-c0b4-4b95-aaf2-a9181e64f1b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451897, "uuid": "b40665b3-f8f9-4520-918b-86e4e2509e23", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62eeb92e-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782478992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478992, "uuid": "cec1b879-f539-4891-bc76-8e7b61474f71", "comment": "Malware payload", "value": "32580ced08057ddc9dfcdbd6cd7e8145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478992, "uuid": "f77d387f-29e6-482a-911e-7479ac1c1336", "comment": "Malware payload", "value": "98642b369a90c86dff4f99646e1e56b83ed4c540a9200346d08590a36fadc65c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478992, "uuid": "ad1d1f96-2cfa-4522-b4dd-c9fac6c61a6f", "comment": "Malware payload", "value": "3631343d20a74280a6bef1cc87211e024be2a144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478992, "uuid": "e7c4c339-ceb8-4043-9f5d-b6a85adc15cc", "comment": "Malware payload", "value": "6e9cba9f1fbec4255facb5c8051269c22c2c82de7bfa935e7f716ae751bc474136b8bc0a5e6d8d1da38e08c94a1bc2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478992, "uuid": "56a03624-1b63-42b0-b9a8-2272d4c9408d", "value": "T125168D03F6A582E9C09EC038C76A5233EB72BC8D5621B69B6BD44A213F57B705F5D348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478992, "uuid": "8c25df30-8c99-4f4a-b627-367fdd457ccd", "value": "27b13286444c212838932cc2bc4d8999", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478992, "uuid": "9c04c8b3-d2d3-48aa-8de1-0d753584c903", "value": "49152:JrWr+47nVuHgC0Um75tUE1v7aTiWygVi94tkN2QBQcFObMnXWXLqW/cXk1T/:JyJeYBkKgVg4TsUqkX1T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478992, "uuid": "6770f326-db31-4a94-8766-8c7abc3275f3", "value": 4148224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478992, "uuid": "5207754a-7dba-433e-944d-9cab3648c1e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478992, "uuid": "294ba5c5-5c72-4eba-8d23-b80dfa2766ba", "value": "98642b369a90c86dff4f99646e1e56b83ed4c540a9200346d08590a36fadc65c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e10e73-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478886, "uuid": "c7006461-0441-45b9-8dbc-2f4dbb65c091", "comment": "Malware payload (RustyStealer)", "value": "10dc559182458c1ec10f21c31bbbdccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478886, "uuid": "1e45e0e5-b716-45ca-ad7c-b6f2109ef163", "comment": "Malware payload (RustyStealer)", "value": "990ed1ce451e3da0d02b708adfffd69d53a076309ae2a1f3a56e55d79322e331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478886, "uuid": "496914e8-5362-447a-8091-6ef1a8b503af", "comment": "Malware payload (RustyStealer)", "value": "d9ecbceabd7700fb7efbad7ba96299762f83c4ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478886, "uuid": "178e19e4-bd08-4733-ab77-99efaafd4baa", "comment": "Malware payload (RustyStealer)", "value": "1a9ec48e443b95f0d473fe84cb7e679a064244ed9d259cb20067417a085686754683a2efb5a61f595e2eda6d9464a6a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478886, "uuid": "c8f1ce10-55af-42c8-bea9-9c3cc126b2bb", "value": "T117166C43F69581E9E49EC138C31A5223EBFAB88D0621F79B1794CB652F57BE01B5E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478886, "uuid": "8d34cfff-5899-4744-baba-352b3c6007c3", "value": "ac24c75129de769cfd950785b3c3d496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478886, "uuid": "84c024be-1b95-4448-8ba0-a7635b02587e", "value": "49152:OHSYxnvUT7lq7Yutzt5ns0W29cW1mI/HL5T1ogsLkqb4yz26ukMGu729+oUyx2VY:OHzvos4Sn//L5hoqpGd9xU1VgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478886, "uuid": "da76bf2f-946b-492a-9061-fd955c44f194", "value": 4260904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478886, "uuid": "45c08e81-e1ab-4e1d-97ff-9904f6776d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478886, "uuid": "afb7f946-ed8b-4695-86f2-892b96bbbef1", "value": "990ed1ce451e3da0d02b708adfffd69d53a076309ae2a1f3a56e55d79322e331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e039e1-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478856, "uuid": "fe8814aa-529d-42d6-8018-73ccbbec209d", "comment": "Malware payload (RustyStealer)", "value": "d17b005f6c28c7875294028f7a8595d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478856, "uuid": "29971cfb-5f07-4265-8fc8-24cf34728323", "comment": "Malware payload (RustyStealer)", "value": "9aef1f496e5c3cc1ba187fdeb1865b2cb112e71316062913be88e8eba219c417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478856, "uuid": "a1a57a47-7469-4f6b-8bd9-0a7bd393e837", "comment": "Malware payload (RustyStealer)", "value": "bc285df2b57842713075ce1ffc30823146a4a028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478856, "uuid": "56940cd3-2483-41c0-b3cc-93e5ef858182", "comment": "Malware payload (RustyStealer)", "value": "39c792a35a47b4b83583bb316b7442bd70d293671bf9bb189244f4428b97c8f484484c87ac9b24772f60c2d3d3154e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478856, "uuid": "e13df4d1-af1f-41a9-a1d9-6542e5222d71", "value": "T174167C43F695B1EDD45EC138C31AA233EBF2B88E1620B79B36944B612F53B605B5E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478856, "uuid": "7e57203f-061c-4330-80a4-ba8fd578af22", "value": "f72749ecba7fab6de7b94e1f834f30d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478856, "uuid": "d2feda5d-8af7-478a-979c-6565d873ff95", "value": "49152:Gae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uNoFlyHX+f:Grcb6qUgJIfQqoKX15KoaHXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478856, "uuid": "1d42b9b9-e048-4ac8-bed4-2a7463a2f656", "value": 4255272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478856, "uuid": "256c0aa5-da61-49b0-a1fa-9f5024f84126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478856, "uuid": "d65a77f5-9db0-4bbc-b69b-79091a31ac2b", "value": "9aef1f496e5c3cc1ba187fdeb1865b2cb112e71316062913be88e8eba219c417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad4838e-70f4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782432914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432914, "uuid": "587bd913-4426-4a2a-8fa6-acf9e625918e", "comment": "Malware payload (Mirai)", "value": "7f9e07615caef05c14e89dcd8aec8f67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432914, "uuid": "be73f005-1ce7-4759-bfff-5b68f4a1a9bf", "comment": "Malware payload (Mirai)", "value": "9ba2316d355bef23251b64d0f39abd38b25685f5d7db78b3b4be73d1eda5dbe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432914, "uuid": "37ae2023-d14c-4267-8fd2-d42a50f150b7", "comment": "Malware payload (Mirai)", "value": "6d296d4524d970bb1e50009d421aee609d038774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432914, "uuid": "b5061107-f280-45f9-8ab5-c6585dcb7782", "comment": "Malware payload (Mirai)", "value": "c37943918ba33c70a0b88231a0267a1053adfbf0a47d1b441e3ac565ffdf809c83620cf7532b02f5fcba6636d37eca25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432914, "uuid": "45d0095d-b59b-4086-a093-c187d72fd1ce", "value": "T17DE31856B9519B12D5C331FAFB9F418933136FB8E3FA7101ED206F50238A99B0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432914, "uuid": "00739f1e-7362-408f-98b1-6337626d032c", "value": "3072:lgHkffCUj6p9VvZjjC9zONNaJ1Ju8n28Q8sVbtzz+W9a9cZXzFFb2:lfXXj6p9Vg90NarJu8n28EVbl6Wc9yXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782432914, "uuid": "92866ffd-157b-4a5c-a468-5fa980dac292", "value": 149348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782432914, "uuid": "774ce8f5-0dc5-4605-9a66-1d2d8b2b0793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432914, "uuid": "db59d1d6-e9e2-4db0-8bc7-ad64b4b5e2e2", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2dd73a-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479120, "uuid": "ca2519d7-08d7-4d60-a100-35b0fefe177d", "comment": "Malware payload (RustyStealer)", "value": "894291fe7bc78e1eb8d19d0d79511445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479120, "uuid": "e70a09bf-c754-4313-9fe2-90ce8381cf7d", "comment": "Malware payload (RustyStealer)", "value": "9c1ec8c3d134806ed5cb3dcca895a9d0ccb6423657974199a51935eb73b077b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479120, "uuid": "4ae46f2a-a754-4c61-931b-80e78725ae8f", "comment": "Malware payload (RustyStealer)", "value": "4c8bcc432bd7bad7d3ad1ca8e1e4109f79cc02f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479120, "uuid": "461a9e48-745c-4402-a82b-7b4a67d7f4cc", "comment": "Malware payload (RustyStealer)", "value": "a324449c4b5b32e381e712c54693ec761dc24c28feeca2e4a9f4edf565b01bf740bd12b6d8dbf1031589a8fc89c7e3ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479120, "uuid": "80e56886-7ccb-4e31-a845-7866aebcb258", "value": "T187166C43F69582E9C09EC178C72A9233EB72BC8D4620B79B27D44A616F97B701F5D348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479120, "uuid": "a8d1ffbb-bffc-4b75-a156-9de324fe350b", "value": "c7cc9a5fc18197fac5eb1ce360dc0e53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479120, "uuid": "093ead34-45f0-4aa6-b6bb-d1b6325266bc", "value": "49152:wOi8RU7WiExWox5onvTOu1lEn51ubQwxUm1f2eCMiSyBuO2IJ0u/SFR23upkvZVY:wO1bL4d8bgm6meo53HWSv4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479120, "uuid": "8f96547e-f313-4d4a-8042-eb03e09e116f", "value": 4132352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479120, "uuid": "8ee123d7-48ea-4e8e-947a-953c120f51a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479120, "uuid": "64216d6b-f6d7-47f4-b389-afae82d2009a", "value": "9c1ec8c3d134806ed5cb3dcca895a9d0ccb6423657974199a51935eb73b077b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7ee217-719d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782505687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505687, "uuid": "391eb760-a26c-42a1-8e63-cb707d761bb7", "comment": "Malware payload (Mirai)", "value": "ca07a9959ea5c6ed8bdc4ed6beb2bcfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505687, "uuid": "35f8f048-74b9-4856-9ff8-87127cc7e3eb", "comment": "Malware payload (Mirai)", "value": "9d48fad78597d426f827c79d8c5487eef94537bdc101eedf9ae21f0e038f4edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505687, "uuid": "85936cf8-7b4a-4aac-b479-02414fcd29ed", "comment": "Malware payload (Mirai)", "value": "08375b9e00c1900bb20566445e97b83c8ddadbf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505687, "uuid": "dff91784-372b-459c-a792-3d078a29a1c2", "comment": "Malware payload (Mirai)", "value": "04bba641154e8057df9053aa8c08effe032358b725da4e177d8214b4c49fa66d8523a6e2e1cf8d4ff1db792cbe9c576b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505687, "uuid": "e8e77d88-9a36-48f7-b997-f0da5059f043", "value": "T1A0E44A46F8809F62C6D426B6F75D42A833074B79D3EB72069E155B3137EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505687, "uuid": "840ae18f-648a-4ef1-b110-06b82b22e7fb", "value": "12288:LfdAWq4gmAAXxUqqYeRi/gEcEHE7eZbBrTzM69jnwp8p3nxHT:LVAWq4gmvUqTkoglEk7Wbhzgkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782505687, "uuid": "e5f78d0d-5d97-47d5-b1d5-135ee3267e5d", "value": 707008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782505687, "uuid": "dff6cdf9-9910-4c99-b781-3dda997a4083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505687, "uuid": "5cf496ab-ed17-4ad3-a5be-4f3a176a1a84", "value": "barm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07de252-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782458560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458560, "uuid": "35f86273-b061-4126-be96-00fd77f6c90b", "comment": "Malware payload (CoinMiner)", "value": "67678d9eac81d026a20330208892a3ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458560, "uuid": "0449042d-7fa3-451f-b44a-ad3f6b04597e", "comment": "Malware payload (CoinMiner)", "value": "9d4bd3393013152eb9e1f263f051de832cdab5e8597a56474f0f67e086924b6a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458560, "uuid": "c3e68f46-2935-42a5-a92b-fa05a4345723", "comment": "Malware payload (CoinMiner)", "value": "5c9c2169d7fd3ab822ea6fcf28ee9cf4f9ca8ad9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458560, "uuid": "6aeaa8d2-b9df-4140-86c6-210d1773bdb4", "comment": "Malware payload (CoinMiner)", "value": "9716a0e6d9b027b75de47586af301a8adcc86868c8398cf44fdeba92aefb6e1e19553c0a8cd53269d953ea137e49b8e8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458560, "uuid": "e1bf529e-643a-40c5-8c1c-19a4876b2963", "value": "T13DE0268931117B3126E04D06B78480C4F5178FFA5A08EAA0F9040878B1C404C7136F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458560, "uuid": "619bbb4e-da13-489b-8994-e7604df605c8", "value": "6:H6s9USMA63xQ2BWub8ylKNh2w5a6mabEVHrabrbabdX5b35ti/u:as9LB6BFUOlYEwmab2rabXabdXp5tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458560, "uuid": "321c0607-a69e-4ece-b3c5-2329be2cd99a", "value": 324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458560, "uuid": "0531d03e-659a-4512-81c8-650c39b3dd1a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458560, "uuid": "36f5f17e-b5a0-483e-8e4f-01cd9580da69", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cfb4b2-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782511806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511806, "uuid": "ea5c980a-347a-4bd5-9b80-325afba68f87", "comment": "Malware payload (Gafgyt)", "value": "33feba392bb39657a51b0ff3cfcc2c15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511806, "uuid": "d95d9c78-da51-40c5-a4de-cfc33ce7697a", "comment": "Malware payload (Gafgyt)", "value": "9dd42a8f746ee23cca69f4b1471117906c3a2868cf4e8a247b0cb39869146f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511806, "uuid": "b8a45f82-d983-4898-90d5-a6b0dca18db5", "comment": "Malware payload (Gafgyt)", "value": "d79f79b9c90ec3fdfc51d0955762dba379ec4545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511806, "uuid": "26d3de0d-0923-4efa-98cd-c11f103f91d4", "comment": "Malware payload (Gafgyt)", "value": "a6498392ee8432063c0037e66162082577791daa8a8b3b3301d866f86cc7e1e6ab4b834f59d7784501fea0f507e2cab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511806, "uuid": "c8a8b724-0c7a-47d2-bbe3-b9ad85d93616", "value": "T188E3965ABB619EB7DC1ECE33069A5502118CE58612E96F6FB2B4C52CF74B84F08E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511806, "uuid": "8b9423e3-662d-4356-b524-0410c5b3865d", "value": "1536:vPeTGez2Dd/4lJHKEWMko6Md3jNMZgH+spYOBLFrxLFgMWmMkdVcG1DKW01so:v8z2DYpR68Mqn1F1JgfmMOVcG1DJ01so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511806, "uuid": "2341bc25-ff60-44d4-a232-dd326541bad0", "value": 151396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511806, "uuid": "e882de10-a913-4847-8b28-0a056ab82cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511806, "uuid": "888cf116-d2af-4bf3-8441-91cfcb99cc09", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3531ea0d-7137-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782461735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461735, "uuid": "4707400d-4a13-4b2e-a623-a5eb30ff5133", "comment": "Malware payload (WannaCry)", "value": "0be31a0c4f530c88f1cdf8491827fa39", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461735, "uuid": "1e1cc882-e8b2-4d2f-8907-76f9019e0d71", "comment": "Malware payload (WannaCry)", "value": "9ee6705e84b232fa40fa8911064b68755615c4c8e26a1b9bb15b7e3fc91b646b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461735, "uuid": "29d089db-07a2-4d96-9b0a-bdff6702ee05", "comment": "Malware payload (WannaCry)", "value": "cd0f34ec571a6b0ec988a00e4bb9a63425869ccd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461735, "uuid": "d4546864-ebde-4d43-8095-bbe3e7fdcb2b", "comment": "Malware payload (WannaCry)", "value": "6e3047ecc7487def19d779240a205b2d5f51bc26c6d99c66fb2c192bb65c57a9c04f03fad670cd64bb6c722de4cd8ce7", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461735, "uuid": "ea801b13-f486-4224-a777-5e56768b5581", "value": "T11C36C401D2E51AA0DAF25BF7267ADB10833A6F45995BA66E1221500F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461735, "uuid": "7ea9b406-10ab-479b-9e68-e0d5c8c8ad86", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461735, "uuid": "8a9fd9bc-cab2-4227-9b57-26f351d9ad20", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626dq/:jnXnAQqMSPbcBVQej/1INR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782461735, "uuid": "714e64ca-02f7-4578-8566-a91c2d13337b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782461735, "uuid": "6cd3f3ac-7141-420a-a9e7-ddf9e743f0a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461735, "uuid": "adb8c5fc-7df5-4f8c-b3de-6938282760b7", "value": "9ee6705e84b232fa40fa8911064b68755615c4c8e26a1b9bb15b7e3fc91b646b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965164ee-713f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782465334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782465334, "uuid": "e2a1b6f0-0ad3-403a-8505-13f4374dcd0d", "comment": "Malware payload (WannaCry)", "value": "5d6ee171b5847a25c2d068031faef9cc", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782465334, "uuid": "d67a7b3f-6e50-42f5-9365-0c808a51cde2", "comment": "Malware payload (WannaCry)", "value": "9fdfcf7a50597fe85398f2a3520919f8c309f087c433a509ac0f730d363cf5ee", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782465334, "uuid": "4a402b39-2b9f-4ede-bcc0-64bba58d2ab6", "comment": "Malware payload (WannaCry)", "value": "a9e0b176984c9194f40e70e093527a46acd40a29", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782465334, "uuid": "18db7667-ede8-469c-aee1-3c5701853092", "comment": "Malware payload (WannaCry)", "value": "2b14ac15564b3e4c3608c2de270b51ce83ec6bf7d23afd10587e50baae4583a1217362926090b1de4d51c11a748b84c3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782465334, "uuid": "be32b119-0232-43e2-91ca-cfe9974a7531", "value": "T15F36239932EC90FCD4076374D4B78E26E2B37C4A22B9870F5B5086660E13795BF68B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782465334, "uuid": "2f5d5a9e-b768-4f2f-818c-19ab02c9c323", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782465334, "uuid": "dc0c7ca3-4cdd-4bc2-8225-7c180c353ea4", "value": "24576:jbLgBbLgurgQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAd:jnsnsQqMSPbcBVQej/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782465334, "uuid": "02854c37-d12f-456c-8048-a409f6371991", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782465334, "uuid": "1014b491-5fc3-40d2-822f-1e777e1b035a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782465334, "uuid": "f8a086c7-304d-4cb4-9ed9-f2b5496c71f7", "value": "9fdfcf7a50597fe85398f2a3520919f8c309f087c433a509ac0f730d363cf5ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded17e8-718d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782498821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498821, "uuid": "34315fc3-e44b-4924-91c3-188898f7554d", "comment": "Malware payload (Mirai)", "value": "b017f1035365c245027927a6a48c0d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498821, "uuid": "95ff83a9-aced-4e09-9770-cf1143da7cfb", "comment": "Malware payload (Mirai)", "value": "a0a88574ece61c4b43691f3136d01a691436f875482bc3989af0d782847508ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498821, "uuid": "33ea8da8-56b7-4aa9-aba9-1f3116d906dd", "comment": "Malware payload (Mirai)", "value": "2a7f6cc2050b7582f0695490c72254233e91c06f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498821, "uuid": "0947a467-80e9-4de5-88da-27749b9c259e", "comment": "Malware payload (Mirai)", "value": "0f5db9e4bdb4cfba055039d7a235ac438bfcb0e3a6ee0b45a3b57fa0f34dbbce62afb482cc38817b9e4b63a4fedca292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498821, "uuid": "8fad7f60-b552-4e73-9346-56f4f906ee1e", "value": "T195140752BD51AF23C1E232B7FB9E428937156B69C1EB7206DC227F503BC68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498821, "uuid": "d18e078a-dc06-46a5-aee3-ea42cf655d21", "value": "3072:83qniVmbPUxwFYsJdALMhHkfei5x7l3uAAFvI+T+APJZNGvu23:83OhEfjrZ3uAAdI+T+uJZcvu23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782498821, "uuid": "4d9b2996-d80b-43ef-95c9-3fa04980470f", "value": 200580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782498821, "uuid": "15887ed6-284f-4248-b42a-96cfb264af08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498821, "uuid": "dbe4bc8b-f510-4299-bc69-e0d85a1c7a3c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146a8835-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478860, "uuid": "7907b8e6-d49c-4aa0-8de9-fa51026469e9", "comment": "Malware payload (RustyStealer)", "value": "bd760e634620513016f5d3db47f4eda9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478860, "uuid": "cf6064a3-2802-4600-aed0-1c38a30cd971", "comment": "Malware payload (RustyStealer)", "value": "a0f009b91a76d602d781aa9fff9522289769513b5c9ec10ece9f4891aafc6684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478860, "uuid": "0917c253-691d-420e-a0fd-faf12bc612a7", "comment": "Malware payload (RustyStealer)", "value": "8e8dead8cbc6a79939760f7b0915e139effa4b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478860, "uuid": "31546f4f-7c24-419b-b249-f6e753fe430b", "comment": "Malware payload (RustyStealer)", "value": "fa065551aaef8bca0e58fb648439eb6f42c504684b014102e0c52289ef0b4117e5455a0d143daf9a3dd7f948c86a9442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478860, "uuid": "1d871c39-475f-4200-9e2c-ee492cb6ae9c", "value": "T1C7167C03F79581E9C4AEC139C71B9233EB72B88D1624B79B5BD44A212F53B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478860, "uuid": "01190e79-bff2-4fd9-b91b-3a5dd7bd157f", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478860, "uuid": "f7ef7ee3-6dbe-4072-b0be-c96b6856064d", "value": "49152:6+eFIHlV9Bm51YpKX5sjTdcUlwRfQU1ogsLkqTUhs6UD9MKup5uw3Rgm/L7f:6TIHrIsdhIfQqoKX15b35/Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478860, "uuid": "f0f76255-23e2-468e-8fc6-56ed0b85ee8e", "value": 4209152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478860, "uuid": "692cfae7-be4b-4bbc-bfa2-f42702c57ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478860, "uuid": "8675945f-36ac-427c-b6f1-e5b18e77f16d", "value": "a0f009b91a76d602d781aa9fff9522289769513b5c9ec10ece9f4891aafc6684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf889c21-719d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782505803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505803, "uuid": "a9f4e7fd-eb41-4877-bec2-5c0ddb8d7343", "comment": "Malware payload (Mirai)", "value": "0a9859984842510ab614932f62a16094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505803, "uuid": "f017c9e7-3fed-4e1b-b7e4-6b9a3d7af536", "comment": "Malware payload (Mirai)", "value": "a150c4ff04cd3731328486fc03598eb1f366fffc6a31f66e2b27a560769e54ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505803, "uuid": "4a7582a5-c385-481e-97ee-ab3c133f53f6", "comment": "Malware payload (Mirai)", "value": "b926586065e6dfbfed97ebff63ca48329f2364d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505803, "uuid": "5f0bd2ea-c068-43fc-a466-bf1edb59a4cf", "comment": "Malware payload (Mirai)", "value": "041eb3f610507e0298d3912fe936c33507e74b09e361ab064cea4823f3e80f5667a65500600d28b048ef37957f6b8143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505803, "uuid": "1b64e683-7d25-47a6-b823-c72f8e5fec11", "value": "T11453F1E6C2010497A6B618B0FE74838FE74A743495F5B9BC9624CB1F214F4798E58F1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505803, "uuid": "3fddf8ad-2b2a-4f27-9c41-07bf9cb4b64b", "value": "768:XdI1YNtsHlPABBMKzrKwZZk624GCQ+3e8mgBKuThaIQDoqs66oRQA1RveU2PIOyK:tIM6lPABGgb7kv4G/pgBKDvqmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782505803, "uuid": "cbd03832-179a-4597-b71d-091c05cb86a9", "value": 65904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782505803, "uuid": "0ced716a-d5a4-428a-9a84-9305383e1ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505803, "uuid": "181cf3ef-fea7-42ef-b06a-3ffe8688c955", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd971f28-718f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782499760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499760, "uuid": "7f54df7f-f7cc-45ca-8862-6bf702bb1aee", "comment": "Malware payload (Mirai)", "value": "6be29c192262c9b6987f1df5562eeae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499760, "uuid": "07a07880-6b5b-4874-aadc-cd209847dcb8", "comment": "Malware payload (Mirai)", "value": "a1913214f517254c854ebc0ca8aaac737d89a633fed786c83d2b9f6bb8b7f398", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499760, "uuid": "ebdff584-b4d1-442a-8ad2-591d4877a5c3", "comment": "Malware payload (Mirai)", "value": "10d43cd21ef438113a727f96ab5f06a4e4b280bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782499760, "uuid": "b074ba46-e810-4c2e-8a3a-5b104cad608d", "comment": "Malware payload (Mirai)", "value": "6d16fdb41c5d33a47a360cf3ec0cb0cffb28338821e5795dc6fb80d71e0f82c323ca6ed5c3a1f6b7e474c4b4d45d4c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782499760, "uuid": "7ddb750a-83a2-4412-9ce8-a88294020674", "value": "T15734D791A4118ADFCE0158FA77AC4F342B817C70861B1FBD5D5194A8A28F8DFF1C6BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782499760, "uuid": "15742d28-fb11-43d0-ab12-94656b0d3698", "value": "3072:npLc2NZ2iPQo7OTqrdG08IPeEv7UGKlckf5TglWH1ZloEs:nhcgIiecd8I2M7UGKlcqmQVYEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782499760, "uuid": "3b8a3ccd-6fd4-44ac-b371-eb5a85e30f27", "value": 251140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782499760, "uuid": "33d00ec2-88d9-4127-9a3e-70ce465dd4d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782499760, "uuid": "2beb1292-dbd5-4468-bd06-1bbb090029d4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cebac1-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478961, "uuid": "b94b410c-3833-4877-86f3-d3c10fd3c91a", "comment": "Malware payload (RustyStealer)", "value": "f8dd091e55b5cce125ded11ba441b287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478961, "uuid": "ebd8db22-a80c-488b-bb9e-ccc48a075af0", "comment": "Malware payload (RustyStealer)", "value": "a2cae636e32a071fc687371786f7072072ebe4dedcef1dbda9890c8bf03b9868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478961, "uuid": "512f4d9d-5ff5-4f08-b662-e90938da8142", "comment": "Malware payload (RustyStealer)", "value": "023ea1d21263c20b75b51eca8b6e19fbb11f9994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478961, "uuid": "64344bdb-406d-4194-aca5-7df79231a73d", "comment": "Malware payload (RustyStealer)", "value": "e4323bfdc30ea35e5cdd923cb977ca1e47ae03bee9731762bef0e174dda6e2ac40eed153976d1d63f2117b7483915a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478961, "uuid": "7f56ea96-b26f-4966-b742-db20d1709d2b", "value": "T164167D43F6A541D9F05EC038C79A9233EBFEB88D0621B69B1794CB612F57B601B5E306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478961, "uuid": "5ec8de82-07fa-4e88-a24e-a1ffd3c6677f", "value": "49152:3yUSUEczSeKTxMqfvuNp8RV5/N/7iECHIMdSEq37pD1ogsLkqwD/avR6/egNgiqn:3P+nZZwvcES7pRomtJq3gwaD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478961, "uuid": "78312274-866a-4bf4-bb3e-16a7514d3a42", "value": 4251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478961, "uuid": "13a84800-7f98-42fc-87fe-2a61208b3df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478961, "uuid": "b5e20099-a568-48b2-a03d-81a964e5bb74", "value": "a2cae636e32a071fc687371786f7072072ebe4dedcef1dbda9890c8bf03b9868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaedeb7-7115-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782447331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782447331, "uuid": "3ac8b53b-4f02-4881-be45-43aa3918b79e", "comment": "Malware payload (WannaCry)", "value": "73359c690c889a80a018dcf524fe37d5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782447331, "uuid": "a993df32-f07f-4a3e-b078-5c043f2d2d49", "comment": "Malware payload (WannaCry)", "value": "a34a0ab1fefe807b508c1eefbc6c092fbdb00ee47b2e9473b8d30c7b7333d5b6", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782447331, "uuid": "537dc40e-f06d-4d5c-ba41-9e21b3bdb65d", "comment": "Malware payload (WannaCry)", "value": "83ffeebe62a8eac5294325b52929d817201e5c1a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782447331, "uuid": "110c0f12-575e-4779-aed2-8b36914739e1", "comment": "Malware payload (WannaCry)", "value": "3f7da4f205940d17ad2e0a302d58db8d0a6bd37f796501d78a141ee9f8b332a01db2388f075a99430417fed581b0d0f1", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782447331, "uuid": "bd92ea1a-0b87-4c86-ac60-9aa37698be31", "value": "T167361259336C81BCC11B523494B34D26E7B3BC5A227D970F8B948B6A0E13790BB78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782447331, "uuid": "60d57fce-1844-47fd-8718-eba04acd864e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782447331, "uuid": "bb7a6274-8679-486a-aa29-985135921d11", "value": "12288:jbLgXvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLg/bLgddQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782447331, "uuid": "b67b1c77-e3db-4a99-881b-09e2033ed59d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782447331, "uuid": "c8bd47cb-eb3c-4609-b555-62300008c0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782447331, "uuid": "ab8abde2-56f5-4338-ab71-86fd629d413e", "value": "a34a0ab1fefe807b508c1eefbc6c092fbdb00ee47b2e9473b8d30c7b7333d5b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7387e5-7128-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782455551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455551, "uuid": "4515ccaa-9ace-448c-9b16-93c66d88bd0e", "comment": "Malware payload", "value": "3f7528babe4b9389d5c223fa5c70e294", "object_relation": "md5", "Tag": [ { "name": "Fiber.Program-Dropper", "colour": "#AC99AB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455551, "uuid": "24cb11fd-bc79-40bf-88b1-0a69e285f8ee", "comment": "Malware payload", "value": "a3dfa0fbf915bead62a3d78ad23fa0ef0169e13e177e3c5c4d7768b6230f7e1e", "object_relation": "sha256", "Tag": [ { "name": "Fiber.Program-Dropper", "colour": "#AC99AB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455551, "uuid": "75004732-e119-4a9e-aaf3-e2d176619175", "comment": "Malware payload", "value": "da540da3846ebf15ff18cab4f08aa523d0bd4e0e", "object_relation": "sha1", "Tag": [ { "name": "Fiber.Program-Dropper", "colour": "#AC99AB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782455551, "uuid": "073ac2a9-7e42-49ff-bf21-d30b3406f865", "comment": "Malware payload", "value": "6342921f4a2c0bc98712f9131ec2d3adc5acf3980aa31c8ac2895a34f5c3f103bb35bfd6f2932c91bcb6621f5d069964", "object_relation": "sha3-384", "Tag": [ { "name": "Fiber.Program-Dropper", "colour": "#AC99AB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782455551, "uuid": "62205d02-6a61-4e57-99a9-ffa1771540fa", "value": "T118E6BA8AA63DD083F87309FC19149F930056D689A6DC4D1F50602D7ABC9346EFF9B39A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782455551, "uuid": "f284c6a3-df51-492a-9250-cb57551ccd0c", "value": "1536:ehgkHS/AOsmmdu2drTNtcvKKW6rk46itsNPwyEK7TWazI8arviEFCeUDUl+OEWII:Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782455551, "uuid": "1cd214e9-4382-47be-a7a4-2bdfbc6bafcf", "value": 14392082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782455551, "uuid": "7703abac-4541-48cf-bd9d-fbce827959b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782455551, "uuid": "6ba3f84a-40dd-4247-8f7a-ec813b44f69e", "value": "Scan DE0030 Rechnung RE00390230-0302-00032.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85b4e5d-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478813, "uuid": "c9259560-4b21-46c5-babe-8a3a25798fc8", "comment": "Malware payload (RustyStealer)", "value": "16ed0d418245c47341c71db17b7b92f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478813, "uuid": "ca3fea36-6792-4e04-993f-63003f75aa0d", "comment": "Malware payload (RustyStealer)", "value": "a493e6d90938bbe5efe425f644c4041d0a0c74404c8b73f489d33d328d1501ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478813, "uuid": "7cef4202-66bb-44b6-aafb-aa45bdc6131b", "comment": "Malware payload (RustyStealer)", "value": "23873ddbc77bb57622a6268e615fad409c94a26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478813, "uuid": "ddb67f15-a83d-4eee-8a16-e14ef3bbcdce", "comment": "Malware payload (RustyStealer)", "value": "3fdec3261beb75f003983e0c9a93f19a83f39b1440fe60ad1443f57f2fda5b570400066126f70e04f5eb7aec3fdd41ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478813, "uuid": "5e9a6d52-d7c7-49dd-89ef-9d01afa205fc", "value": "T1C4167C03F6A581E9C06EC139C31A9233EBB2F88D1625B79B1BD44B612F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478813, "uuid": "8dd56f85-e78f-4d55-917f-b43431c99715", "value": "044a91827446762cad07f42333b6570b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478813, "uuid": "b695b72b-00d1-4bf7-9e02-9c486286a1d3", "value": "49152:xQTQ/pcussnsRk3BcAOyTMk5khWmAwhSgkSXU+Jf/m+OZ0cBwh5JDpA7weUv/pGf:xQXus3cQKxSXDJYibjvBGb1H0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478813, "uuid": "8872de1b-b0d6-4bd8-9aea-fcf4a52ef511", "value": 4280320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478813, "uuid": "3bcde270-689e-46a7-9dae-352b1848f638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478813, "uuid": "d29d2e2b-bd66-4db0-b889-d4ef2e3f9753", "value": "a493e6d90938bbe5efe425f644c4041d0a0c74404c8b73f489d33d328d1501ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b836f68a-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782441768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441768, "uuid": "f138c232-3500-40c2-a7ef-e75eb8c01e7b", "comment": "Malware payload", "value": "ced9a94ac3a1bb631a4c80af90635980", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441768, "uuid": "6fb6df06-51e8-44d6-abf4-bab0219113df", "comment": "Malware payload", "value": "a53225573a531d9f3dffa1450ec8300aeba24d90911daaf102b927e721528f44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441768, "uuid": "909d3290-0114-4230-a595-d3a53702bb04", "comment": "Malware payload", "value": "042f45452f0d96d8182fe314a47307661242f283", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441768, "uuid": "4bc9f8b3-41c0-4a8e-b382-03d5ec025af6", "comment": "Malware payload", "value": "c1ecd9edf9ef39dd79280b90739eacae16f9d0c543a40400ec106b6954158e0158c0bf4198609da6c88bd885799c4ae2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441768, "uuid": "ac479f1b-f5f9-4594-83c0-124d200b6cbf", "value": "T17133AF32F781EC3449DDB0FF49A10E79A75916638719BE1C431D1AC62AEE227F6A1C34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441768, "uuid": "6069d198-442d-4224-b9dc-7e9172e2b1c7", "value": "1536:SyQeceMi2XuZCTG5RfZx2qWJZ1plPxlLbSPjIqPt+MvI:eeNMrUCTmn2vnbSLnF+Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441768, "uuid": "91d4efa4-fb30-4040-8304-1a93b4339bc8", "value": 52638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441768, "uuid": "33b57c0a-cb73-48f0-bdce-1b9f63d43aef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441768, "uuid": "082112cf-f163-4411-a0d1-166ea8098106", "value": "ocafa(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19855a51-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478868, "uuid": "ad631771-782c-43f0-9a8b-df539a618880", "comment": "Malware payload (RustyStealer)", "value": "cb624c395ca5cd9c17dce1e147c3b191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478868, "uuid": "a5baed82-ac39-45ef-aec6-0a6316da88de", "comment": "Malware payload (RustyStealer)", "value": "a59521e3eb851bf86fff48634c3c1ddd573ba3ce123a46a48f1bf08617c00e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478868, "uuid": "87cb34a2-d570-4aac-8f52-bc3a0c24064c", "comment": "Malware payload (RustyStealer)", "value": "5eb29963546c2ac77bcbe8875745f3c6bae07266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478868, "uuid": "42afb587-e024-4cbc-bc1b-6b41bff5cb12", "comment": "Malware payload (RustyStealer)", "value": "e2a330871b6bffdfad676c6779bbbe1cb5235c231fb4c23bf9e126b5bd485d071ec44629947519dbb73238dd4782fddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478868, "uuid": "76e35df9-3861-4d69-bad6-1c1d8966e883", "value": "T112167C43F6E541E9F46AC03CC3169A23EBF2B88D1621B69B1694CBE12F5FB605B5D304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478868, "uuid": "faf0aa0c-258a-40ae-86d1-f39e56c4e6cc", "value": "44c5cb64d11d686fb9616e416a0ebe34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478868, "uuid": "d5ab99a7-4ae7-4d50-95f4-a249aeb2f10d", "value": "49152:flPgI2yvGOHEsb0WUqPGKFV5ChvklXixeNGdwnalgK1u+AfCJU8CN6SCmYvkFSx1:flPmyjlXbSx4rna+Kj8YgSNUEj41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478868, "uuid": "e8e4d873-8461-43fa-a35b-47e76f8234c8", "value": 4370984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478868, "uuid": "f7224b0d-a34f-400f-abab-fdec86bd1c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478868, "uuid": "8d6ec5fe-0c45-495a-971b-586fdf03f2de", "value": "a59521e3eb851bf86fff48634c3c1ddd573ba3ce123a46a48f1bf08617c00e34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89109be9-7108-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782441689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441689, "uuid": "61aed617-522b-47b7-9377-5418df77dce7", "comment": "Malware payload (ValleyRAT)", "value": "371c5012232b478c8c4f658f5b320dac", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441689, "uuid": "c49f33d2-4c10-42c9-bd46-b9bde0877bc3", "comment": "Malware payload (ValleyRAT)", "value": "a5dd2750e61244f975ecefad9ef22ee7524368fc2520a6cd6cf83e112fb3ccba", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441689, "uuid": "055d6968-e398-49ac-a990-ef1251b75cfc", "comment": "Malware payload (ValleyRAT)", "value": "9272ecd42b28182c47b7376c590d4c8b8b7fd790", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782441689, "uuid": "21f8b643-c1f0-463b-ae3c-925e69aa7cea", "comment": "Malware payload (ValleyRAT)", "value": "bdb13db852b9d6f11d6c5230eb152f9575d6d2ace41dcef1024abf010b6da29f9f4cf89e4a340bb5c1738dcac58fa4ca", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441689, "uuid": "1c983007-1afa-4e78-9e43-a65d8396e063", "value": "T1A5863385BBCA48B9C04FCF76C59B075C30187FC08A694D2776D9770C6EB262859B638B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441689, "uuid": "8f7ce609-4ae5-476e-a9ad-e0b601b29928", "value": "196608:+Mi8ZQGetd/xM6O7IhP2x9lJVMfo00ET4C6sEwgbz0M:ZdQPkDtrZXET4CDEnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782441689, "uuid": "dabccdca-4d11-4875-bbe0-b4ca0db97298", "value": 8347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782441689, "uuid": "b888fb3c-beab-4408-9a1c-fe5dddc03ec6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782441689, "uuid": "7910939b-e16b-4795-9cec-a98465e25b74", "value": "a-software85659013.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb50e67-7132-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782459518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459518, "uuid": "54d6946a-ce2d-4b43-950b-e6ce712181ad", "comment": "Malware payload (CoinMiner)", "value": "bafe8e9aa22a944277d4e5bfcec177f9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459518, "uuid": "68e5c8d6-0513-4970-bcba-9947fd524edd", "comment": "Malware payload (CoinMiner)", "value": "a72cb33e43ae72204508cb79b97c8c194efdcfe56e1b56bec3eaf9af0d899b0e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459518, "uuid": "b79eaf74-6417-494e-a3d9-339f1ebc23cf", "comment": "Malware payload (CoinMiner)", "value": "2a77723f830a28c8c8fec44dbff9f7b4c7bd861d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459518, "uuid": "746ce780-1213-42df-b973-ddd6c5695cf6", "comment": "Malware payload (CoinMiner)", "value": "06feaed05971b664ab749048418f0b652892fb45e41f722a0e29051409e17815e7e7a47c35d33614ea357241f354af96", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459518, "uuid": "ba90ff14-3ac0-4851-95ee-f1d2253ef1c7", "value": "T123644A4ADF750FFFC5AECE3052AE121715DE885A52FA6B3761BCCD08B256A0416E3C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459518, "uuid": "29d07b98-a3e9-4df8-be06-8234c60f643a", "value": "6144:2DpouIjIavEZCMEmP0KQjRKbK8N8J05kfIN38X10erQ+NrJ:uohEubOcfINsXLrQmrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459518, "uuid": "d28f56a7-9f92-4d5b-81e6-44a97d5c118b", "value": 335420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459518, "uuid": "d2193873-7807-4da6-8e6d-78880ee74467", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459518, "uuid": "d7755343-064f-4c98-a0a8-08ea5c052d7b", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a232e9e0-713d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782464495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464495, "uuid": "d6e6aa64-7018-477a-a45f-df462d305a73", "comment": "Malware payload", "value": "62fbe5c5e5841fc82382ebb83e33c535", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464495, "uuid": "ebe6f986-bdf0-4218-852f-6e7563363ce0", "comment": "Malware payload", "value": "a9e0fb3a64d2dcf75a1e312d2bdc17955e7bc9f134d6592434881cc0e630f638", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464495, "uuid": "4b05bd1c-bcf3-4903-a4e0-9d322842c33a", "comment": "Malware payload", "value": "6c83ed6ae5c1487c8a93d19b8cb13248e167cd2f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464495, "uuid": "2c72e2e2-e588-4c9e-a92c-bd6b7bba8fc0", "comment": "Malware payload", "value": "a6011dfc2b982db5759d703d1dd0f2b3e46692f1e3ce5628305ed9501f617893c341a1b16344d93e16ad79452229531b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WDYMStealer", "colour": "#84EF22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464495, "uuid": "ce9a6e7a-2f3f-4e77-9147-ad9608943d8b", "value": "T199552330247CA9BCFBA655BD5FCADD46275206266EA04136F2CFDDFCA98480193CA3D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464495, "uuid": "0263ae5d-62f7-414a-8693-d6fb209826e6", "value": "24576:QgOuiqdFph+DeeH+UOK6hIpVefl0gWcGggOuiqdFph+DeeH+UOK6hIpVefl0gWcT:7OIRFeLl6hIpVeN0gWc8OIRFeLl6hIpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782464495, "uuid": "dc33f812-5ed3-4010-8dcc-01c0b749f7fc", "value": 1364260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782464495, "uuid": "23237712-b511-4e3a-a1a2-6fea9c1d992a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464495, "uuid": "4693bb53-7bea-4338-afee-e4b59f811832", "value": "BetterUI-Mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4263e909-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478937, "uuid": "647cc08c-eebe-4cca-b13b-fc09cf6861b7", "comment": "Malware payload (RustyStealer)", "value": "1264576eb9649b064a6c9fe34923fa16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478937, "uuid": "00d92434-3149-44c0-bff0-aca30cf3b997", "comment": "Malware payload (RustyStealer)", "value": "aa1568998c531266e0dd0f0ec26e623d6271e8441356b8267342fb64c73b9711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478937, "uuid": "5104d0fe-3a28-4811-a2c1-3a16c36e2145", "comment": "Malware payload (RustyStealer)", "value": "83609a69e0057093f1f44065266fde68bf911cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478937, "uuid": "6423e6cc-805d-4d6c-a7fa-3aa52e5979cf", "comment": "Malware payload (RustyStealer)", "value": "447d15dc0b01bd4f6fbfa41e70e2d1bd3180c06a78e64a2c0e34d35a0da5c44ecc8fc8fb55d9395e2ccb850d7bc10ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478937, "uuid": "1b96dde7-8918-4851-beaf-bd7d9f491ede", "value": "T1F7168D03F6A581E9C49EC139C31B9233EB72F88D5624B79B2BD44A212F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478937, "uuid": "6037ce4b-7969-41d7-81f3-fae31d6f2f92", "value": "c027ad65a3a7e550445a6ecb7bcb986e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478937, "uuid": "78af0804-6a4e-40c2-8be6-635af85e52dc", "value": "49152:AFXlq7LYMS3+e70b5dsEiFjI53gkqQ5YL5T1ogsLkqZ7Dsp36ZsaH2LmXxAwPKOS:AFVq78ACkjraL5hoL69Lex5KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478937, "uuid": "5110b20a-4715-48f0-8e7a-f7382341ac3d", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478937, "uuid": "9ef11bb8-c18d-4376-931f-db2442934a6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478937, "uuid": "82f838f5-2808-493d-a884-4537fbddf73d", "value": "aa1568998c531266e0dd0f0ec26e623d6271e8441356b8267342fb64c73b9711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfb1cd8-7150-11f1-ac1e-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1782472647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472647, "uuid": "085820e6-7dd6-42d8-8176-4672b1da0d0a", "comment": "Malware payload (HijackLoader)", "value": "92d237bf44b690e79645fcf276107bbf", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472647, "uuid": "04926a34-0c56-43c2-9f88-5a9ddf71e08a", "comment": "Malware payload (HijackLoader)", "value": "ab6be6dbe8499287e1f596d72791ed7be436c81b1c464ea388601dae07804401", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472647, "uuid": "d6c8c3b5-02a7-490f-a16f-1729a8497587", "comment": "Malware payload (HijackLoader)", "value": "933207525df3a3e511254c50a2299d3188904e28", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782472647, "uuid": "227cf96f-09d8-4f02-92a3-1a07056657c7", "comment": "Malware payload (HijackLoader)", "value": "a732e4f5ff087f5dcd75610d149b43ee811b58d02ec13f68e53708c83ed372427a2e06a1a2408ed86cf3ae2a85cd40e1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472647, "uuid": "abe69793-bf4b-491e-9b8a-9dc708cdff9f", "value": "T1920633D0B2EA6B36DC605D70C39A86430F30EDA0E713B05F7691F29928B319A5D756AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472647, "uuid": "ebd16778-1276-4879-a055-3f546eb618ac", "value": "98304:PLX1qUJj0MEv/QOwGcsPGwj2HK5HqrXcdotdR:DX1790McDesN2HX3dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782472647, "uuid": "b1a60e44-8c9f-4e5f-96df-f13d0650daa8", "value": 3997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782472647, "uuid": "9af76759-dda4-409e-b916-0f1cc3160d29", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782472647, "uuid": "51af04c9-4c88-4fd6-9d86-fd5b96874ff8", "value": "AKLVBOSV.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d90ad35-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782511571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511571, "uuid": "b2919396-57b6-4b00-854f-db4a4d90a10c", "comment": "Malware payload", "value": "23179b38e5f7f63cd8962aa335f9ed74", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511571, "uuid": "f1044126-acd4-499d-9d24-0f66ebdc8c7a", "comment": "Malware payload", "value": "aba53ac926aec982a32be2012d84e931a4499d8bbc5c5c652fe3928c1132c134", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511571, "uuid": "c0ea2e0b-d6f1-461b-9ddf-c5b679d2c6b1", "comment": "Malware payload", "value": "3c080bfa2d5ff741b6ab42e8f7eac16251e312d4", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511571, "uuid": "295429d2-b936-464c-b53b-f98b23df0be2", "comment": "Malware payload", "value": "e9598efa89b844385cacbd94f060eb2f1a4554112dbc39ffa72a69cfe8ac88478f56d0c9d214db19aecd3efdf5edc951", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511571, "uuid": "0a0ddaf0-37ee-4c95-9d9d-c72edec0b2f2", "value": "T1C4B6339B67BD8C7BE3999C35883706C9AA21F308B74502C6374DD8AFACD211D79A5D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511571, "uuid": "4b4fe8c9-ecbf-44cb-961d-a714775bcb99", "value": "196608:G5LmCKBWJxONXVy2SxI4BYU1gVw0gSHC7JwMPBkCE8i1msP3n4uFZEOhExaD:G5L/UVyfxBBYU1WwtSUPy8iN/HyaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511571, "uuid": "cd401d78-e82a-4f39-812b-920b0d78465e", "value": 10448646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511571, "uuid": "630f0235-17e1-4dce-abb5-db0136fb20de", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511571, "uuid": "f129c5a9-92c0-4911-a991-4d46cf80cdbe", "value": "files.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be507afb-7136-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782461536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461536, "uuid": "1da10ceb-8af8-4699-b328-3e00ffa6f295", "comment": "Malware payload (CoinMiner)", "value": "5f69ad635b5f66ad6c37193e56bf740d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461536, "uuid": "f0d55189-9ab5-4322-ab2b-a6f57cb5011f", "comment": "Malware payload (CoinMiner)", "value": "abe6031483b952c9d6421011b0002e68d5b46608ec304b271ee06f814a446017", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461536, "uuid": "e549c5e6-5579-467b-b03d-5916a6f4bc93", "comment": "Malware payload (CoinMiner)", "value": "ab440ce454d2d659bfc2d7a47ffdc610fd941dfc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461536, "uuid": "0b707d51-108f-4f5c-89be-a57415d0a7c2", "comment": "Malware payload (CoinMiner)", "value": "84f9296b977bc5c51c035c7a830b137ad5dd8324b6079f9644b62534b0bfc3c51108473f89bf6d590683ab9b37f897e6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461536, "uuid": "5da0bb2e-25ce-45ce-9aed-6723d1f8f20a", "value": "T175A31240802014E2EA895DF2757ED9CA996A0B74E1FB737C31BE018693EEED13724577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461536, "uuid": "59d8d8b5-1a65-4b2b-8fa5-b5d3724f3bab", "value": "1536:Hl0hxzzaXup/kmkyPVSYQvvEIkhbrHSPsySFBg5S7F31u6RH5+HZ5oi3XNJAewow:F0hJ595aHEIkhbryE5FP19atHkcMTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782461536, "uuid": "e3b5b17d-bd33-4d07-b99b-c003815fbd67", "value": 101988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782461536, "uuid": "3097e220-2be6-449d-863b-0b709665aea0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461536, "uuid": "a5e8425f-3d79-45c1-b30c-0986a4e23dfe", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278b834b-70f4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782432936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432936, "uuid": "846f48af-e1d3-480c-91e5-d1ad79a7bc3d", "comment": "Malware payload (WannaCry)", "value": "700b42582dca1ae9e0aad8a5dd7f9022", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432936, "uuid": "8882fbb6-f9de-4fb4-9f2b-ff4a73625abe", "comment": "Malware payload (WannaCry)", "value": "abf48b77091e81dfe1c0528bbfbf48cf3f551ac269b32e8e667449657cbe4697", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432936, "uuid": "bc842095-aab8-4a08-a161-ded94d09f076", "comment": "Malware payload (WannaCry)", "value": "f177ada3a90190dc9016346a51ed8c2536b9d0b1", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782432936, "uuid": "89b9c35e-ca34-4197-9e7b-d92993da674b", "comment": "Malware payload (WannaCry)", "value": "9badd95c222610ab61c08d4a5e05291ab2487b5ec58952def14cc13dc861de3fe9323086b1f757086092c903c0183670", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432936, "uuid": "a55634e5-a021-4d41-bc75-b3305574a85c", "value": "T1FD36239932BC91FCD10619B484B78E12F3B37C6A12FE5B0F9B40857A1E13B56BB60752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432936, "uuid": "68c69bfb-f432-4e5f-a9aa-d2f10811a31e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432936, "uuid": "0d747be3-cb70-4924-a799-c40b72e2f06f", "value": "49152:jn4nsEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DofPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782432936, "uuid": "be8dfc68-2a99-4467-9d0b-986a1a5a993d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782432936, "uuid": "d0919516-736d-4c67-930e-1db343c02b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782432936, "uuid": "7aa871ce-5c35-45b8-93a7-e3ae67e8d894", "value": "abf48b77091e81dfe1c0528bbfbf48cf3f551ac269b32e8e667449657cbe4697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb02c0d7-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "8438c566-4477-48f9-aa82-ce32a96137c2", "comment": "Malware payload (Mirai)", "value": "a56010e92bb95f1f8c1fb74086047266", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "89225c65-6b22-405a-bdd1-c5ecbc7083df", "comment": "Malware payload (Mirai)", "value": "aca4dcb3e2222a1375d9129bb757ba84b2bf4bfc3fc16e32c84297a88fa93b7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "45b8a3d1-5822-4fc3-855e-f4d49410d838", "comment": "Malware payload (Mirai)", "value": "e37c47688dd767f0840e73d1ce967d4deffa86e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "5b52ba59-bd97-4dd5-842c-92a030d7dd17", "comment": "Malware payload (Mirai)", "value": "7ab067c661b6b5abc5992395d38b4bc120d68df0ba2565984808df1c2d8f6a839c0c1bce372ac9cb6c758c4db23af443", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453021, "uuid": "2bc491f2-bc05-4d14-ba08-eeb255387dea", "value": "T196636C8AF5019E3EFC4BD6F542930E00A6317BA99D63291BA521FCF33E310D1A95BE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453021, "uuid": "d57a6d1c-ddae-4fe3-bff1-ceeab91b68cb", "value": "1536:suvEsf14gl9ku7/uoKPeUN4YGuuY2C8kl5OA6KW2Ai5:Z8sf1T99ry4Y9uP6GKrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453021, "uuid": "3160f309-2c65-4be6-a0de-93b7282e0dbe", "value": 71092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453021, "uuid": "cac6c3ed-cdab-44b7-befe-d8c41b0d3613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453021, "uuid": "d1e3cfe5-29c7-45ef-86ed-5a3580a645e1", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9971c957-7132-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782459756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459756, "uuid": "2942b52d-b4cc-49de-9032-a8e1a03b0d90", "comment": "Malware payload (CoinMiner)", "value": "1d180508a95b807d9aaf420becc44afd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459756, "uuid": "debe73a6-ca9a-4175-bc18-9f43d22e8db2", "comment": "Malware payload (CoinMiner)", "value": "adb6d88c2cc0205310fabcd7356b14e671bf24f3863238c9c4968bf6cadff0c8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459756, "uuid": "a97c10c6-acd1-48bd-8365-e840d2f811f7", "comment": "Malware payload (CoinMiner)", "value": "d1c45171f91366aa41dffc3ce89a5e6f8c094242", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459756, "uuid": "4f8cc87e-7280-4e92-bb26-5d2e796b92b0", "comment": "Malware payload (CoinMiner)", "value": "5b0608b64e687ad2888a6df42d7d48a0b7b4596fced4598abb297c1ca3c6bc3121306408a4d8b6dffddd3025bd6a815a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459756, "uuid": "052a39ca-919d-4c3e-90ba-c5f126b5ea7c", "value": "T1733419A5BC80DB52C6D427BAFA5D829933134FB4C3DE3506CD241F2936EB55F0A3A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459756, "uuid": "48f3e26c-581e-4551-bc57-26a547287013", "value": "6144:xpvLCzfZgxDDPWpnc9AqEqgptPNVM9nvDB3EZO:/LCzf02Rc9AqQNNV6yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459756, "uuid": "fe5aaa6d-8a17-4b8c-a168-31611c1ac07b", "value": 231244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459756, "uuid": "6d0105fd-3cbc-4bbf-a88b-562ddf928d2c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459756, "uuid": "e5f862a8-78f9-4e51-8040-7c9570cc2676", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c439a55-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478873, "uuid": "983edc8c-b09b-4a95-b78c-c3ccbc89ce61", "comment": "Malware payload (RustyStealer)", "value": "d0be04a50f59108082b5494a11edae7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478873, "uuid": "f23ba94c-37eb-4d16-af30-0dfad13f987e", "comment": "Malware payload (RustyStealer)", "value": "af86620ba519e190b2eb9175d0cb8b9dcb46ae610282164d0596c0e76f0e37b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478873, "uuid": "ccc3f88c-e3ba-43a8-8915-42db0368229e", "comment": "Malware payload (RustyStealer)", "value": "8d7de03085033264eeace68a19c4a031069e87b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478873, "uuid": "616fa5c9-f1c3-4631-86f8-b2b05eb064ba", "comment": "Malware payload (RustyStealer)", "value": "07cd375bb03aea13d02279dbd1572ecf4ac6b1883a8378951bee1c82b15a2b3a4b70d582819ea424bdd9c5d6c3384546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478873, "uuid": "7286b41f-8e5d-4d1e-9fc0-a71918ccf681", "value": "T173167C03F6A581E9C0AEC139C31A9233EB72F88D5625B79B1BD44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478873, "uuid": "1680e56d-98a0-4e70-b401-778a21e4739c", "value": "3a0e9c8ab7bea5dd191d4fb4e9b75632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478873, "uuid": "fbd5c420-6061-42c8-a3e4-d6d596ffba47", "value": "49152:LQTQ/pcussnsRk3BcAOyTMk5khWmAwhSgkSXU+Jf/m+OZ0cBwh5JDpA7weUv/TOC:LQXus3cQKxSXDJYibjvLOb140S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478873, "uuid": "efbd2148-2400-40ac-aebd-a1454eb9c9ef", "value": 4204544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478873, "uuid": "dd3c8e0a-0dca-48d1-a9de-f7860a9de304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478873, "uuid": "49c2ce6f-3763-4025-9629-bac18f00466f", "value": "af86620ba519e190b2eb9175d0cb8b9dcb46ae610282164d0596c0e76f0e37b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7628f5-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478932, "uuid": "3c254806-b7d3-4a67-ac4f-a85ea38b8f12", "comment": "Malware payload (RustyStealer)", "value": "d881ff2d496d18b8dabfff2a0cbef79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478932, "uuid": "fb93321c-1270-4b0d-bdf8-272cab0f7e32", "comment": "Malware payload (RustyStealer)", "value": "afc49e31e6ae1cb3b6d6e2b3745048dc9935fa5cbac24b31f47a94837e1fe2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478932, "uuid": "bf38ecc0-b123-4d19-91d5-a8c050f8f2b7", "comment": "Malware payload (RustyStealer)", "value": "f8baad3bc189ab36faeea3bb8f68e2a3e63aabaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478932, "uuid": "4415dbb3-2091-459b-9a4a-b67bace5db5e", "comment": "Malware payload (RustyStealer)", "value": "178e3089510af202287643437fb8e86670279bd8c3241a01c1262558392ea74ae1ca3e7bec8abdebfda85c3927ad59a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478932, "uuid": "7793c90d-38f0-46e4-b4c6-93882b3ca4a8", "value": "T1CD167C03F6A581E9C09EC179C71B9233EB72F88D5624B69B2BD44A213F57B601F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478932, "uuid": "d46a812d-7b96-400d-a62e-df7d2f683b57", "value": "94f1aeec059a0704a022d9dacc98cefe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478932, "uuid": "0992795f-8a63-4742-9811-109b4d43c14d", "value": "49152:svlph7vTlpCB/x5KpvmpF0vp2nueeu1ogsLkqa4fJZ5NDuGxIGCdK9zrPt1C0gq:sdpFc9DWQueeAoxJJCM9z5MRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478932, "uuid": "4ae1c8a9-6f95-4b86-bf64-e8312dafc8bf", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478932, "uuid": "fa084f55-4300-4306-8c39-dd63a9199a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478932, "uuid": "815468ee-7ccc-4651-ab3e-f931e1aa7ea4", "value": "afc49e31e6ae1cb3b6d6e2b3745048dc9935fa5cbac24b31f47a94837e1fe2dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b19c886-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478898, "uuid": "c6139e69-e935-4a3a-a385-8c96909d0eb6", "comment": "Malware payload (RustyStealer)", "value": "2f6758bd9dd843fe2b4337d8fca758d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478898, "uuid": "6226131d-83ca-4b63-acdb-c8e4d428b262", "comment": "Malware payload (RustyStealer)", "value": "b00956d3ba0a6c2f0219cf5a062996a1e9ace8b6926f3735a417896a719bb717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478898, "uuid": "cd43a78c-8cc8-47e0-ab75-877506346491", "comment": "Malware payload (RustyStealer)", "value": "e3b5c94d66d0aa05f9f3168cdac1ea44055529c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478898, "uuid": "4678eed9-b8f4-40ff-8f73-fe330e6b7d3e", "comment": "Malware payload (RustyStealer)", "value": "424bc916f221b4c7fd4a51cba45ee386ba78533922c154c80daedd03bf15cfcb5c2b5c4a3873e2c1f6c7131bcea7bf97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478898, "uuid": "7f27dcd4-36fc-4c0c-9e45-3f176382a75f", "value": "T1FC168D03F6A581E9C49EC139C31B9233EB72F88D5624B79B2BD44A212F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478898, "uuid": "7c472867-ad9f-4a97-bf4b-e00f9f7d6f54", "value": "c027ad65a3a7e550445a6ecb7bcb986e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478898, "uuid": "19f6dd78-a0aa-40e8-bbb0-599388698f42", "value": "49152:hFXlq7LYMS3+e70b5dsEiFjI53gkqQ5YL5T1ogsLkqZ7Dsp36ZsaH2LmXxAwPKlS:hFVq78ACkjraL5hoL69Lex5Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478898, "uuid": "69a6201b-81bc-459c-afd3-8d50ba1abc8a", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478898, "uuid": "c7015915-caa0-45ea-8e1a-a5484a62fef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478898, "uuid": "92b11270-c1ca-48b7-b923-ce6747e55710", "value": "b00956d3ba0a6c2f0219cf5a062996a1e9ace8b6926f3735a417896a719bb717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9342e1-7142-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782466636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466636, "uuid": "20349295-db90-40a9-be44-504288383116", "comment": "Malware payload (AgentTesla)", "value": "4b68c75c72823af59074f1dd0d07b1f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466636, "uuid": "11f7a8ce-9cab-43ff-af6b-86b23a1a962c", "comment": "Malware payload (AgentTesla)", "value": "b0e94f6295e469e77f16759ad1a117e4f5c120455032f375b38660f050bbf9ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466636, "uuid": "abd58b58-9d16-4fbb-9715-c8c3d7d2cb8b", "comment": "Malware payload (AgentTesla)", "value": "84f81b908bd93e017c25cebb74b970cc42c23287", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782466636, "uuid": "88cd6ed3-d0eb-4d3e-994a-7be637274174", "comment": "Malware payload (AgentTesla)", "value": "8b94fe15369335d0e20403b49236b1e130e51e9289a2d864c53e4fb11d10fd6a6e4c94af0e2ca2603524f8055ff056f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466636, "uuid": "451bf38b-640d-4421-992d-2e35139a3ded", "value": "T11CD44996A63BE0A9F61A98B34D0F0FEE8512DC52E6BE60D5DF0072C84DF2D91D435C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466636, "uuid": "8a4a0242-aaab-4bba-9a7b-dc4ae8ebf663", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466636, "uuid": "bf015258-7591-4b15-8205-92c9e006b4d2", "value": "6144:3bfoprb/eSgnR253Ghob6cbz28k3ptWX/eELXZCr7YBLwf5ct7Es:3ba/etn+H6az2823WXWSXZCr+gaws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782466636, "uuid": "0bf2c255-de32-4f24-8783-fbb5eb32df62", "value": 642784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782466636, "uuid": "93216a1a-6215-429c-8d41-c1bb5d57156d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782466636, "uuid": "0614ec6f-712b-4f44-af58-4291578b5da0", "value": "NEW-ORDER-EXPORT1234244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4c5345-7174-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782488163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782488163, "uuid": "f813874a-694a-42ac-816b-3f842051e6a6", "comment": "Malware payload (RemusStealer)", "value": "83c72f21a650908f11476e32c210951b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782488163, "uuid": "a523de43-c69a-4f36-a0f5-d44d023ac719", "comment": "Malware payload (RemusStealer)", "value": "b122fb13a9014410c09a8ae53d40979ad4c2f7903223563941aea3be50edf01f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782488163, "uuid": "a77f54fe-2e44-499a-9bb1-4bc043b13fc7", "comment": "Malware payload (RemusStealer)", "value": "a9464a7c132787dd9589c51ecb48d7bb4bc05d66", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782488163, "uuid": "10d676ec-7155-4a3f-8eaf-f1799429316f", "comment": "Malware payload (RemusStealer)", "value": "e60e2600c15f0d6a2dccfd263e239b540711ebad06c27b7e60af30e4ef2d9298789812af8e286ef9baf91f04c3201d06", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782488163, "uuid": "b3605c61-e6f3-488f-838a-6ad4c6c6072b", "value": "T183046B10B1E2C4B2E673053118F89B75597DBD310B214AFB67D80B7E4F342D1AA35ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782488163, "uuid": "70465bc6-48e7-46c6-b8b3-8372855346d8", "value": "44fecc80f9b0222c9a3ac23b1cc2d9f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782488163, "uuid": "f34323ab-d6a7-4221-8cd0-67f1a40b3920", "value": "3072:iVDsce3PgRODbw/g4jmlAQJRSeI01tGrrP/lOAg0FuD0kpqMaf5A:iVrRys/Lfg8ex1twMAOJppah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782488163, "uuid": "4825a005-2029-4a1e-9245-23995d62e888", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782488163, "uuid": "121e211b-d2ce-49d9-9d7a-9487a11ee982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782488163, "uuid": "c3fcef18-0575-449a-a193-1a460678dfab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c784053d-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479160, "uuid": "28116900-e7d3-4548-bde1-66aeb3fad102", "comment": "Malware payload (RustyStealer)", "value": "1fcc698a3ec527ad70918c7b09ee183e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479160, "uuid": "925b3d5d-4c8f-4d3e-9552-eee763a904c4", "comment": "Malware payload (RustyStealer)", "value": "b1b42a53800427415c6ac7d386574c04fbee740b1993150103b55f68d8ebb625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479160, "uuid": "4c32227d-da2a-48f9-87d1-1a0466e2d8d0", "comment": "Malware payload (RustyStealer)", "value": "bdde8a33e0e8aecefdaa5f6f83379c9bf0642b66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479160, "uuid": "b3f661e5-5b84-4bd4-9a73-ba8f61e4154c", "comment": "Malware payload (RustyStealer)", "value": "702d64eaf0b813a25d3ef807d866fe52a842819c1071fc018e947dd083bcf7c1129b602da2d74e4019913b59b49c44c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479160, "uuid": "43687a3c-412d-407d-8379-127ba96f09a9", "value": "T131166C43FA9582E9C09EC178C72A9233EB72BC8D4620B79B17D44A216F97B701F5D349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479160, "uuid": "e9053f10-ac08-479f-ac05-29dd730bff0d", "value": "c7cc9a5fc18197fac5eb1ce360dc0e53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479160, "uuid": "bf11cec2-8149-4143-9509-aa12821a1665", "value": "49152:DsTbhTMtf4oGB7apQAlG8eqBcZERE7mUMZ/uSPbvxcV3+iakJ0u/SFzMXQJcqKgy:Dswf6ouebv6FIEMMU4XZMbMtoJAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479160, "uuid": "da68ac6c-06ed-4d91-9074-6e88f470efe3", "value": 4132352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479160, "uuid": "6078dfd2-ab2d-42fe-b321-e433063596b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479160, "uuid": "2459aa40-31cc-40d2-841d-dc33d7ec7ec6", "value": "b1b42a53800427415c6ac7d386574c04fbee740b1993150103b55f68d8ebb625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf1c882-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478928, "uuid": "43d531d6-5769-432e-b3fc-e677c8fdaccd", "comment": "Malware payload (RustyStealer)", "value": "f22525696e2cda866516145e63a625dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478928, "uuid": "26d28446-ff54-48ec-89a1-2392c01bef57", "comment": "Malware payload (RustyStealer)", "value": "b1db4568ac046cca55619fc4f488a3f9c3b8b8071e0d5dc74530923750b9bf7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478928, "uuid": "746fe70c-aba9-4429-bc9b-3e4f28cf482d", "comment": "Malware payload (RustyStealer)", "value": "b41892263642df6f4dae10d8116d7e8da39ddeb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478928, "uuid": "394dd57f-ba96-4b04-8c9f-a3ce31e7e0b2", "comment": "Malware payload (RustyStealer)", "value": "2c1f21dcc1839a85f786ea5ee3529b92440a8fe6ee7e9dbd0e5d1ba9231b36e4d3fc98533a79874d72b39f70c2bbd762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478928, "uuid": "27d5aea5-83e0-4a3f-8a28-4468852108cf", "value": "T19E167D03FA9581E9C49EC079C71B9233EB72F88D1624B69B1BD44A213F57B605F5E388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478928, "uuid": "9b7d27d9-9c71-42e3-93a3-fb292403eec3", "value": "246058360039e7c35c50b7abd74372ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478928, "uuid": "be52dccd-3f05-4f4e-9b7c-ecfc508cc669", "value": "49152:tp/YrYaDafhjFrp3o1htPn5/pFJUaIfWIXaZe1ogsLkqLn0QcsAKCcs5Ja8m9owQ:t5Saffa5Jr9gaZwoeUyab986Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478928, "uuid": "542f20ed-f669-4541-90d8-4322f7f54f05", "value": 4217344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478928, "uuid": "688f88e1-371b-4189-b4b4-cf6477a1836b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478928, "uuid": "87a4f80d-09f2-4b3c-96c9-ee35204cc8d4", "value": "b1db4568ac046cca55619fc4f488a3f9c3b8b8071e0d5dc74530923750b9bf7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569950b2-70fc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782436451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782436451, "uuid": "04c0879b-7f2d-4e57-ae91-d576ae902c7b", "comment": "Malware payload (Mirai)", "value": "59b7d548d116489199143133b3e00779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782436451, "uuid": "0b75d1a1-447c-4d3a-912c-8164837c713b", "comment": "Malware payload (Mirai)", "value": "b1f0308d07368bdd9d389f0b4ab9627dd22f059021c1b3b1949357afe23cac8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782436451, "uuid": "72e4de3d-3c50-45e5-b493-266e8d4954e0", "comment": "Malware payload (Mirai)", "value": "6ecb50f0fe9fa8b3b324eae381c5a40c50914f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782436451, "uuid": "d10dbadc-b8ef-4178-a617-5871bf1551c3", "comment": "Malware payload (Mirai)", "value": "9e1fe99ae1f9c6f1df912b2327f169b256210c1e863c233d26380fe5d13336beafff12fcaba474d3a92127e5c8fd3fc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782436451, "uuid": "06d85af8-b26c-4045-aff7-5ef7caba6a46", "value": "T1D2A3390BBC82DA12E5D662B9FD1E508D331307B8D2DB72038D149B797BC796B0E7A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782436451, "uuid": "6dd74813-e62e-46fd-8ce3-ac4874eadf92", "value": "1536:8enuCVu1plWOLvrq+w35RW6rnV3UQaaeggAtDgiJ+MYV4sD45pYMFy:Zyl1upRW6Z3UVa1p+MYV4sD4Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782436451, "uuid": "ce42cdf6-1c90-41ca-b0b1-ec1abbb86536", "value": 104356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782436451, "uuid": "08a8915f-247b-41f7-8bc4-45d9d710f01e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782436451, "uuid": "ef504412-9b87-479c-8be4-5d6076f17df1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458b7d7a-71a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782508578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508578, "uuid": "c6dfbd46-b46a-4dba-a5e0-bafbc7f811c9", "comment": "Malware payload", "value": "4383e880ce10d524e1edad8f058d23bc", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508578, "uuid": "a27bb10c-04ca-4fd3-80d9-7c3daeb0968b", "comment": "Malware payload", "value": "b48ff07c855be9ab7b513c70dadfb4d0380f78477ade7b5e424933bc82cf9664", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508578, "uuid": "13ee6bfb-3871-447a-99b5-c77ffed395e3", "comment": "Malware payload", "value": "52f34fdc10af481b6eb396971fe52ef57bf58d78", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508578, "uuid": "d219ac2c-0c26-4f52-8e1b-8e894720da3a", "comment": "Malware payload", "value": "dc03624cb403f05d1442e55827ee434b47553dc873fb54f3c4a6f2e9e9e548609e84dffce3a687be446ab93b07e3088a", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508578, "uuid": "ce2b42d9-1c51-4722-b681-a14d8729f5d8", "value": "T14DF58C0BBCE108FAC0D9A23189B6425A7B74BC490F3623D72E90B7782E767D05C76B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508578, "uuid": "4a0b73c3-0469-4144-bd27-417c4d15f146", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508578, "uuid": "ff56295b-50e9-44e1-a9c1-d56619596d67", "value": "49152:ZXyyE+U4UMjNXphiypDYkjmehiYvW8eJAissBt1L9pvLYePNaPT6tF:ZQHylDi1Rqis2tBL0m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782508578, "uuid": "ac3bbfa0-5b2b-4133-942e-0ccbdd5dc73d", "value": 3584392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782508578, "uuid": "1d1b3b56-3545-4391-90a0-f0e4a891a18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508578, "uuid": "b49dab60-7826-4881-a9db-da4c2c9a4d6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96f2514-7145-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782467943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467943, "uuid": "35751bb6-0058-4e42-9291-49360fe1ae67", "comment": "Malware payload", "value": "703dd581d87b5bd4efe0318da0eed442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467943, "uuid": "25aa8b9a-f8dc-4203-bdbe-e1de06cfdf3c", "comment": "Malware payload", "value": "b4f9bde5402e27294b53a617b685cd05db430d9b1674017623469bf6fc6b7a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467943, "uuid": "380969fe-2086-492e-a6eb-50faf62fa747", "comment": "Malware payload", "value": "22662f3c92c1fed229eee9679e4a13cd15020865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782467943, "uuid": "80992137-4b8e-4733-a12a-2092fa22ffdc", "comment": "Malware payload", "value": "b76432d248a9411b9791259b20a3eaec244adcb79e3b2d8f497f0b4db86af21e0cb213351cd433bb488a31d4fb02757d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467943, "uuid": "674eb9f7-556b-4c46-95f1-365b79deaead", "value": "T1D1F733292836D6EBC1E934F71664EDB6C34DC0437220617C39364698629CE83E5DE9FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467943, "uuid": "bbda03fe-58aa-4a7b-85a8-453506d4cfcf", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467943, "uuid": "31521916-dcb1-49d2-ac3f-8b69d5e7e1ea", "value": "1572864:et9IKPDOJJMRWYfYeR31cLpb4YbfqXxODpCL2cj7:eUKbOHMRWEr3Up0CfyOBcj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782467943, "uuid": "1f618fdf-b5fd-4654-b93c-4d320e31f048", "value": 77015178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782467943, "uuid": "8f03b997-e75b-415e-9b52-06d4042d9573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782467943, "uuid": "273d12fc-075e-4c1c-8014-7ea9267fbc99", "value": "Oni_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf3212b-710b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443062, "uuid": "2bc37f02-c996-4ffc-9fc4-1e92008138d7", "comment": "Malware payload", "value": "49610649506fe33b85fc16c8f3455a4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443062, "uuid": "e4c4802a-3193-465f-9c9f-e77ce2598704", "comment": "Malware payload", "value": "b604c2c1f3ac76338d5885e33d6ce1b5dd126cabf93278fb12ddfbcb20cf1b3b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443062, "uuid": "ea5c5957-7140-4d18-9ce2-8c8e3ffd55e6", "comment": "Malware payload", "value": "96caf6fd9ca376ed8e58d79cff4515fa152de18a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443062, "uuid": "a231be59-809b-432d-95ed-c1c28df83ee3", "comment": "Malware payload", "value": "99d3427bcead67c794ffc15e46e8c60424438dbae0674b7dc54473857b0c1c82fbb7a7873246dad124940d4d57b07f0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443062, "uuid": "ba96079e-cdf0-4dcc-a2db-5572a8fd770a", "value": "T12233AF2912454FE6CB33BB92546020C0A3695CFF2B9056BFD71595B029A0F3BE5AC1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443062, "uuid": "28c1d8b0-0ce9-4bb9-afde-8c5a55838664", "value": "1536:smDAQjzPfJqata20V1l5KWw/NZHhDKpBJL0v0D3jaiuHGwusM7n:skA+ZiKtnhDK508j7um0MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443062, "uuid": "e8526132-a6e4-4d7c-aae5-a80851bcc29c", "value": 52926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443062, "uuid": "5b4dc6ca-2700-482f-84e2-d4f2a5c744c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443062, "uuid": "342cf36e-05c2-4ee9-89e0-1b18e2bac2ce", "value": "ocafa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e811893b-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478785, "uuid": "61cbf4cc-cdc7-436b-901f-eecf0260e905", "comment": "Malware payload (RustyStealer)", "value": "98df75fde3c6ce76573002cba98f8279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478785, "uuid": "7fd36963-b8a9-433e-b3f7-806080863a14", "comment": "Malware payload (RustyStealer)", "value": "b6acdce1f0bf857ab01659840e683c2b9c0a6d92d40ce20f6853123e2a08b8ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478785, "uuid": "edafcdc3-b705-4767-9d9b-23adf22212ff", "comment": "Malware payload (RustyStealer)", "value": "be456fe6ab331084ed9e22e935b8b10bbc086dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478785, "uuid": "f021d1b8-528c-48e0-9500-ec4b398c6ef4", "comment": "Malware payload (RustyStealer)", "value": "ec8408f9a4c8145759a013d1d71e025c7573de03a65b3277e39152289ab1c34b78cca6355c0f7cb7a54574723f8ff0f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478785, "uuid": "e89ed736-0e2e-4456-823e-1f8ff8a3bd11", "value": "T17F167C03F6A581E9D0AEC038C71A9233EB72F88D5621B7AB67D44B212F53B606F5D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478785, "uuid": "2a3f1ac4-840a-44fa-b46c-b6008f5cf180", "value": "1b6a7ea171c460dd7f82e9d3af017a67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478785, "uuid": "51bdd28f-9fb0-4484-a7da-7a7a445e41a7", "value": "49152:DlTmyiLHV2VIaKNOgiwf/hVL5cT29bqmKt0N9wg9FiOKa4QpC44/YgL+cskXx/k1:DFu26BV7DN9wkFF6ekB/k1qK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478785, "uuid": "eafd63c8-8105-4ba1-a5c3-af75a75504d8", "value": 4307456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478785, "uuid": "9c2feee1-ca6d-4a7b-b083-002173fd8e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478785, "uuid": "b704d00b-1fbc-4924-a0fd-e743a6fa3e57", "value": "b6acdce1f0bf857ab01659840e683c2b9c0a6d92d40ce20f6853123e2a08b8ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3e61af-716d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782485102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485102, "uuid": "73714a66-2581-4936-be9b-601b966aed71", "comment": "Malware payload (Prometei)", "value": "0cb17cb0160028d94a9d4ccec6f20902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485102, "uuid": "546e1097-74a2-4cf8-aea7-44c30225e986", "comment": "Malware payload (Prometei)", "value": "b6e528faacf10c8d9b64acb9ae50d17abc0420f5140ec61630dbc031045aeb2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485102, "uuid": "7e6d77dd-dc7d-496a-baea-aef35e40be70", "comment": "Malware payload (Prometei)", "value": "163977e4ad3933ff74dc8ab76f41fb55ee68c365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485102, "uuid": "525de0b8-1dea-4a52-b71f-bfc0dc853c6e", "comment": "Malware payload (Prometei)", "value": "af85345a298807085b9ed6c8d9e83bf5972ac3d27dd6b15e18179031febec262f9f9234173544a4aedc189002ebc09ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485102, "uuid": "c7d1d7a0-53fb-4dea-b804-88440f35b7e1", "value": "T17EA423B4F9219E8F6DD76DB91B24831DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485102, "uuid": "8611a79f-5200-438e-9f73-1de293b86a29", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdX:Fs6pyCC/Ya2hpi6T6N4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782485102, "uuid": "2a8d4552-704b-4ce3-b3a5-7d3a6d6e00d4", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782485102, "uuid": "85bb2df0-e839-4ea4-bdc4-76f2496e8653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485102, "uuid": "39f60fb9-2835-4269-88aa-7b9b8bec76ef", "value": "b6e528faacf10c8d9b64acb9ae50d17abc0420f5140ec61630dbc031045aeb2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed26f4b9-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453024, "uuid": "0857ee61-260c-443f-975d-74f3acf63533", "comment": "Malware payload (Mirai)", "value": "c4b0ae93b63bbf950edd4d50f830dd5f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453024, "uuid": "8c34c8da-b8cc-4690-b8df-a4f05f9ea6c2", "comment": "Malware payload (Mirai)", "value": "b7b48a5e5344e8a21831604887456589d7418b0fefbc7cac9b0ed2e86e7c7d91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453024, "uuid": "4e2d60ad-e62a-4a54-b523-2ac1d966a945", "comment": "Malware payload (Mirai)", "value": "df882d962cd76b7bdd9beff586e7c26c99159b5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453024, "uuid": "e4789e1f-e155-4aae-a107-f7701ad515f9", "comment": "Malware payload (Mirai)", "value": "2a081119ab6e0d631613b1dcecc97a1ff0ed51a7b4d2e8eac819c4882470e9826abd4a5f98d94a4efa750ad7f7a06fbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453024, "uuid": "10b0b81f-4f5f-4eec-834b-d7947ad0f0a3", "value": "T1A36308C29902EDB3CC2261B81AA78B65C935F97338316C47F3EA3AB1E4556C1D94339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453024, "uuid": "d95cf534-fa21-4f1c-913f-54658045ef8c", "value": "1536:aXSr5K5XpvKaLSiDEdzA5Un63BaTzgI+8AWmlQcmPGisl4dywSXk:iS0XpCaLdMs5m4aQ5lQcm+HWywk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453024, "uuid": "8b02aabb-5dfe-413b-a8dd-2726041725cb", "value": 69804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453024, "uuid": "1481cbdc-2757-4320-8218-e37ace56309b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453024, "uuid": "021904fc-52c4-478a-9fc4-b79265c02e48", "value": "MMaaRRiiOisecTanee.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59efc621-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478976, "uuid": "c3308590-73d9-424e-b398-17caa8e58607", "comment": "Malware payload (RustyStealer)", "value": "0bd221b54d468936dbabb9fbcae5dbe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478976, "uuid": "ae085a45-0348-4384-ab0f-496d97a04491", "comment": "Malware payload (RustyStealer)", "value": "b8117b16485f80a23007d8c527f7ee3204a3b5c7623e7c782dbda03899318916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478976, "uuid": "13953abb-0fe8-4b68-8660-1295e60b3496", "comment": "Malware payload (RustyStealer)", "value": "31460a02e4fbab7cfb582600b5a5dff1e7e7cf2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478976, "uuid": "b71b4f32-60bf-4695-929b-1b3a01008c4c", "comment": "Malware payload (RustyStealer)", "value": "2abc4123b8779f4bfb026ffe54c68523df6b0c1a04ee8806c82f77b6eb5a21aef7e86b666cb995e53af0fcf3f39fd75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478976, "uuid": "60ccc2f9-6d72-499d-aff2-e05fb5b1f0a7", "value": "T19B166C43F69581E9E09EC1B8C71A5227FBF2B88D2620B6DF1794CB652F17B601B5E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478976, "uuid": "fd42a330-b714-4e35-9ab5-59103efef7c7", "value": "49152:ByJKyE2lX+f2WNtuD5Fsgg22Ni6F1UrwYLv1ogsLkqy5ehYcPNbpPu3ZvQ6pZD0:Bzy9na2gzO8YLtow2Q31QqD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478976, "uuid": "5d930f9f-ec16-4234-b589-920f8447a6db", "value": 4255232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478976, "uuid": "15f97bf0-d42e-46c4-ac21-bbc005a25d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478976, "uuid": "54ea6341-882d-4db0-87c2-7c37049272e9", "value": "b8117b16485f80a23007d8c527f7ee3204a3b5c7623e7c782dbda03899318916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa48c6b-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478843, "uuid": "c3f6db40-c75f-4f6e-895e-01bbadc05c8e", "comment": "Malware payload (RustyStealer)", "value": "38261bfbfa59d9af40a0686529dc2262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478843, "uuid": "fdfc30da-30e5-44fa-80dc-6da0ffe28715", "comment": "Malware payload (RustyStealer)", "value": "b9a711023cde48ebef1937edd6dfad98382fffca3cd538691a3933921f987d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478843, "uuid": "8b78768e-7d5a-41da-b15e-7867deec78d7", "comment": "Malware payload (RustyStealer)", "value": "f7892b8553a93de8679228ecf1ca6f0de7855b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478843, "uuid": "003e19a5-f57b-4cf8-a56b-bf098ede21bd", "comment": "Malware payload (RustyStealer)", "value": "a65c9a13b107e5d0d96b7b183e6525839afeb2067ee67d3ccfd79c626d166c3a2a54852eb28063e11c75aba17b0c955d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478843, "uuid": "5d5230dc-dd1f-47db-85fa-3586144306f2", "value": "T12C166D83F69541E9E45EC138C71A5233EBF2B88E1E21B79B1794CB612F5BB601B5E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478843, "uuid": "891ca8aa-d8e4-4490-a3d8-6e6726d1f047", "value": "f72749ecba7fab6de7b94e1f834f30d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478843, "uuid": "ac679546-b112-4d7f-b020-8ad88002b355", "value": "49152:2ae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uhqN2tnF+qozPs:2rcb6qUgJIfQqoKX15uqEF+qozPbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478843, "uuid": "248d2f66-fe0c-4524-b0ae-9b469debec85", "value": 4258344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478843, "uuid": "c008a1d7-e64d-43b4-bf83-304583b1e489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478843, "uuid": "fad09e32-1342-41e7-b5e9-32697f8e27f1", "value": "b9a711023cde48ebef1937edd6dfad98382fffca3cd538691a3933921f987d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0193c6e7-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782486130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486130, "uuid": "cbb41aa3-9e34-4c9e-ac2a-4d521e1f6393", "comment": "Malware payload", "value": "b5d8c31cf8eccba98632038764748b2b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486130, "uuid": "aa09423c-4230-459f-b45c-81859346607c", "comment": "Malware payload", "value": "ba182b9cc66dad0d74c298e31efb3447eee7da0f5f18b91f5d31bde59cd284a1", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486130, "uuid": "de40df20-31a5-43dd-a067-bed0c616b6c2", "comment": "Malware payload", "value": "5384df075d835ead40e712a7261f271778fd3309", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486130, "uuid": "195abca2-145c-4a74-b2a9-02e7cf6aa0ce", "comment": "Malware payload", "value": "259dbde55e7100e5224aa30deee391218b011f20d8c2895e2b9cdd80b3d9be936deed7d0a8dc77bb05f321cdb1a1dd30", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "jenniferloeffler-com", "colour": "#D884F4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486130, "uuid": "a443f249-f979-4a7e-ada7-16bfbdcfd27d", "value": "T128E5338EC8FF685DF97B1810C5C429C1D3674072ADC396DA5AE10BD2E4D3682DB2A94F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486130, "uuid": "f2c18a95-82b0-4e8e-ae68-62a0e7faac05", "value": "98304:hO3vV//VHI5DT68HJs/iYaIDqhXrg18sb7bEU8oDZzO:hO3vEm8HCfm72lb7bEtezO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486130, "uuid": "84e4aeaa-f097-43d3-9721-0910e2467e64", "value": 3171746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486130, "uuid": "ccb32155-8698-4184-b3a2-5154b9f59bcf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486130, "uuid": "3d8bec24-c814-4dfc-8d0e-03aeb5342fa0", "value": "jenniferloeffler.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead920e1-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478790, "uuid": "acc32dae-244c-467a-8b60-0664a7874e45", "comment": "Malware payload (RustyStealer)", "value": "c524874b75254cb431a7d9ef4980018c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478790, "uuid": "0499e852-68a9-410b-9df6-7d0562a96e11", "comment": "Malware payload (RustyStealer)", "value": "ba394c1dc1c059a38ee415ef860286b425af60cc76fc74c768c6fa146cb6cc94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478790, "uuid": "55d51539-7366-438f-b75e-2a1bcd8ec199", "comment": "Malware payload (RustyStealer)", "value": "acb9d85117fe4483d99e089c272a00ff846f0895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478790, "uuid": "26fea1a2-b109-4e08-940b-5dd24299c7c2", "comment": "Malware payload (RustyStealer)", "value": "c959687f2263501801039c472617b7579bad6b66c8a2a6ec61cde144f42f90dd8bc21ac60faee7950153d66c834c7099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478790, "uuid": "c8fa63cb-4162-42f6-ad86-290fd08020a7", "value": "T11A167C43F6A541E9F06AC038E7169233EBF2B88D4660B69B56D4CB613F53BE01B9D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478790, "uuid": "be59cf84-3fd0-4c62-a79f-294dc78a646d", "value": "49152:lZp7cq0qjiy70iwC9sO8TE5GfS+4VPoe75+D+bqOUC/dwKnWeEL/UA112lx7z73e:lZp4q08IlgH5LjUC/mKbFN3ma3gUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478790, "uuid": "f9dbd5b6-d810-4ec3-8289-d74eb27934ae", "value": 4365312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478790, "uuid": "e1496312-8fcd-4a84-b6f1-75c6bf7bdaa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478790, "uuid": "f31e14b6-33fc-4725-b736-e8f2a569061c", "value": "ba394c1dc1c059a38ee415ef860286b425af60cc76fc74c768c6fa146cb6cc94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1878112-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782486425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486425, "uuid": "07e11e40-39df-4540-9534-57f913602006", "comment": "Malware payload (Mirai)", "value": "1962f2e0047814fef9c68c8ec8ab77b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486425, "uuid": "a80b07d2-6268-4648-b60f-c388564cd937", "comment": "Malware payload (Mirai)", "value": "bab90c6e5d3cb39b3d324bda17f24928a0c366780528d1d30b143aa30eb7601e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486425, "uuid": "3b9c86b2-847b-4dd6-b6ca-d8c7f880b60b", "comment": "Malware payload (Mirai)", "value": "3da78444c256a4daa347aa94b9aa003eb68d18e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486425, "uuid": "979114ef-5ee0-44c8-9a27-91915cdaf86c", "comment": "Malware payload (Mirai)", "value": "9dda694050f003612bd4fc5561b20158f426d147353de984aac2a6e4b4a7761e2f5d709b54677e0aee51e6ff60f316a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486425, "uuid": "03903400-44f1-448f-89ba-f323666f071a", "value": "T161C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486425, "uuid": "436f12f3-670c-4851-ae61-7b775d5ed1b0", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JM2N:MwCvdHmezn0nUPMu9KryXsM2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486425, "uuid": "ea39d742-a747-46dc-a7d1-60475d03755d", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486425, "uuid": "50af56d2-fab5-4128-b023-51acdd0f64f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486425, "uuid": "90fc56aa-9ca4-4b1b-81fc-cc01805ccd34", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1413361-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782458534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458534, "uuid": "7c5bf9a1-cb05-4de7-9f3a-84fbedbd7067", "comment": "Malware payload (ValleyRAT)", "value": "f83363744ed74c747388a2a905d3e280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458534, "uuid": "131c4fce-ba4c-43e5-9372-916be5530211", "comment": "Malware payload (ValleyRAT)", "value": "bb1cb60ff6eeb6009668354fe7af609a5495d1aa8998582f8e819dedce833930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458534, "uuid": "a3807969-579b-4227-838e-bf9e25ae4fb5", "comment": "Malware payload (ValleyRAT)", "value": "e2327867eba4b882fca948a92a2dc2faf57a06ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458534, "uuid": "d877915c-657a-470c-9da3-038d34068375", "comment": "Malware payload (ValleyRAT)", "value": "49ae1e7fbb61118e0a90112ae187b34976de245c0b657fb9ab659401fc67af43048472c4bc3a9c54773cbfbebbf2fd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458534, "uuid": "33c73735-da8a-482b-825e-27cdd08fcd1d", "value": "T1CF862315A650C9E4F7D6FBB44A16A5F0D3763C661A32EADF01B032261F732D3CA36621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458534, "uuid": "db7c896f-f96b-4111-a0c8-242e5db6b847", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458534, "uuid": "878c0142-9e3f-4e7b-878c-e909e05f453b", "value": "196608:I3G2pSwmJ3ZHQrT78AGYOjtSXKXxI4TC2:UwZZHQj8zPliEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458534, "uuid": "bd7b2f8d-f55b-4ec3-bdcf-5fa961fe020d", "value": 8051503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458534, "uuid": "932c526e-d350-4e6b-9368-39e799b39c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458534, "uuid": "de1ba806-83a8-4c06-bdf8-b769fa891cb6", "value": "dingtalk_downloader_v8.0.121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5b569b-7156-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782475360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475360, "uuid": "4962632b-bc4d-4bcc-8b3b-1162a405e931", "comment": "Malware payload", "value": "57d67fd5e3465a3b0f6ae5b0b97caefc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475360, "uuid": "d1c15c4b-9f34-40e5-9819-b38229d44aed", "comment": "Malware payload", "value": "bc3d82c6ea17a5198d600bab8f602bd020b94c7d00318d3c241a7b103535d6de", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475360, "uuid": "03324187-abca-4817-b546-87c000835ced", "comment": "Malware payload", "value": "b2a3fc565648c6bd621b0a287a1a46c450c503b3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782475360, "uuid": "a0e876b5-5594-405b-8e64-bde34f5f77da", "comment": "Malware payload", "value": "52ae73de763a994272d0850162825d1171f2eab1130884d2830e381f001aaebdaae1bec061f1f619428c56f3d21e8cda", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782475360, "uuid": "5a1f7332-9d93-4b89-80f3-e073ea796ff3", "value": "T1A373224FDB06C703C2B74751BB67C8B755E109CD266E20155C3F4999CBABBB48B14D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782475360, "uuid": "b9ef5fa4-6e9a-4db3-993a-b5076320e832", "value": "384:aGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGK:ah6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782475360, "uuid": "a478a3d5-28a9-455e-967b-f8f2d8af4644", "value": 75682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782475360, "uuid": "1a352c9b-2c5c-49d1-b3d7-3868706711e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782475360, "uuid": "1da7fcc9-2ccf-4331-ab5a-03dabb540cbb", "value": "PL18-06-2026L4857.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2375e0-7165-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782481453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481453, "uuid": "10b08a37-62d6-448c-9ad0-005c12c8591a", "comment": "Malware payload", "value": "d428788a43978411bd9bf8e4fb0bbe83", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481453, "uuid": "3413d079-9105-4943-9bb3-cc6090cbac6d", "comment": "Malware payload", "value": "bc502fd4afdb3939206d11d11b47c8831af9ab572e272d35393c4b31f7304b62", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481453, "uuid": "e4c5d828-94f8-47f0-aa2b-1dc103475fae", "comment": "Malware payload", "value": "8e013d443a45189397d5bdfca644b0cdfdc4920f", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481453, "uuid": "629c63f9-b83f-43cd-905f-24871d479465", "comment": "Malware payload", "value": "46a8a3821654e944f6909768024ad437d3a2c7790d63336b45389711603240eb02931b6587bbcd6ccde329701822b968", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481453, "uuid": "7afd17d8-9f12-4b9b-a669-d122f37c5864", "value": "T157E6E0BE27CB1DC3C33CF4BD9B49F7B4B85F60A14225D45A559D01F8082AC6A9DA4A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481453, "uuid": "d3840c71-6114-440b-9010-cc30482a5219", "value": "6c871eb5afcc648e749d578ab8277277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481453, "uuid": "cae1253f-7820-4f9d-be89-b90b2c6da292", "value": "196608:5Jw/noZ60ZCg312P7Di1SIGXVuGgJuU2APuMtfAo5saQobv:5un2wg312yJOYGgUvAPF9xm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782481453, "uuid": "8b03f207-1c96-4c13-b811-c024f1435800", "value": 14412800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782481453, "uuid": "6c151523-ff99-4bc2-afd5-8bababbeee27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481453, "uuid": "d5bb61fc-50ba-49cd-a253-1b2e76a48315", "value": "pf.ch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757cf8b7-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479023, "uuid": "2c142663-0b24-404e-b086-c3c79b9d2aab", "comment": "Malware payload (RustyStealer)", "value": "2044f4c2d285ecd05327e826d669a1ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479023, "uuid": "25f6ab83-a7f1-4a36-9480-554668c537e7", "comment": "Malware payload (RustyStealer)", "value": "bc6e19c760e652670a81ea3d099305d171111a6c9a910792b57f2aaaf36105c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479023, "uuid": "8099e7b9-1503-4d94-8fb8-427904b75c6c", "comment": "Malware payload (RustyStealer)", "value": "42bc7d0aab96389f1aacb1e49958b55cc775c7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479023, "uuid": "ef81e66e-a3e0-4f3d-9e74-09b7acd3a5d6", "comment": "Malware payload (RustyStealer)", "value": "186661bf872bd3c6071d5bf3d6949e1563597a740b9ae7c6c501e45cd3fca29bad7c1e8cf6d4a3b4ef12c4eaf05129cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479023, "uuid": "ef9a707c-1615-4336-9a11-d1b4d257754f", "value": "T17E167D43F79582F9E49EC138C7269233EBF2B88D1621B69B1794CB61AF53B601B5D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479023, "uuid": "b13a0c1d-1109-492f-bd4f-0122ddbce226", "value": "49152:5PXEY1idIUSQzrgA+5VOYa8E7jh5lv11ogsLkq3KiUGD4rOTxADBFs1bR480F:5/H1igBlax3Hlv/ogMCDPs/48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479023, "uuid": "7171a85c-f623-43fb-b285-40419df142af", "value": 4221440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479023, "uuid": "f37557fe-106d-491d-8edb-077eaee5ce77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479023, "uuid": "4c406b97-9361-49eb-a5e2-e8f6971233f8", "value": "bc6e19c760e652670a81ea3d099305d171111a6c9a910792b57f2aaaf36105c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ace2b6-7161-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782479741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479741, "uuid": "2cd385c1-1413-4ecf-a60f-01e0f759390c", "comment": "Malware payload (WannaCry)", "value": "6776873bba10f9f247ef5f63cd0bd8ad", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479741, "uuid": "35ce8268-6823-493c-8f94-ad4e5011e5b8", "comment": "Malware payload (WannaCry)", "value": "bcb9b1d06d7e39ea21a7cdcae0f96c5ae4191565f2b1f6f72959e078cf3d2373", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479741, "uuid": "4ece9d03-ce9e-4d03-8fd5-c7defb5ca292", "comment": "Malware payload (WannaCry)", "value": "ae549f86d58e56deb5408327745113e2728300dd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479741, "uuid": "251ec803-468a-4142-9901-88dc8734d0d0", "comment": "Malware payload (WannaCry)", "value": "c05bdaaec70f0a136b32588770992f6b4550f401445348f0076b6cd86ac0d3b665f6c55627ad400183b99ff46c5e4b74", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479741, "uuid": "e63062c0-ca5d-4b93-9d11-b075aec17b60", "value": "T1A73633582268D6BCE006197444B3CE2AE7733C5157BF5A0F87504DAB3E13B9BBB90B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479741, "uuid": "4f5b8779-f1bb-4cc0-afb8-b379acdd5e74", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479741, "uuid": "2a13ab36-b16f-4a38-9324-981da8f6c5d8", "value": "98304:DGDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:DGDqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479741, "uuid": "0815665b-6b6d-4b58-9d1e-b0ccbfd7a492", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479741, "uuid": "d0b8f642-bd3a-4b56-b9c4-149457799cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479741, "uuid": "ebf81b95-2d8e-428e-b47e-af15946d618b", "value": "bcb9b1d06d7e39ea21a7cdcae0f96c5ae4191565f2b1f6f72959e078cf3d2373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87971754-71a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782510836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510836, "uuid": "e8a8b366-883b-4dc5-9319-cff146fd0c31", "comment": "Malware payload", "value": "dd10dad714d3276dc8bb6237152ee9cf", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510836, "uuid": "7f32c497-0cf3-48e6-ab4f-d8cd810b7d8b", "comment": "Malware payload", "value": "be31cb864127a72378b5eb989a68f4ef52b2f09430170fd1d4d090f272d2235e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510836, "uuid": "d98ff9e0-7be3-461f-b2c2-4beb2f1ce63d", "comment": "Malware payload", "value": "ed96ae506eb4cdb1f919c68b0af2da83c214d60c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510836, "uuid": "cee3d421-a6b5-465d-8232-acfc1f2f6492", "comment": "Malware payload", "value": "ad4f0158a1b25370bc375ab29cbe1d7be24348bb7afac55a0918f23f401498a8f3b80f665f62ce458b9f27792c053c30", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510836, "uuid": "e3fbbaef-2fb5-46d0-8d6d-4c28a4174016", "value": "T122F58C07BCE158E9C0AAA33188B651AA7B75BC490F3127D72E90B7782F727D05D36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510836, "uuid": "3fe3d6e5-0f11-48ae-88fb-bdc70105a9e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510836, "uuid": "199a7966-ab5d-49bd-b947-8292b3a8a195", "value": "49152:C8H4Duxz/ahCWND8TjrA/n+OfjOdJ5HREzKHf3tvsW0eX3tvns83QYhRbq5J2BV:CB4A/dOlHRbHf9BlnP3Qrs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782510836, "uuid": "9247f994-48b0-4a73-a65b-c32ed074d1cc", "value": 3582336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782510836, "uuid": "760c70f9-d89b-46c9-8557-bdabc2bad76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510836, "uuid": "171c7578-218c-4aa2-949e-324cb2bac6ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8f8d0b-71a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782508212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508212, "uuid": "d6abd453-ede6-4934-a369-39029ac7ca3e", "comment": "Malware payload", "value": "871252e0dc4ef2ac5167a5577013ee74", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508212, "uuid": "92871d94-aecf-406d-94e7-c78f3fd9e0a2", "comment": "Malware payload", "value": "c097558130cf957989c38f44e1a542412c4964d380fdba85197d83d5a83a8c56", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508212, "uuid": "d93a6949-f70c-4a4d-95d1-8207bfdcf0a6", "comment": "Malware payload", "value": "10356375b28da7e6bd64f21e13bda2b540a94f1a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782508212, "uuid": "d3c161aa-1223-4ddd-b249-65ce944b6532", "comment": "Malware payload", "value": "1cb51c47cdee79dff5b4a05597151ca8b87a68879c876c428af829cfe1c199de875e4de355ccbebff3f884f63d03e147", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508212, "uuid": "7ddb2483-53f5-4451-aa7c-a5a0c3dd64d9", "value": "T19DF58C46BDE148E5C09AD23188B651AA7BB4BC090F3627D72E90BB783F763D05D36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508212, "uuid": "0e0cb731-4a4e-4a79-8db7-8bbac16ec1be", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508212, "uuid": "cad49615-95cd-4446-8d22-d2a211d52cb2", "value": "49152:2Zjcu3+X+qHG6SJVDlmv9GQXHdP4Ggl3DrzXydmFxiAU4guvmwKUIv0FbuUhwYci:2RU88v6DRR5u1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782508212, "uuid": "9b83cb04-4717-4f02-aaa2-b0adefe3e697", "value": 3585936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782508212, "uuid": "d1e7d4d4-bd1e-449f-a3c6-706b65ff7891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782508212, "uuid": "59881068-3f79-4d7e-8f5c-c554dc078439", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaedde9-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "99a6806f-e991-4736-8d72-baf563ad05ef", "comment": "Malware payload (Mirai)", "value": "99a8f6852131e68f1cbd97a46669e444", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "cdf5e716-dd73-493b-8d8d-4cc57cd91693", "comment": "Malware payload (Mirai)", "value": "c19bb1d093619d27c88113a5e8eb79cdb28dbc7cdabe394b47c4e3e6d24f9954", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "27cf6c60-3e80-4cb5-ab84-e57cc5094851", "comment": "Malware payload (Mirai)", "value": "fde28ab87e1bb4243ccd5b68b920ede4d487fa78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "ec4667f5-7940-484f-a40b-f49ffa1f657e", "comment": "Malware payload (Mirai)", "value": "ac57f63d3f1667ba156a50edebc8a01dd737fc2b6efd5a5d565ae86e0611cbdb1891a371551d9fc1b9d711db21c64687", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453023, "uuid": "fa5544be-5804-44fd-bcfc-86f1aac5c00d", "value": "T14A6319C2A942EE77DD2220B84AA38B659D36E53338316D43F7B53E61F891AC1D90375C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453023, "uuid": "02b92b42-94b9-4122-b3fd-b444a2b8fc53", "value": "1536:RlMhYSMDQqP/gx0Mt3OGUXMWeC+vJc9xPz9fEYCBBDE+sO1kGLcqXB6N:RmWmhc9Jz9S4O5wqXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453023, "uuid": "27efdff3-b212-4e49-b04c-d1094943afa4", "value": 69644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453023, "uuid": "43c6f8c9-6155-4e25-8fae-913066045833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453023, "uuid": "4278fe58-4ebc-400d-ad57-6b3613b16612", "value": "MMaaRRiiOisecTanee.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6bc119-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "01173748-4bf1-42cc-87b1-495dfa4a47ea", "comment": "Malware payload (Mirai)", "value": "21d0e4b8fde9088af20a7217d3db701d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "8bdd0f56-8d28-4103-bf37-fb015c187029", "comment": "Malware payload (Mirai)", "value": "c206b9d109dd50c5e641ff5035b4d2a24b02ffae8d5adca02ba58883e9726262", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "0272ca8c-dffd-4d13-8319-031f52e6e186", "comment": "Malware payload (Mirai)", "value": "389574eef835d115f83dddfb44f3985d5dbedb99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "da860bfc-9c13-459e-9eba-89b3bc878f21", "comment": "Malware payload (Mirai)", "value": "691fd1ade12635af32a30c8ac76f37d7875757eeb8845cb4551c796e61b670722d8f9b873e7f1b4724b4a933e6245031", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "a7be764e-a68a-4854-94b8-679a5c1500f0", "value": "T19D336B65E8295D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC271144FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "ebc6af3e-eaeb-422c-ab5e-eb7c6492ac2e", "value": "1536:3a+BiFCYXjD2/FuhFsKbwBx/aURAYEYCF:3pioYXOt42KyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451899, "uuid": "446198ce-2060-4e01-9993-2eb750353dc1", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451899, "uuid": "6482d53b-e924-403a-8703-748ce6271c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "45e9c53c-2708-40fc-8a1d-303e7da9a8cc", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a2fd44-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479075, "uuid": "b829d110-20b2-4721-b14a-2612d27ee8c4", "comment": "Malware payload (RustyStealer)", "value": "419eddfb2f3808f2de24083e3d2453c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479075, "uuid": "bfc052f7-732d-4f88-8321-d3acc1cef67e", "comment": "Malware payload (RustyStealer)", "value": "c37542c9a47f215a2e13e99878bbae1a87f65d2239848d3ac0fac7371b9c1114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479075, "uuid": "61ff44a7-ff20-416b-8a42-d517fd496313", "comment": "Malware payload (RustyStealer)", "value": "1996b34e3424885bda52145418c14be6273f8be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479075, "uuid": "fcfa05da-02f4-4922-b1da-c91fd67159f7", "comment": "Malware payload (RustyStealer)", "value": "9c88ebacdf4ccc7c833525343ab1e363404905ebe5b05cd33ec10a994be2717ee6810a68ac8c462aacfe8ec025777e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479075, "uuid": "c1ff7d22-91ad-486c-9c76-7eb20a2e3929", "value": "T1DB167D43F69789D9E05ECC38C7565233EBF2B88D1620B69B1694CB6A2F13B601B5F344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479075, "uuid": "deb68a8e-a9ef-4b28-a104-f3739e7e7685", "value": "49152:D/ZP9U+uXvw9urPEk27lUzp53jzh2wXiyfQU1ogsLkqcDaHPYC1jxqhyAH46mbAt:D/DBuRVfhP7fQqo0Cky16hTUFHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479075, "uuid": "a43133e0-f263-4db6-b0f7-e62aad6e3655", "value": 4248064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479075, "uuid": "f6ab6ff6-2921-46e9-86fe-671e04bc09dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479075, "uuid": "29c8516d-b02f-43b6-b207-f105e9d989a0", "value": "c37542c9a47f215a2e13e99878bbae1a87f65d2239848d3ac0fac7371b9c1114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c604c85-7188-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782496617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496617, "uuid": "3d17a180-24be-4542-ad84-ff9daf449405", "comment": "Malware payload", "value": "38afdb5298a301871278e15711d1fe8b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496617, "uuid": "909a34b2-e881-4e10-b022-afee2c078cb5", "comment": "Malware payload", "value": "c44501faed7f8460936e69c2e0b43f1d6f445347269da5fd7e5b1e4676133e2d", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496617, "uuid": "8935cbd8-a368-4820-8002-c9e4fc6f1cd8", "comment": "Malware payload", "value": "e3733b6c96f4cc66e6e48a49ff7f0e871f0a9557", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782496617, "uuid": "6755df8d-8a7c-48b9-b5a5-1bf49e09d00d", "comment": "Malware payload", "value": "2023753550c2e1e6601f6be95b27c38143c129d765ec5ed423544dbf8ab8eb2caa02a6525011b8a3dd8fd16554ac27a2", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496617, "uuid": "0dd801af-c6f5-4b17-8ebe-061383ed6b20", "value": "T10075231613E55585E4B993B588EA46FB9131BD624F3A0AFF25E06C6E3B73680F03470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496617, "uuid": "d2f7ee49-9d46-4e75-9c0a-9aea97bfa4a3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496617, "uuid": "7d98fc46-ac3e-4c7f-ace2-6c098c4a17f1", "value": "49152:lysWEqe9shdRCS2dlqPl3+gvGwlfWcSRoHzA:lmTeKhdRCPYlulofXS2HzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782496617, "uuid": "6df6e9d7-55c1-4e8e-a1ed-2deb7aefcfdc", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782496617, "uuid": "5c3f8f24-dea4-4069-bf2e-5dc042f34511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782496617, "uuid": "5b7a9f5e-e0df-43b4-b4bf-c3337db1dbfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4238a7-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "48690209-ecda-45aa-9e23-43e98ab06d20", "comment": "Malware payload (Mirai)", "value": "a3d9e997dee8eaf064c7c23be54249aa", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "73cad1fe-eb32-4ea9-b580-2cc0109b663e", "comment": "Malware payload (Mirai)", "value": "c4791134307cb09f702b8c22d9b8868bdff95bd8fbb890fa3bfe87a797fdf88e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "e2685f54-c5fc-455b-9f7c-63e7a69defea", "comment": "Malware payload (Mirai)", "value": "090af07d8ed0ff908b3a70459f0e865b5622d6c4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453023, "uuid": "686d8ebf-be2c-4f45-ad3c-e3ac29b3d532", "comment": "Malware payload (Mirai)", "value": "f1883a65ec105cbc5b060189bbc4fa13258dd515f64b921a28cfb846cd17571e98ff35eb60238f33d82ee9270738f144", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453023, "uuid": "3d3f61fa-a3e0-4fa7-aa75-960fd20e67e0", "value": "T1E7055B16F2B334ADC163C034479BEBB2AD39B4790112AD7B22859A353D52EE01F19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453023, "uuid": "67983841-db77-4c92-937e-c11f99a50d9b", "value": "12288:LpWG0Z2YslmZ4xseXwaUiygVVRhFggXN9ccvo:LpWGe2hltxpXwaNVRhRxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453023, "uuid": "34ea2bc6-4686-4365-88c6-262278a22b38", "value": 852328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453023, "uuid": "9ea39b00-b9bb-4b19-9c0c-3033efba6103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453023, "uuid": "99b2f629-74c3-48c0-bed3-2aa2aece0d38", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6f0358-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479085, "uuid": "ae8fbf6f-d212-423a-b9de-108a26bdc73a", "comment": "Malware payload (RustyStealer)", "value": "270b0faa31df55806d6fe4090eb68439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479085, "uuid": "6f32507f-0910-43bb-9347-c657d5853c33", "comment": "Malware payload (RustyStealer)", "value": "c54e31892d9b39a99472105b17cbbae579c4d2b6affda2dfc79e00628c940592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479085, "uuid": "f32a50fe-fddb-4b6f-84a2-73f7f4d6d467", "comment": "Malware payload (RustyStealer)", "value": "0eb91dfaa265da98636badbff3d8f55485947a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479085, "uuid": "e73b05e4-2fe7-4d8a-a62c-106dbb6e24f8", "comment": "Malware payload (RustyStealer)", "value": "4986650a8800d0bbb234c7552675c79b6130ada0150aa474f97a905dd861b6b4a04664446c9ae7af92720ed15e0f15b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479085, "uuid": "ceacdef5-4c7d-4b65-bc16-e631569b2a8d", "value": "T1AD168C03FA9582E9C0AEC138C75A9233EB72F88D4620B79B17D44B212F67B606F5D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479085, "uuid": "3ed6c3d7-09c0-45e5-8052-0833942f3f69", "value": "b6f2031f270f06241bd725d4657b9fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479085, "uuid": "e52f4a6c-827d-4e63-aa0b-6d887cbffeba", "value": "49152:7hRI8CvjuQ8UYQXrN5RmUiZhRVr99mHE9NXDCyeB9LBhPG/qkUBWsXPn+0ANQThU:7Xc2VTzcHln+4e2Ua32hyRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479085, "uuid": "4cecbf2f-bfc8-4a73-9003-819c0b01bc11", "value": 4303872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479085, "uuid": "824512f4-bb77-45e9-a01b-a2c9d91969fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479085, "uuid": "d9eeed24-60b5-4005-8fab-539211192b5e", "value": "c54e31892d9b39a99472105b17cbbae579c4d2b6affda2dfc79e00628c940592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ce1da9-7124-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782453767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453767, "uuid": "b6c937f6-30db-4ec4-9002-a81fde4be6e9", "comment": "Malware payload (ConnectWise)", "value": "e7933121b98aeecf7102e0049a44e4da", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453767, "uuid": "ec1034d9-2b8e-4e21-b005-8f6625f6f7aa", "comment": "Malware payload (ConnectWise)", "value": "c6097f0c8548e6549cc790905c1cb7a52b0763194dc41e92f8a026e4c1c0b293", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453767, "uuid": "d37050cf-ea8d-4041-a1e2-7762d734cca7", "comment": "Malware payload (ConnectWise)", "value": "43eea26e7cfb91f815712f1fc2717ae70eb7ff04", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453767, "uuid": "8833f692-0145-4976-8e71-bcdb7a0c38db", "comment": "Malware payload (ConnectWise)", "value": "e0429b84cffd6bc32ee4823d1c66fe49e1e301f6c35d06385193202a26175e70e9898b8375e4a4c77f1579b6b8232b3d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453767, "uuid": "a6497595-6229-4e7e-b86e-f7377d9bf83e", "value": "T13F46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453767, "uuid": "df240332-4a3a-4658-92db-9447d1879d46", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453767, "uuid": "5f5c72d7-6f47-4c90-b38b-2e821523495b", "value": "98304:5zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:5hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453767, "uuid": "a1fb9749-f968-43b0-a7d1-a419973727ce", "value": 5643264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453767, "uuid": "73a8a121-6d33-4aad-82d2-5ea8863c0676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453767, "uuid": "551ce033-7d2c-4fee-9784-c2120cee04de", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf74bf1-7199-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782503971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503971, "uuid": "76bb2dd3-5a28-490b-a877-5f58985b39c7", "comment": "Malware payload (Mirai)", "value": "e720a6cbb70f8494ad6c001331920e99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503971, "uuid": "1a5fa8ff-6daa-4e0f-bda4-cc6c6bc5a095", "comment": "Malware payload (Mirai)", "value": "c60d7f885f481f6e8194f01551640da1e45e493c90edebeecfa0deb7a89b838a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503971, "uuid": "08ff0884-9177-44d6-badf-958596f778ed", "comment": "Malware payload (Mirai)", "value": "2306ccdeff8c4c19a9ad13d58a5aaaee46be9f5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503971, "uuid": "97693533-5586-445f-b6b1-1302a342acdf", "comment": "Malware payload (Mirai)", "value": "1146c7d53a70047a175ad5e5df36b90c3ceacbd01b7df422c0e6521b29be5e4ed062945267eeaef39f1adca13fe33b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503971, "uuid": "2137b0a5-2785-42a4-83c3-da3d538bc114", "value": "T16D44E806AF610FF7D8ABCD3306EA1B0129CC681B26A53F36B674D968B50B54B19C3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503971, "uuid": "01ac3f94-d255-4e7d-984d-7ae465020e39", "value": "3072:QO2sGGqR75Q7G3KNkYQDNJ49/qKKGzB1E5EwvLxwI2EhA:QzsB2NQC3q/9RKk1m9CI2EhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782503971, "uuid": "6a22c5a0-eeb7-4c4f-970b-813efffbec91", "value": 265012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782503971, "uuid": "35ff142c-56f4-4f3c-b5f6-315669e6a187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503971, "uuid": "64cc78ee-a697-4364-97be-4642b47458cc", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e40ebc-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "da937eb3-8fb8-43f3-ae1a-28dae6748f0d", "comment": "Malware payload (Mirai)", "value": "22d70f1c86145227bbd00f2935f92828", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "ab44776f-f99c-42e2-b64f-f7565417d156", "comment": "Malware payload (Mirai)", "value": "c65afaf94ce8abf1cca128899e26909ae83df551e658fb8d9bea2ce4f75bdd6e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "643f82a4-ae55-4b15-9d2e-23bd6ccd1a93", "comment": "Malware payload (Mirai)", "value": "fbbec443ed907b25b2d56bd5bb6eef221bde999a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "c3c60553-e0f8-478e-8f8a-78d6bf058c3c", "comment": "Malware payload (Mirai)", "value": "86a51e8f2675a1146eb1bcb1947a5af902f9e3e1074fe6deabda8e27c330c2f75dafdf6bff9eacd139de583c24bba85e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "7b277ae4-f3fd-4d8c-82e8-d3d75a9e3c5f", "value": "T12AA35B85F783D1F5E9A349B1406BE3AAC734C82A9132F7A5FB493D31FC71602495A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "88b10eb2-17fb-4a8c-aa33-9e5592999d29", "value": "3072:/HO15wOe/FtoIVFo+QN3Ek5ObaR3Tsw/l/aqFu:W15wNtdIqIr/FFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493094, "uuid": "e6adef17-3b67-489b-bf05-b91a9a329798", "value": 99660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493094, "uuid": "f80acd77-10f0-42c1-85db-ff80f377a898", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "f0378941-bbad-4acc-b31e-36cf309742c8", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf48df23-716f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782486018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486018, "uuid": "80c9d22b-ce33-4cf7-8b83-93901254947d", "comment": "Malware payload (ValleyRAT)", "value": "481b030071c78a6d71901654b7fa4dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486018, "uuid": "4229bcd1-dcf4-40e1-a1ab-0fbd91424144", "comment": "Malware payload (ValleyRAT)", "value": "c6ea91b2783f566fdc1992ee1a380f26d358bc4a9e25f9675494aed0d069f16d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486018, "uuid": "0dd3391b-8b69-4ad2-8bc0-2f5eb776f9d2", "comment": "Malware payload (ValleyRAT)", "value": "03fab2a83b8b4f563133d4b7b4b8f0cc5018ec5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486018, "uuid": "dcebc8d0-542f-4a7d-bce0-1b9ad2cd3b73", "comment": "Malware payload (ValleyRAT)", "value": "50cd2e50da0978b466a0519c1545d8f179fca1cf680bd28435fed93ee58cd1c0a527d99b3c733cd7fca21b69713eb5a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486018, "uuid": "043e1db6-dce2-4df2-a3c4-40852bdf62ec", "value": "T1A395229D6A4450F2C57452F58D0805B8A2BEFD1F3E203925BA38AB212C77786DFB8375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486018, "uuid": "daadbcf0-cfb8-48ad-852f-e0a8be394797", "value": "b352331f1815c3aef5e75c650559b8d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486018, "uuid": "5dc92394-1d1c-490b-9adf-c6cf920741bf", "value": "24576:tBT3IdwagHtoI7Wtgu/917dYl4R0KuGk2XGA+t:tBT3IdwagH6I7Wtgi7dYlkkMl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486018, "uuid": "998b06b9-f52a-414e-a3b4-2cd6ba93e2fc", "value": 1995376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486018, "uuid": "9d18109f-2891-466c-98b8-92de442e8cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486018, "uuid": "94af1725-b92a-4b31-8056-a5411320dd7d", "value": "481b030071c78a6d71901654b7fa4dcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36f2a36-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782452042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "8125d7bd-7850-4c49-b07c-29c69ee89677", "comment": "Malware payload (ConnectWise)", "value": "1a70cab8d03c30f587dd5128dde1a5ed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "e4bd4c6f-ce52-4c25-9e11-15272b0f6eab", "comment": "Malware payload (ConnectWise)", "value": "c738c3223beaf007bac4f324036eb3550fa274b4994f0f4c5b99c8b165f22a51", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "965255b0-7668-4134-97ba-c1a851e7bcb8", "comment": "Malware payload (ConnectWise)", "value": "7f4ba2df8949f5f6d5fd306f17d5130050a3a8c7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452042, "uuid": "f7d86a14-19ae-4818-b64d-166f3ecf4247", "comment": "Malware payload (ConnectWise)", "value": "924a6e6882fbbd1d3a887611800d052584b4a50a17bb14146603b085dbb43f058a06b46447f577c0238a66c8bfa635b0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "68b6c4dc-10c3-4013-a2e7-8b5ca3f42008", "value": "T105646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "a76dfa4a-669c-4c6a-9fae-8161a6d8b1ec", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "1d7bac8d-820b-4004-ba8f-1fe68871fb69", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782452042, "uuid": "82056034-e936-42e1-a5a1-06598c4e96f9", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782452042, "uuid": "4bc71b71-4a43-40af-b40c-7c3f5410da56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452042, "uuid": "79a3915b-3053-407d-98a7-289dcf3fcdea", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd160ea4-716f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782486015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486015, "uuid": "b6cd02e4-dfdb-45b4-ad11-677afa1067d0", "comment": "Malware payload (RemcosRAT)", "value": "3ed46511118ca32e085a53caca44a09b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486015, "uuid": "80e8ebc7-28e5-4245-a913-1bab8df38fb4", "comment": "Malware payload (RemcosRAT)", "value": "c75d8323a4288498f44893d1549ecc98be5b4dc3e89875189fe45f2eee0de36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486015, "uuid": "29c0dc25-484f-4229-9533-ae940a7ec2ea", "comment": "Malware payload (RemcosRAT)", "value": "9e8fa6e35b2122fad071a03b6180bf345f7e0f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486015, "uuid": "061851ad-15d6-4cdc-9b94-1eaad7744ba4", "comment": "Malware payload (RemcosRAT)", "value": "e029cec5a54a60d46f9d6ccc38a5b3136740b9ac54d6434e4355e56771a4d98e00b825a4222188313d3bbd8301f6154e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486015, "uuid": "774c49ba-1fce-44f7-bd11-a54b88bfd126", "value": "T164B4AF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486015, "uuid": "e952663c-6778-4115-be44-bb87ef9dcec1", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486015, "uuid": "9f1ee64d-b2a4-4eb6-9a7c-228f8c5d9b6b", "value": "12288:VlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSmj/:Vl0GcNUJV8i4mHM9/DZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486015, "uuid": "43fd27bb-25f6-4694-a8f5-a58faaed22cc", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486015, "uuid": "e29e3d04-7a17-40e2-b848-6a1fa5f2abeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486015, "uuid": "300f09ad-90d8-49c1-b7ee-4ab1ca0184ce", "value": "c75d8323a4288498f44893d1549ecc98be5b4dc3e8987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a4f2ed-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "37549b2a-9e38-4049-a7d3-029fa72ae9e3", "comment": "Malware payload (Mirai)", "value": "33e12ee29ee881df260aa490b7296c93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "d77c2844-fffb-4e26-99ad-8204ba8a077c", "comment": "Malware payload (Mirai)", "value": "c838fd942bbb2f84a84aae2322cdde91d7be79582c6959223af96cae6c26aaaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "e11e5e14-5154-476b-9ecf-4108ac377089", "comment": "Malware payload (Mirai)", "value": "3972864fed20b89c53e15c87bcd30966c9f725de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454006, "uuid": "560a6066-c8c2-4189-9643-b443811e4555", "comment": "Malware payload (Mirai)", "value": "136cf91c5748b52ea79812dc6cee4bfb32d74024497cb2b3c1e5c685c558d5e9212b493d798434fcf8ece930cbaa4d1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "9237701c-e3e4-4ffd-8af3-5adfe5d447f1", "value": "T1CC142B45B643CEF3E41304F011B7973E0B30ED364836D595EBA8AEB5DA27AC166163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "be703310-c65f-43d0-a47a-f7b602f6588f", "value": "3072:7VQvbpvW59+CyOmZRcGF5hwRj0aKKFk9dl1blpDi1:7mVOb+C4RTUx0D1TDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454006, "uuid": "22b37ad2-3c4a-4826-bb36-d39504947589", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454006, "uuid": "4a747768-2ecd-452e-a6e5-1df408fc8667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454006, "uuid": "001b7c59-b26a-4c06-8fe7-fa82294c9d70", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3321355-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782486428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486428, "uuid": "c5b2cf67-b69f-4a67-b12e-d2511bfb9744", "comment": "Malware payload (Mirai)", "value": "ff8aae99667dce574d285e19d92bc2cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486428, "uuid": "15a3aa7a-a387-4697-98e5-1e5ff5b34d58", "comment": "Malware payload (Mirai)", "value": "c865fe054a9fec4ff4976b078e7f59ce8ac0916e216eb3dc2dea6ad5799c2925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486428, "uuid": "215ef338-c17f-45be-afc1-2ee67307a18e", "comment": "Malware payload (Mirai)", "value": "7592d03247e1028eecffac99974b3983bd195fc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486428, "uuid": "a59146a6-8a4f-4952-a475-deb2fd79849c", "comment": "Malware payload (Mirai)", "value": "c020e1fc99e8b436dff5fed4f8d14a1825d53d1562133a06c22219858e161a934d78116c3c1fe3986893a198a58dad30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486428, "uuid": "e0de98ec-de8f-4c04-a7d5-719e9e161a7d", "value": "T1FC933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486428, "uuid": "3da5ea3c-6546-4ff8-96ab-dc8e8e5b3907", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2Dv:eyxt7W+G+3QBBntmzg6d7WidDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486428, "uuid": "8be98ede-31be-4d55-9db8-9dbdd6154806", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486428, "uuid": "1b3de0db-4e00-480e-92f3-93025cd55013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486428, "uuid": "02fbbb53-679f-4d0b-8151-d3a6be7552f5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6454c5cd-715d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1782478135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478135, "uuid": "ab8a2eb5-8229-420e-b588-d1521ae3e0ec", "comment": "Malware payload (Cobalt Strike)", "value": "6c9a2003f966064e96244f362628065b", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478135, "uuid": "7252e654-d042-4827-a264-999de6017965", "comment": "Malware payload (Cobalt Strike)", "value": "c8d5ded9c78fa5cd8ea2ec956064e7aab3e04fab95e9b2c4611f9370c0b28323", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478135, "uuid": "858af70d-c3c1-41b7-8483-33c5b41d5d1b", "comment": "Malware payload (Cobalt Strike)", "value": "8e575b592e414923db94865039e5b79266314b52", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478135, "uuid": "453f10a5-45a4-450e-9bd6-09189c919855", "comment": "Malware payload (Cobalt Strike)", "value": "790c747d68f8c85087dff3e2293ef6ef9098efbca438d2b442486915ca11519d56b1053c9d2c427931f48acd80bfb982", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478135, "uuid": "f2170e58-3d22-44eb-9d72-f9217b5b422d", "value": "T1DA76D552EBBA90D5D4BAC0398662A227FD723C5DC33463DB8B41AB165F327D09D3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478135, "uuid": "99637dd4-f630-429b-af51-bef6eed12273", "value": "f35409c0277bcdeb1733f6630c1a95a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478135, "uuid": "9d0c26b7-8508-4f1d-a3c6-0e284e8e5b05", "value": "98304:WQG4EA8yihj4HxeZFLOAkGkzdnEVomFHKnP:kA/2jAsFLOyomFHKnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478135, "uuid": "69081164-d5bb-4656-91a7-66c81c17db72", "value": 7659008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478135, "uuid": "2ec33317-7c30-41f9-8cc4-12ef9d9323ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478135, "uuid": "6e36c1ba-d457-4646-98f0-6eba0541938b", "value": "c8d5ded9c78fa5cd8ea2ec956064e7aab3e04fab95e9b2c4611f9370c0b28323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca96a4a8-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479165, "uuid": "0c5569c7-e4d5-4e17-8776-887d4fc689d1", "comment": "Malware payload (RustyStealer)", "value": "2a026ebc8eef3e2cc77878bca0798f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479165, "uuid": "e36e67ad-2df9-4d2b-863b-2d020962be6e", "comment": "Malware payload (RustyStealer)", "value": "ca08bdd63f2268afbe9d1662cb45c3ff77f892e5e6a6c1e86b83d481af182649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479165, "uuid": "72d499cc-7413-4af7-8c6c-de35f4f0f138", "comment": "Malware payload (RustyStealer)", "value": "85c2dd97b5801f4a23448546c050600d01f173e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479165, "uuid": "b33352dc-1607-43e7-9b8a-5047053de810", "comment": "Malware payload (RustyStealer)", "value": "53e1578e44f509ce9eb80b6811b5f3d10c15370fb6e13fde1344271ab3f4600ef75555832d6c8a80432e82788538a298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479165, "uuid": "1c39d113-fb01-4b96-98e2-6c14a307334e", "value": "T1EB167D03FA9582E9C49EC179C71B9233EB72F88D1624B69B1BD44A213F53B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479165, "uuid": "7e04ab6f-240d-41af-a3fc-1fac64217048", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479165, "uuid": "728a5212-aea7-46e9-8595-7b01354cc3c8", "value": "49152:MMhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jreFdyFZZ22:M5w3u+vBoTheSioTM8jSFdGZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479165, "uuid": "a0930c44-ae04-415b-a29d-27cce2b7d6c3", "value": 4217856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479165, "uuid": "d6273d08-1769-44b2-a4c1-d406b5c68348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479165, "uuid": "ada87111-e048-4e76-9772-689be07b82f2", "value": "ca08bdd63f2268afbe9d1662cb45c3ff77f892e5e6a6c1e86b83d481af182649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f738d6a6-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782458625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458625, "uuid": "79223d00-e130-4ec0-9123-a89a088b9acb", "comment": "Malware payload (ValleyRAT)", "value": "85bcffb9aab5821ccf3525e7045e0320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458625, "uuid": "8151a7b1-981c-4f51-a135-293f26f174bb", "comment": "Malware payload (ValleyRAT)", "value": "ca3586dbe56a8300f9e34ce92becc58e12f4612c3d48a324136c50115f1cb23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458625, "uuid": "d032d631-04ab-4a5d-969a-83390733aff9", "comment": "Malware payload (ValleyRAT)", "value": "78414a08a56b91e70edaece22b56494581f58c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458625, "uuid": "10e8adbe-105d-4905-b069-a9f0db53eeb0", "comment": "Malware payload (ValleyRAT)", "value": "3c6d02cde1eeea21461cdade47a5a9287c86ba2b584555b8195bf6be77dd8772c45d37b2bbc2e7f3fc2919c4ae798b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458625, "uuid": "28b740ce-c939-4961-9320-ed9f47ba8da8", "value": "T175D2F782F9534552F91CF3B4282A2EC5ED673D7029B3850A8E54B89B1F3F086B0C55FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458625, "uuid": "817d7636-816f-4f5b-a414-a255461aa0ec", "value": "1fc0defd421bca0369b4c5fc4b32035a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458625, "uuid": "e107b73a-0722-402b-8d4a-2e01060f3d99", "value": "192:q0FNSv5kksQDbEjaNWJLzjOF78H3CAUNbE5pz63MdlrX5EuvfP99:tSlbNYJLzji783CnNbChZfPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458625, "uuid": "aadfdd1d-0cda-46d0-a53a-1d6c16d544b2", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458625, "uuid": "72bd2398-c13f-49d6-9394-8b8665f09faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458625, "uuid": "c8c9ea08-eac7-4525-9b5d-35fc96bcf79f", "value": "\u5361\u4ea4\u6613\u4efd\u989d\u5177\u4f53\u6d41\u7a0b\u8be6\u89e3\u27b7.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da008b9-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "44bb271b-3761-4674-9d6f-87e95203f655", "comment": "Malware payload (Mirai)", "value": "cb4f9d62d2fb451fc18132911a61a686", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "7f6ddf99-dffc-4feb-814c-a11e5d13c750", "comment": "Malware payload (Mirai)", "value": "cc4082328b1614a367514d226420b44118355da711be976221291d682c59cb78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "d846b07e-5c7a-4bb9-acc6-a33cba2eda04", "comment": "Malware payload (Mirai)", "value": "b7b373099488fa10d594ee8d392419dffd4e0f22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "17aeb8db-d556-432f-afd2-8a92560f4caa", "comment": "Malware payload (Mirai)", "value": "b1b6a8210c4c5fc8f98a2a23d43566ceb72018560241bf0070ede6b41d1004af95e6d580d707bd58350c951a7d43f789", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451898, "uuid": "3fd719fe-35a0-4f94-a029-0d242681b434", "value": "T18263F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451898, "uuid": "69d7c590-6f45-463d-a3e3-98190632d098", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duEhtX+RZMZk9v0zAIyi+wcauE:TvBkGNxQ6Kb/jXmUkZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451898, "uuid": "f8a46152-fbaf-4f57-906f-3986d3608dd9", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451898, "uuid": "b08ac9e5-e17c-4dcb-b11b-3f7bd8b083c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451898, "uuid": "2dbb0be9-33d1-4614-97b8-159f5292dace", "value": "mirai.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf2af2-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479171, "uuid": "0b165352-9c94-4af0-9f51-93834b103bc8", "comment": "Malware payload (RustyStealer)", "value": "b41cbc3ebfd0db1331818712635e7d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479171, "uuid": "bedfc7b3-2c5e-48ca-a536-b7162b995547", "comment": "Malware payload (RustyStealer)", "value": "cc933a50c4b195a7c043188496042d2a3566ee1589b48112050b552c948bb3d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479171, "uuid": "e64cdb62-6cad-4bb0-a5c8-f26bcbe2bb2a", "comment": "Malware payload (RustyStealer)", "value": "1c3fea3f97d87bfb853e10d3dcc5404677e1411c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479171, "uuid": "415276ce-49ba-4ab2-98e7-27ba4eefad7e", "comment": "Malware payload (RustyStealer)", "value": "989bfa4d6ca022991b689fd2c5a4fd63b3584b47371dcaa6f2519f271d2ccf4e4abadc96e9efeb9f6bbf81a073da3c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479171, "uuid": "89e224c1-1e7f-44b1-9036-4e7e74ea24db", "value": "T184268D03F6A581E9C0AEC078C35B9233EB72B88D4621BA9B1BD44A613F57F605F5D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479171, "uuid": "64838af9-26f3-4511-b791-2bd9728bf77e", "value": "cfd56f88c30e7b2ca01cca1ea99ed9fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479171, "uuid": "19e03d9c-eb62-433a-9308-0344ef6759c1", "value": "49152:eXT+BGKWdf/+ijM44ylmMoLSZpMrCKLRLmWDUPa2nBZM8ebjRRGi/wu/P1fw1xZo:eXywKWQi+2BSNFYRvaYeivKUmtn+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479171, "uuid": "90bbb882-7cea-44c9-b7b9-81433b63acaf", "value": 4829184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479171, "uuid": "446ca0b2-504c-4a74-b4f9-f1f0bd8e0c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479171, "uuid": "e54bf32b-f6f1-4678-a419-7684419eb9e0", "value": "cc933a50c4b195a7c043188496042d2a3566ee1589b48112050b552c948bb3d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e75bd4-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478864, "uuid": "5e00e135-a970-45b8-8551-fd513eea6f86", "comment": "Malware payload (RustyStealer)", "value": "0c84fe9285b5eaa476a7646ae02c87b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478864, "uuid": "7bc7d8d4-55f1-4077-ba95-24a50218c95d", "comment": "Malware payload (RustyStealer)", "value": "cd861121f29f14fb75db0ce73b979b86fe4eb3c019cd0bd83683786f9af26dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478864, "uuid": "eda5e337-882d-44f1-be4b-0c42c8f82943", "comment": "Malware payload (RustyStealer)", "value": "d68cd664051e64aea45b844bdcc38af3460d1359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478864, "uuid": "10c3a6e2-5c24-41bd-bfa7-c3e70163a9d1", "comment": "Malware payload (RustyStealer)", "value": "20102f4641355445c7c679b8e0109d4b419c2611d99568ac5a0715bf867b0b1c86a44654d5bdbc2c29833cf17dc78726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478864, "uuid": "37657e59-3c3c-4c19-8f03-d54778da6f31", "value": "T1E0166C43F69D42E9E05AC138C716D233EBF2B88E5621B69B5694CB713F63B601B5E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478864, "uuid": "36f20e01-1603-44cd-97c0-a4a8d23e1da6", "value": "49152:U+eFIHlV9Bm51YpKX5sjTdcUlwRfQU1ogsLkqTUhs6UD9MKup5uIjtAC55X3If3:UTIHrIsdhIfQqoKX15vj555X3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478864, "uuid": "5a4ddb6d-a760-40cd-ad2f-02ed9ea0dedc", "value": 4250624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478864, "uuid": "f3cbce7a-2fe9-4b3c-b815-beabadd5bc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478864, "uuid": "35c0d114-01ab-42e6-820d-0c1775dc49c2", "value": "cd861121f29f14fb75db0ce73b979b86fe4eb3c019cd0bd83683786f9af26dd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8f9d6e-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782511807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511807, "uuid": "7ae2f8e5-9c9b-454b-bfb7-55eadadff959", "comment": "Malware payload (Gafgyt)", "value": "402cb10e41e496fa617e839663ef9925", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511807, "uuid": "a0a401c7-014e-480b-93ae-033187a89085", "comment": "Malware payload (Gafgyt)", "value": "ceade2e6f3cc94173e8f6a7b065f359328dfcde8dd3931beeb26822627cd343a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511807, "uuid": "1868900d-3f5b-4687-af78-97dd87df2a9e", "comment": "Malware payload (Gafgyt)", "value": "e96bc849a58ed58458504c2808d29a082910aba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511807, "uuid": "166450b5-2d14-4124-bcea-30de119ef247", "comment": "Malware payload (Gafgyt)", "value": "a373a4e9f343b61e4d21e40db9b603e33c84dc0573706542d0338bf3e151d14570a438b8e9fdc9d5af21d483dcdef3ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511807, "uuid": "61c53453-012f-4f95-9f52-b47c2fba9b86", "value": "T132A33947B9619FB3C0829AB565FB4A304713E8955F4F2A5A31785AF4034F4DEB80EF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511807, "uuid": "91475fff-36d6-4500-b692-1e159c000f4a", "value": "3072:6f2QPyhYfaTzpTX6dblcxTP4/mzK0POjBfk9o:42Q6mszpDsc9w/mzK0POjBfk9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511807, "uuid": "58ee3f4a-dc59-4fe2-92a0-6230326cebd1", "value": 105676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511807, "uuid": "bf58d360-905c-4d0a-96c7-1b8a6b8cbd60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511807, "uuid": "c7c9b3ff-8bfb-488a-867f-3e309b97d602", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a195f9e-7130-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782458656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458656, "uuid": "0b7c0198-3a05-4366-a797-ca1e99cc1fef", "comment": "Malware payload (Mirai)", "value": "a931c995887dd522579507df9499a811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458656, "uuid": "95ca0bbe-4553-4463-8242-6bbab18d634b", "comment": "Malware payload (Mirai)", "value": "cee1a90be193ce6b37822a2b53fa5da56ef813155cc53797099ba5b23add9336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458656, "uuid": "66a13ceb-de62-4256-a7a5-58cda018e53e", "comment": "Malware payload (Mirai)", "value": "77df4bdc47b4813be406f34a9a4cc38603a29fa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458656, "uuid": "b0f79220-45c9-4bc8-b976-6440828facf2", "comment": "Malware payload (Mirai)", "value": "1825cd2deb88d32b34a42aac4ae023a322c19556aae693f2583bafe48ff101b3ffdb853edf4ac69b28e550b5ff419c00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458656, "uuid": "c3fd2d40-92a4-442e-a1ba-95652e59a866", "value": "T18CB37C69AE4E3C82E3C7C37D9E525FB1321FB4B8C75192B52F02425ED4DEE9A98D0442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458656, "uuid": "2692cfba-1e8c-466e-92ee-f512b31a090b", "value": "1536:lUIuDNOLh1MINkUic7C4CpmdiVbxD0P9LQgvUEZ+hRJhWfREpWkN/7O:buih1xdih90FLQgvUEQxvWa/7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458656, "uuid": "07e6191c-a544-445d-8dfa-2a1ae76f608f", "value": 108432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458656, "uuid": "0a2cb010-c009-477d-8469-d5a7e33abca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458656, "uuid": "bb556af1-6ab2-4eec-99a9-2263ada49c14", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ba3fbc-7153-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782473787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473787, "uuid": "4daba141-31b4-4dab-b78e-65011b188e5b", "comment": "Malware payload (Vidar)", "value": "5eca7be606723c470d02afbb53188dc2", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473787, "uuid": "93ad8de5-a751-450b-970b-c4ba12c74407", "comment": "Malware payload (Vidar)", "value": "d0d8d45ef06d0d9ee5f3e0b01885c965f8541d2ad0cba3ca401aca56bb0258e9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473787, "uuid": "99b9bf5a-e833-49ff-882c-0ebcac81aa09", "comment": "Malware payload (Vidar)", "value": "ccad36f947b504ab0d3fa44db56416bbeba001fe", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782473787, "uuid": "647d7fea-9b91-4744-a766-44a427b432f4", "comment": "Malware payload (Vidar)", "value": "55028ddcad402e2d069f38e8fbb7b469c48bb54884cf651637ff394d7d636a44f3b3df78dc68968c78d57dcf7afef6f3", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473787, "uuid": "34c76ccb-b534-4a15-916d-9ac9636142e5", "value": "T19C064A876DD008E5C09E92318CB6617D6A66BC0C0BB32BD72D52BA782F767C84C3675D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473787, "uuid": "d0b214b0-51cb-460e-a536-f4187fa6209d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473787, "uuid": "756ef530-5d97-424b-90dc-abef7a1ddc40", "value": "49152:6oL80/z5VD3P/JMCkXnU2TKNB8HpyZGYv+apyJ:68u3PKNCHpyZGES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782473787, "uuid": "4f94d5d4-31ab-4afd-8039-3740d7858a6b", "value": 3813768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782473787, "uuid": "0ad1bd03-ebb5-46d5-bf5d-465b788b6a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782473787, "uuid": "53d0af8f-9d78-48ed-a7b7-3bfc47c94ba6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cb7e92-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782452871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452871, "uuid": "c63efa6e-f694-4b6a-9a8f-d8e7e92f7612", "comment": "Malware payload (RemcosRAT)", "value": "91de8b7c3e1fe89ca8bc15890daba065", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452871, "uuid": "255d02bf-03e1-4f32-89b1-7903c52a63c3", "comment": "Malware payload (RemcosRAT)", "value": "d0de302ea5ba726c0dc51c90a0a9379614c210945763deca5c6695754c83f16c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452871, "uuid": "d12785a7-c3eb-4288-b0ed-2861b219ad32", "comment": "Malware payload (RemcosRAT)", "value": "f1332fa8d4a228bb7904f4054b8ac81f7c15ffe7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782452871, "uuid": "150985b3-e1b0-432b-b49e-25a41f12755a", "comment": "Malware payload (RemcosRAT)", "value": "36e8815a12f1d70bf73e3459ad40991fc0be428d67233cbeb14e89f3c196744a92acdcd1b9cfa12617e74c89ca17cd85", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452871, "uuid": "f13b262c-cfcd-464b-948b-54331739640d", "value": "T16F526B6ACCB95CD46AAB3780BADBFDA710950B430E61052CD50208A4B73D7BCDFA285D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452871, "uuid": "1df3a1a1-01b4-4a2e-a212-a63a4fc815a5", "value": "384:5orl2yr/sIlaEeZ08uVJhQma2dpP+xoFTTrZdlDHeZjVJnCfY:KrlpsIlaEeZmDWypWxoVJdlD+Zx5gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782452871, "uuid": "00f9692a-4127-46b0-8849-5ad25c23304a", "value": 14163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782452871, "uuid": "23d6a863-a71b-4a98-bcaa-0fc22220f681", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782452871, "uuid": "3226df1f-8428-4b74-bf56-1724493c32bc", "value": "Santander Comprobante de pagos, PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5e5808-7186-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782495624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495624, "uuid": "7621cf12-e4d9-4019-8830-74e45306a227", "comment": "Malware payload", "value": "058ab6d0604fff794658eed332507463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495624, "uuid": "3db5d522-c709-46af-b5e1-4b3369cee706", "comment": "Malware payload", "value": "d113f31dc738655fddec9d7939494cd2dfd14d7ea31c52ef49252d51b9ed5730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495624, "uuid": "7dea0308-b64e-436b-8fad-8b96c28f1c90", "comment": "Malware payload", "value": "ccb5de9ab79b1c6dc875715012562ec22606a5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782495624, "uuid": "8787e35f-0df0-4ead-9041-37997d2f16e1", "comment": "Malware payload", "value": "9013fc9b1565120280521f7961c3d33e714302d686e0f2fca6777ade4f966ba1aa0963647d0bf1ef2e8f8414968611c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495624, "uuid": "f130da22-7283-4888-8cf1-ff8e5711b6fd", "value": "T1E2D41903E6D250F9C16BC275876AE372B572B88C12757E2F5B98CF212F20E50972E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495624, "uuid": "1054523e-4d2a-43c8-b75c-0dc469e9a829", "value": "3c3d6531c1a0edf3c7f7a21b285df2ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495624, "uuid": "7b649e82-9d3a-4107-8ef1-1f6520894968", "value": "12288:TV7PX56HDoazvSnw1Q17frdQoOcNOYbS5hNe:TVTJ6HDoaz6nw1Q17fWonOOSHNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782495624, "uuid": "464f1057-67a6-4142-af81-d7875a2c70c2", "value": 613427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782495624, "uuid": "ba5cb5f1-1b30-457c-8893-c3c7bcf39d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782495624, "uuid": "bf957476-99a8-4d49-9d11-27c3637922e4", "value": "libepsbase.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e1aaf2-716f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1782486008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486008, "uuid": "7d81a24d-95fd-4cfe-a103-8a96d265fd7f", "comment": "Malware payload (RedLineStealer)", "value": "3f48ee014cdde9588eddecf08bf35821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486008, "uuid": "13603df4-d8fc-4eb8-81ae-012ec90c509a", "comment": "Malware payload (RedLineStealer)", "value": "d20ac6d6eda2d70adf552f3bca04c1e030611df9e61febee7246b87410e68d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486008, "uuid": "5bbac5f7-2fbc-4dc8-80a6-0b358309e902", "comment": "Malware payload (RedLineStealer)", "value": "ed87b2e3088e4bb147855d2829a48a9e45f03351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486008, "uuid": "d6f9e2e0-952d-44b5-9a53-cc535b47bf47", "comment": "Malware payload (RedLineStealer)", "value": "f679fb79e49ea7586a149cfe59530a93809db155e25a67ce746dcc3028da67ca653dec6ca695778f860c386002a5dc42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486008, "uuid": "2ea2de54-0568-4b39-b1eb-3066040f1475", "value": "T1CAD4FF1859BFC015D0E7EAB12DDCA8BBD9A990E3644D793710B4633B4B52784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486008, "uuid": "cd628846-0192-42af-83b4-01b177ff4651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486008, "uuid": "a3cadc53-2800-4368-af67-8bb79ec44bde", "value": "12288:QkUWLo2zz5eA1GoYqqbnIXWksf1PQQQQQQQMc9VhbO/7T:Q2HzL136", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486008, "uuid": "87107d37-2d13-4445-ac76-16cbeb26d35d", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486008, "uuid": "e4e26e48-3517-4006-ac94-7d175ba1eef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486008, "uuid": "4ad8dd6e-bb34-4df6-b44e-b797c580537b", "value": "3f48ee014cdde9588eddecf08bf35821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2337a3-719d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782505745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505745, "uuid": "358fbb06-28dc-49ab-991a-da872b77b979", "comment": "Malware payload (Mirai)", "value": "25b1910300664920af458a7623d6a0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505745, "uuid": "eae69336-9032-446d-9a0d-4de3c4f552a1", "comment": "Malware payload (Mirai)", "value": "d2102df636e277ae48b10aa3b957b555316ac94ddd27131c840f737d5411fedc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505745, "uuid": "67598976-8774-4d76-8073-dcb0e0777325", "comment": "Malware payload (Mirai)", "value": "e2ff803e2519690ca2daac37a6cd155da9d00fcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505745, "uuid": "18582255-0274-4ea4-9e9b-81bb27b01dc5", "comment": "Malware payload (Mirai)", "value": "c978a95d5b699370dafff48141b0f132896fe9c04cdb219b5c37326d1ea88ca6d5637f1e6a161c84bd55876ccba46e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505745, "uuid": "92362881-94fd-4d46-8e85-9d29463a0410", "value": "T197530292C70A97C8F3596F52D1100B805BC2D7CAB5FBC1E29442EB21AE15274D63E9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505745, "uuid": "615cf095-956f-4012-aeab-6b8cab6ae6a2", "value": "1536:Q9JwLheaUAufPJU2ZBcU6DDzhG6wGDbHjZQmZbWcoY4u+qgw0VucY:8JwLhPfMUkh6Do6wkSmAC4u+qgw2uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782505745, "uuid": "40e50689-6c40-47f1-ba0c-1b0616aeba56", "value": 64200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782505745, "uuid": "ce73429b-0255-4c76-a15e-d10617590cb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505745, "uuid": "537a90ed-5b8a-49d0-a832-406d0a228899", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3723b1c9-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "c9b0c393-8f22-4884-86a3-7f783ced7544", "comment": "Malware payload (Mirai)", "value": "1be37b3a02a06b84cf2da0d6068a0b4f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "d0701f9b-8521-457d-83be-72b8fd1bb461", "comment": "Malware payload (Mirai)", "value": "d2efeeb3b501422dd31b5b66739676909c473a9835f9d98323cee269a2480d98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "60c6ed4d-58a4-45a1-ac0a-c6420057d391", "comment": "Malware payload (Mirai)", "value": "c2b634ebff8883a27e7e2f5b03415e18fe4d72f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454007, "uuid": "7adb3cab-f0ed-4d51-bd27-eb276effc26a", "comment": "Malware payload (Mirai)", "value": "2f886d12da005b6fc1b043fc50cb6755dcf0159f9f11feef6c841b8b67cd1039adc48913d54f9b18d4e1b17652b7b974", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454007, "uuid": "fba92ac0-8cf0-4145-9464-fdad3c3e5d58", "value": "T14B243A027B0D0E03D1532DF0273B1BE14BEFFDA128B5E680755EBEC59271DB22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454007, "uuid": "7fd9139f-be1e-40ce-9365-63cadc8fae45", "value": "3072:AaQzEan+B5RL6tiseuDTc5AIxseNkAbZn9HvVFS8Q1jVMnGIC:W+B58xesQ5rxRkAbZn9zSvjCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454007, "uuid": "6e95fa02-ab9b-4740-bbb4-31b3c6685f28", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454007, "uuid": "d7af2ece-b35f-4faa-9db4-4c4e590b91b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454007, "uuid": "4e9ba532-a591-4fb6-8910-96dca7966b10", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988401e5-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454171, "uuid": "7790cd95-ee6f-4097-b1d0-6f4d1df0139f", "comment": "Malware payload (Mirai)", "value": "f6212d04ec4480930f74496a89cf7936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454171, "uuid": "3bde08f0-19ed-4fec-b9ee-bcb145701b5b", "comment": "Malware payload (Mirai)", "value": "d30944617f3f3831f9f968f94592b8f007cb821df0c92c894c1f37ca851960f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454171, "uuid": "da20abb9-db13-4b5e-9459-037288d352ce", "comment": "Malware payload (Mirai)", "value": "c982b0b36a5d04e4a38c204f59727c3379c0ef9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454171, "uuid": "e98a1b44-b8be-4b27-b24c-a1992a69c660", "comment": "Malware payload (Mirai)", "value": "514571b5680497b8c052c3eff5375a0f5bd9d4de5482c4e4ff63ad1a652f4d8d71e6f2c0e3201dfb9fc94f7b1abb8c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454171, "uuid": "607f8df2-c576-4ca6-a9b2-5f836f2dd7e3", "value": "T1E4B3280BBC819B12E5D622B9FE1E518D331317B8E3EA71029C209B6977C795B0F7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454171, "uuid": "c5109f9d-2073-4807-95dd-a628583bbe36", "value": "3072:elYjL8XJDkhP7TpnMaTfgqGfHyEO2WAMhn:eyjL8XJD47TRMaTfgqGfSEhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454171, "uuid": "5f4a95f6-fe49-414c-a2e2-804d2e438e29", "value": 117824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454171, "uuid": "0582f324-efde-420a-8253-ad0d3464f620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454171, "uuid": "ac3997f6-0c4b-4f52-9423-3c97fc9ada12", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e5fa4d-719d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782505682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505682, "uuid": "46179ff5-0640-410b-b0c8-d842a0a1b88d", "comment": "Malware payload (WannaCry)", "value": "e0b020c2c49fc3930f342653085e6549", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505682, "uuid": "07717d53-66e0-4954-bfc6-b4461d43e656", "comment": "Malware payload (WannaCry)", "value": "d435698c0c6075d687fff90803c54b24fb36c95be86ffedb9befc62f0277439f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505682, "uuid": "6b425b4b-c6c4-41b9-9459-ebe8ec5e63b3", "comment": "Malware payload (WannaCry)", "value": "0f8de96b51d4464fa9e83e1d2c33c1dd492c54b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782505682, "uuid": "62371de4-8731-4cf2-85f1-5eafa47ba8ba", "comment": "Malware payload (WannaCry)", "value": "b95e8fd12f2465c04b2809e67235ce7bf380f77a92f220f857a8351f9b102d660d6ff20e88c6de42de7aaeff0e4f8510", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505682, "uuid": "ac0c65ea-2a2f-4aa6-bc25-7be864175f97", "value": "T1FE3623DA75AC60F8D1167374A4778E26A2B77C6D21BD9B0F9B808B210C03B61FB54B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505682, "uuid": "07220696-c495-47d2-8069-8f0a3756c293", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505682, "uuid": "8da3f994-5753-4c8b-bd80-1e71a741fbd2", "value": "24576:RbLgurgDdmMSirYbcMVgef0QeQjG/D8kIqRY:RnsEMSPbcxVQej/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782505682, "uuid": "52eb245f-17a7-46f5-bba6-7d50d329c6a0", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782505682, "uuid": "6a1e8234-15c1-4752-bbfa-5718c5768942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782505682, "uuid": "3e6cf5da-7c08-47ed-b4a4-e91e305bde7d", "value": "d435698c0c6075d687fff90803c54b24fb36c95be86ffedb9befc62f0277439f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29baa4b1-711a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782449260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782449260, "uuid": "8bd57074-ec7d-4656-bc3c-fa4568171370", "comment": "Malware payload (PhantomStealer)", "value": "fb3238bc5d1254643ce9507a9560420b", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782449260, "uuid": "81c9bd76-1b0b-4957-8d30-08943fe9b872", "comment": "Malware payload (PhantomStealer)", "value": "d4f2a8731db28ded7dfe939e8f50827df4c3399295eeec156003507ae098bf83", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782449260, "uuid": "72fe1c29-eef6-4ee2-a029-4013ae88446d", "comment": "Malware payload (PhantomStealer)", "value": "343cd1005f3f0130843dffb40e256c733dfcb931", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782449260, "uuid": "16f238a7-a8d7-419e-8309-6a2e8877844b", "comment": "Malware payload (PhantomStealer)", "value": "6676a997c8f9c4d354adf1ec678a795f46d5b3a476f49394eacf33e2b6cce86727dd7d31e7884c4590d4af272cad9167", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782449260, "uuid": "6fc1b54f-8af2-4103-92c1-59087c361bdb", "value": "T17AF533232EB07DB84798E3AFA5AB6E121C015F41D515E0D737D061C7279BBD2CA0BC69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782449260, "uuid": "0fe9ebdd-480e-43e8-b231-9f691e32983c", "value": "49152:rUMez9Wu/KJvmcc9N4kyb3xEhxLAp71AAZUuB:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782449260, "uuid": "c9877fff-f423-4053-a0f1-f3aa8dc21060", "value": 3421142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782449260, "uuid": "3f021946-dfea-49c1-92fe-88f0faa40174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782449260, "uuid": "c5099cdc-710e-4cb5-9f79-c4a674abaebc", "value": "G54NBV10.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064a11cc-716e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782485279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485279, "uuid": "bc98da94-465c-4727-b1a5-0f1a992d04b1", "comment": "Malware payload", "value": "e6906caeb0aac854905edc255fb7046b", "object_relation": "md5", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485279, "uuid": "ebb71f1a-228f-453d-88d8-e276f60d4e52", "comment": "Malware payload", "value": "d551be873e5bcebbc1a2f0baf3ee52c98dbdfeb483b46f6d2be8333df7635bfb", "object_relation": "sha256", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485279, "uuid": "06c1ca5b-908d-4fa0-8039-a4f54fcfedd4", "comment": "Malware payload", "value": "a41d420a413620b92d75cc157c0002f163783009", "object_relation": "sha1", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782485279, "uuid": "0a4f965d-f59c-4cb7-b968-ce2bc92952ee", "comment": "Malware payload", "value": "a21b574bead3c1dd7f69ef0c3c1123e6196a612408c57c4458cb714133308792c8cb710339d1f73e77ea62dc501c1b45", "object_relation": "sha3-384", "Tag": [ { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dservices-space", "colour": "#7DD0B0", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485279, "uuid": "e5df9558-e8ac-4af3-af2a-5fcddc98f75c", "value": "T10016336E81012C74F5821CB8936DB9E0A006347B5C9A34754C0BCBAFA576AE7D6F5B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485279, "uuid": "47d28d46-8fc3-4fcb-a7ec-3b624e7fa958", "value": "82b064beaf47c47d8f53a822526299b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485279, "uuid": "37c9a5d2-4aa6-4d75-9fb8-4a191952e4ab", "value": "98304:FZ6wktoeYfV5uEfneq9DiT5vGUyLNevO3pPCP+sHnH5xI52+ULMgN3mxiMM:FZomx77fneYDiTEUyIG54+sHnfIU+UMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782485279, "uuid": "d7839e02-434f-48f0-b5b2-6cb246e7c4c6", "value": 4145152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782485279, "uuid": "59203be1-f16e-48d5-a3b4-6e48f736f7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782485279, "uuid": "f32a7ddf-038f-4713-a8af-b1cc4ade676b", "value": "mapistub.payload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc2adf8-7124-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782453856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "c56409be-a645-4567-bf1d-ba08f3a11b4e", "comment": "Malware payload (ConnectWise)", "value": "17b6b52dad9d0f22946dc7151de3b206", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "9afd4ca4-d0d2-4b07-ae03-b3593c26200c", "comment": "Malware payload (ConnectWise)", "value": "d6dac4795a555ac174409e0fc911e18747284480c0e6f5f9f3d79b0bc1c30459", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "1eba8c41-893e-4aa4-8efc-1e081e9f0c22", "comment": "Malware payload (ConnectWise)", "value": "c1caf85d8581425524e6906558a225ac4c7d45fc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "8c696c40-7a6a-4bc6-a679-f1e3c30c4020", "comment": "Malware payload (ConnectWise)", "value": "0781530647df6fa60771c001039cb025c18512deaeb673336bf311cb7402bf2cdc896b7a7fe74b96be093ca642156336", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "d1ad4c1c-805d-4a31-b5c3-ffaf0e5cfcf2", "value": "T1FD646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "44447217-10a6-4c86-875e-636f0f831cee", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "e0f456e2-a725-4d89-8162-9208b6175a1c", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453856, "uuid": "71c897b1-5289-4196-ada4-eee927859b24", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453856, "uuid": "c4d6479c-b616-43f1-9dd5-b3d5885e05ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "c759e766-cc0a-46c3-9afa-e41c523da3a4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dde8a22-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "b870c6f2-ad06-4d40-82af-71ab51bdb149", "comment": "Malware payload (Mirai)", "value": "d4d9c9b555d4361d718ea657042b2038", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "f436b033-ca38-4c32-b04a-b31a60110830", "comment": "Malware payload (Mirai)", "value": "d7aaa4a78f00d573ce587f559fa17d8b6c434d5cbfaf1a84b874a93c15320364", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "17a6e841-7ddc-49da-8652-b6bef79ee6ce", "comment": "Malware payload (Mirai)", "value": "9cfa0a6b3b45595a4865808ba51235e52a867aba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451898, "uuid": "e458a04f-cb5c-4ea2-ae0d-a360b8d515ec", "comment": "Malware payload (Mirai)", "value": "f41ce47397329a259ea9aa70bc868226fea53ade2342992fa8c2b8508581e2009bfbe4fd2dda04d531ebc647f66151ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451898, "uuid": "86519d52-2318-4651-a775-519bdbe4c70f", "value": "T196430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451898, "uuid": "4702e1fd-5006-4965-9f13-87f5dd493892", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsjBXuL27P2hFBw:FH09gQ3jeBg27+hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451898, "uuid": "cc144f61-f03b-40f8-ad1f-096cd9d703db", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451898, "uuid": "af423fe7-ead8-4e5e-b367-852da90a42a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451898, "uuid": "b9872ade-1c8a-4ecd-9642-92bf3e8c874d", "value": "mirai.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7429f6f0-714a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782470001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470001, "uuid": "9b89f028-bdac-4d41-baef-625cf64cc701", "comment": "Malware payload (Formbook)", "value": "c854e48d5a9812140bdab7e4fdc29c32", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470001, "uuid": "c342afd7-d541-4cd9-993a-5b96eb24afa6", "comment": "Malware payload (Formbook)", "value": "d9460d9ceadf034753a211f6bdace5292d3d7db2e79969d19b366a5473efdad5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470001, "uuid": "e644381c-d331-4b2b-9c23-f98d7e9348e6", "comment": "Malware payload (Formbook)", "value": "fdece86a7dcbae6c4d4aa3b66705899cc272fbcd", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470001, "uuid": "8ecce9ec-a67c-4abd-9b37-4b4ef7a0b080", "comment": "Malware payload (Formbook)", "value": "a4310ec51cfc69b6b710d02ceda7376449480476cd08a60fc568290bd8f0c25b354efec94935648bd96b32390dfe67d4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470001, "uuid": "4889c4ce-f150-44ea-88f1-d6e73cdcfc08", "value": "T123041234C2CAB12EC9D9931690ABE49E1E0BDCB62FABDE5D885D78905F441C5B0FB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470001, "uuid": "666a3e17-eec0-4359-bd65-23a9f7fc752e", "value": "3072:MP7yJG/5GA2WJyuLSvd4LvvI+iXWcAh7lL3xR49PwoezPZxbxpXMO:MF/QDW0vd4TvI+KWcAT3xYoBxxcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782470001, "uuid": "a0ae0494-c845-47db-9c51-9032151f7b3f", "value": 189013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782470001, "uuid": "74fb8a92-cde1-4ea5-9902-76723b9e74f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470001, "uuid": "3076c923-6af5-4d08-a11b-1df32ccfd464", "value": "ADCB_PAYMENT_COPY_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393fd891-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493095, "uuid": "c7f1bc70-afa2-4543-8aae-080b7ba8974e", "comment": "Malware payload (Mirai)", "value": "aed80656a062f91c1843b06f05a43e65", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493095, "uuid": "dd54070c-dccb-4737-8858-accfff5d9046", "comment": "Malware payload (Mirai)", "value": "dae1ccd2f6c790b85b52c85351e4930e2e4306e695a642fa2b8fdf512a22b2a5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493095, "uuid": "5425cf9a-270e-480b-a04e-586c05cc4fc9", "comment": "Malware payload (Mirai)", "value": "bcfce4b9f472726b44b166da73235ce3267a48de", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493095, "uuid": "0139f96a-ce64-48c1-b2ea-ec74dfe2b179", "comment": "Malware payload (Mirai)", "value": "55975ae9352c7531eb0564452ef65144bec9466d46aaa213ee0edada6d0a76f7bd7f8d01285bd75c0639a0878e016782", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493095, "uuid": "7dde2384-e7f3-4fb5-8856-f5dbfdd90adf", "value": "T17BC31782BB43DEB7E55321F112F69B304A32FC3E5823D581E779BDA099614C0AA1677C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493095, "uuid": "806acd4d-f4c9-4c93-9d6a-651520d59351", "value": "1536:DAAbxQsERZWOQa5g257KDOt7n3NJa8r1No2tpVvtIwzZmkGEHdYFJVxE07Z6CSmL:PbesERN5vt73J1NvOwdFGyVc0a++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493095, "uuid": "790730bd-8097-4fc4-81ea-a88766b3acb8", "value": 127560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493095, "uuid": "1349aac1-36ff-4e60-87e9-b4c46e4f2ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493095, "uuid": "dcbe2d97-88d6-46db-95c0-d127b15d7ee7", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27543887-7160-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782479321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479321, "uuid": "35ba6910-15f9-4a8a-bb35-330b9fa0c88a", "comment": "Malware payload", "value": "3e3dcec5647f305e133ad11bef0ec2e5", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479321, "uuid": "d70ef8c2-0c37-4203-8b5e-6af16fb46a42", "comment": "Malware payload", "value": "db4a31dae409c88db23e509570ab549f31d4bd02a27e69bdd2dfdfc777424447", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479321, "uuid": "4ad2e4c9-45bd-4467-9bbe-7e909e7c8ed0", "comment": "Malware payload", "value": "f9bf1c4670d50b1244adb88b6140e5bad6e49e12", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479321, "uuid": "12c688c7-6a5c-4082-b14c-86a9d1875fe2", "comment": "Malware payload", "value": "0b87400acd0ab72fce78a8ac2765061042fd97963e96cdd1185a02ea1ea2a06a5dd300c9a60dd70c34ddc69e05ea4be8", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479321, "uuid": "478b7446-186b-40af-9f1f-3af0957b8cd5", "value": "T137C17DC0A2ED71B03B8FA8A6B74B9611C2B50113B0284CC87A5E1DD64FC9768E7B51DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479321, "uuid": "f8fa3f0e-1851-4ac1-a719-4a184b65b227", "value": "96:D6gsw0iES86+ZB7fisNs1IEx3AfV+oLCMWHZAnyfKr0o75BOnrSLEb4LyCa4Sb:DGPXZhisNs3yfg4CMW+nyo0o7+nrSLEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479321, "uuid": "8a0619a0-0264-4986-b928-a73f0273e4e6", "value": 5684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479321, "uuid": "1fc2b828-8864-4fcc-82a1-2cfaa91be560", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479321, "uuid": "33f01906-fc7f-42c8-a112-2534a2f5affc", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfb677b-71a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782510469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510469, "uuid": "82fb29e5-0180-4e7f-a063-b4a332c72b61", "comment": "Malware payload", "value": "5f56871b9b70e1d23cc87999ba25de8b", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510469, "uuid": "51c6a0f3-019c-4c86-b5e4-32750a20fa27", "comment": "Malware payload", "value": "dba680270005c06d212e4a5f5d632f363f563c9d0c00bafc7c1a43ec2de17f48", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510469, "uuid": "6214eb4d-a14d-425b-9cc3-07f8f671f2a1", "comment": "Malware payload", "value": "8da4f992296c82e3afe5df287607ed74c8d4ee0b", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782510469, "uuid": "0db0571d-6570-47fa-80d9-00fead734037", "comment": "Malware payload", "value": "9df7051cdc420e3b99b9cd3e1cdaa8111044fb176264a8abf8920e7d31d4acc7b8a7ef711d755618094e4046a690c4de", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510469, "uuid": "b7da48c0-5708-41bf-aaaa-70c6a07cbd4d", "value": "T11AE0E56ADA1DD553E63E89603C6B0B257CE6C89D8CA1E8D44014E1FB22D48917A9852F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510469, "uuid": "80c2825b-3045-45a7-857e-2f405dd83992", "value": "12:LV3dJrgPmzpmv3kvRHd431+3s3ptGadb9TAtZn:L1LDov3YHK3w3s3TGax9TAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782510469, "uuid": "357b4ca9-df4b-492e-bb00-ae294fbe2b69", "value": 435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782510469, "uuid": "8046bba0-8108-4345-9d1f-fb53f4b4bdf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782510469, "uuid": "b496f9c2-9f78-469e-ac7d-202570f0b511", "value": "DVSKZy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327a2c71-719a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782504251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504251, "uuid": "953f2403-15de-4ceb-ad87-8c3420b27499", "comment": "Malware payload", "value": "2ee382f0228244f1cbabb81d26ed507f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504251, "uuid": "aa831e0a-cc56-4798-9cee-11b890af687d", "comment": "Malware payload", "value": "dbf7bd71c9f72fc15797cbee3843127bb58008861cbf199181fc8d434a557e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504251, "uuid": "a792b6a3-9fea-4591-9367-6475d3aa622f", "comment": "Malware payload", "value": "066ef127006da5750c2556d5e39b6683861ec7bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504251, "uuid": "6c6708d5-5533-407c-98b8-df0dd26e9514", "comment": "Malware payload", "value": "8494ae954bb8471f3ef0feecf18773a3e5746a85acf75afa2c115f6103ff11a12129093a8aad4c8bf62da1afdcce1488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504251, "uuid": "5ca88593-97b3-48cb-8d13-b6b63e65ba26", "value": "T1528302A2411A0713E290EB753492CF21F5E8A6A6D4C763BE1A53B5DDFFA1610CC8D13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504251, "uuid": "6db97f7e-3432-44d9-bacc-7d0cdceaf9bc", "value": "1536:dqld0SkbNYoR23rUcifJg8CGr8siiVQjeQFEiTEIvtSbgP8SoDno:dqld0LBYscif28n3seA/PAbgPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782504251, "uuid": "a2b900df-6444-40a4-97fe-3c6ee9fd14dd", "value": 84436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782504251, "uuid": "a0aed987-b4ed-4049-a926-df67b25dc459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504251, "uuid": "3cb6741c-9ec5-4a7e-932f-df2391a45a66", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374e194a-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "f8c95407-35bc-4455-9d6e-7e69c3b40a1a", "comment": "Malware payload (Mirai)", "value": "0f77321358f361c78357b730c0db8bd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "cdac689d-9130-4c6a-9568-67638af3442a", "comment": "Malware payload (Mirai)", "value": "dc39e937b74ab6c4920360b2049a2cfd58306011b0011340dc60c48267c263bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "4add7f36-a02d-40c7-9d9f-5b459977c46c", "comment": "Malware payload (Mirai)", "value": "9abaf7f9ac3838fd93946c21f2e389436e02e869", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454008, "uuid": "5df58297-f928-4102-9640-7b4a0d760f4e", "comment": "Malware payload (Mirai)", "value": "d566c0c3f557f7972198280d78c907707788f73d005dd36200bcb306d0c7d56a7be5ff21af46aae3ea38aeddea2f3232", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454008, "uuid": "adab24c2-417c-4047-8487-fc55bf74b47b", "value": "T1F054D60A7B519FB7D46FCD3306F98B0128CCB45335652B7A3670E65CB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454008, "uuid": "b68c9e72-2595-46b4-bbc5-69c9344627f6", "value": "3072:5r8XEqqlQzmhMfC9oS/ZmtrMyuIHZTC7gqpUoCGtKO6jnRnGcLQJJ:KXtrMMpygYjKtjlLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454008, "uuid": "bfb7d4b7-2960-4e17-97e2-c6c1350ded59", "value": 305584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454008, "uuid": "e23bc0b2-b0ef-47b0-88b3-662ea836d135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454008, "uuid": "6ee829bf-7507-42c1-8b96-0d8334d52c93", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fd7d62-710c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443503, "uuid": "d1ef17f7-41c1-4168-a35a-50ec5c7eefa9", "comment": "Malware payload", "value": "a8d7a56eab057b1e9acb08c6591c8ab5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443503, "uuid": "1239693f-2037-4fad-af30-1735b3a9b3c3", "comment": "Malware payload", "value": "ddc0d8f4f72fd20994dea4e5804c1f87d3c3fa42b0915f6acd8a4510329907e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443503, "uuid": "2a598f8d-cc24-474b-845c-41bd3d26d88b", "comment": "Malware payload", "value": "1dc4042c93d082a64b214722b1d5d0cced7e2183", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443503, "uuid": "6145c56d-7ab4-49d4-97bc-ee7e3084d244", "comment": "Malware payload", "value": "d05a507af91f5f33497e57b7c693785f8132f9ded5226e77b8020721b2f46bdff23ab493051c490d1cbe324d98124c60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443503, "uuid": "bdd6137d-9bc7-40d6-bd1c-8445d02ddc7d", "value": "T16AE29D0BD4184AB287D26C0665A320E3514999EAD4F13FDCF73C64EB1E78E4CA366273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443503, "uuid": "8a33c12a-ede3-4abc-8221-2af2e61a8c47", "value": "768:geEmW/8ZoEOHgJRYIndFi1O8J9EDujUdY6V8GZwbtOMNu0tj:aUmaddFGJ9GGUFM0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443503, "uuid": "4be465e2-1391-459a-9f6e-e5e6de121e91", "value": 33190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443503, "uuid": "3b05eb70-2aab-4b1b-8f47-c48214bd6eba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443503, "uuid": "cc9fb55e-4eae-46e3-a2fb-404b0251881f", "value": "ufino.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b5ecb0-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479047, "uuid": "61907953-5b79-4d6a-aaf3-fbf364e329ef", "comment": "Malware payload (RustyStealer)", "value": "46c5fedb9cf3b4b7c83b97843a7d00ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479047, "uuid": "c70172ba-0772-47f5-b635-474d8c0af47d", "comment": "Malware payload (RustyStealer)", "value": "df19a218334f4c54bedf4b8d9636b05f42ddad96ac0633207aede90990da81a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479047, "uuid": "0e7b1561-173e-4fe5-905d-950629b59bdd", "comment": "Malware payload (RustyStealer)", "value": "50f348a63e65897a1f28cc5d41558832fcf2bed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479047, "uuid": "f6a84917-c6a5-486e-b7c8-9c35aef43d54", "comment": "Malware payload (RustyStealer)", "value": "5249aa85e06c33fc82b746495dcafc456828878a434446f39902391c686fba7221b1cf2c2ef329304f3aa0aaadcef76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479047, "uuid": "7e498f02-bbf8-42e0-87ca-bd04e8e500d8", "value": "T179167C03FA9582E9C49EC079C71B9233EB72B88D1634B69B1BD44A213F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479047, "uuid": "a04bfbc0-94e8-4c6b-9057-013b59cebe1a", "value": "cdd7ced0ab8379dc69be4b1c638655bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479047, "uuid": "53e8f2af-1006-4695-be94-d1bce5890efe", "value": "49152:8jztWH8a/SkFJs6vURPl5bwdCuIlRcap3jvq4AE1ogsLkq/gEBuxy2ua8cQj26zl:8jPa7IKxizS4AaoK94cM23UK+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479047, "uuid": "5bddbfba-c4e2-4a05-937b-477cc9b7e9e6", "value": 4215808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479047, "uuid": "cc649269-4625-47a0-882c-dade1ad36f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479047, "uuid": "711a19a3-1f6c-4bf6-9036-63bba061b183", "value": "df19a218334f4c54bedf4b8d9636b05f42ddad96ac0633207aede90990da81a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6cc325-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453025, "uuid": "e8136330-c245-4670-a56c-4cd0ac466e38", "comment": "Malware payload (Mirai)", "value": "fd5d09936d2fc3e162bb0be87d0e50f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453025, "uuid": "61b2f2c5-1179-4afe-ac14-6e25fcf47589", "comment": "Malware payload (Mirai)", "value": "df757c092b7c23bafa38c7c05a386ee45d117aae8b103ead056ae5765f0a7141", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453025, "uuid": "b826fcc1-612c-4fe3-9fb7-1a49ee3edda5", "comment": "Malware payload (Mirai)", "value": "84154e16457a98db384b95a780c5a1e34fcb2f64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453025, "uuid": "ac390d9b-d881-44da-bba6-cc43036767b9", "comment": "Malware payload (Mirai)", "value": "60cb56e59de5c09b5004edcd06552f9ce0d504df6fbca129b9cf06f533b5da59bd7c6e67c774824d0bfea6d5955e0aec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453025, "uuid": "c4274a07-3c5d-482a-ba2d-7211748d1fdc", "value": "T12D537D17AD25AF81C40284F8B9B08ABD8B13FD659C532DD5E46AABB55103EFCBC453B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453025, "uuid": "df961250-6e04-4b13-8655-3b59be61fd5c", "value": "1536:/SbiSRGcXcY8S7qZaVvzBTvINobcT5CmSa:1SBMY8S731vxcT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453025, "uuid": "52107db5-a792-4a05-8a3e-2f6a19ced29b", "value": 65244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453025, "uuid": "05a1078f-68fc-42e8-97a6-b4ca596e56a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453025, "uuid": "b5dce124-f905-48ab-8205-f3418a0a3d44", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe97914-7170-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782486422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486422, "uuid": "705d5eac-7949-4575-bc2c-6cab1485340f", "comment": "Malware payload (Mirai)", "value": "99c86b5ae8ef1416021b6a965cf1d419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486422, "uuid": "4231c059-442b-41d4-9a33-c9d780a4810f", "comment": "Malware payload (Mirai)", "value": "dfaccd5a0836d7a1e74d89e27b522bd4e2332b4f25f23c4b69c0ec0a07fe770d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486422, "uuid": "17ee136f-097e-4420-8cc5-0cb58f016457", "comment": "Malware payload (Mirai)", "value": "363063ee6b050eaa5b5f747a0308c0c7bc8936fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782486422, "uuid": "5eab8435-6ae8-4f59-ba62-9279cc903e37", "comment": "Malware payload (Mirai)", "value": "81db8e3f4203c0539c13e3508567bf7dc5e172e90bed6d16363354c316634f22043f942641644b54d885cf18d52d5d04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486422, "uuid": "bec28f43-813b-4faa-9736-eb4fe1d3e8d0", "value": "T102C3AE9BF64B2851C96546F10BCB4FED6E7370119E2B98E32C0D7A3B6E751CB48123A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486422, "uuid": "e59f469e-b3ed-40bd-9f4d-d0536f95ed7a", "value": "1536:4bJoTVxk3xcJp4DCOqjO8wPUxF0DkGpATGKiI0/BMkTsF7ig7/LW:4tink3BFUxSQdGPBMkTsF7ig7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782486422, "uuid": "deb29dee-00b1-4573-b6cb-215e2be6988c", "value": 124280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782486422, "uuid": "e6798411-1ed0-4bf2-9c4d-9d24f3b4fa56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782486422, "uuid": "9d244ef5-8f90-4289-8819-0e4ba551cf94", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e244a8-71a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782507135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507135, "uuid": "8e931a23-37c3-4ee0-8799-d455375da931", "comment": "Malware payload (RustyStealer)", "value": "a725c940cf743957fe8d061dee5e3509", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507135, "uuid": "2992ce7c-9593-4616-a47e-6d9fde0ca1b8", "comment": "Malware payload (RustyStealer)", "value": "e00cd20d10209b8f2744523ebeb5932bdbf969dfee9ceee9aa659c0b10e3369f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507135, "uuid": "ead08db5-d4ae-45db-9fbe-78d6c3e36ec6", "comment": "Malware payload (RustyStealer)", "value": "3526b193e70eb708c42c8393550a0db7a74d142d", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782507135, "uuid": "55a8b590-35be-4487-958a-0dd2d04f60c0", "comment": "Malware payload (RustyStealer)", "value": "5aa7927651ce20a718b81d17229ddf24ed33d62b9947c7b645cdd8dd31840ad9bed63c05c112c9e7a3f2903a3645bc74", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507135, "uuid": "5849db6d-afd7-441c-a091-429da810ca70", "value": "T1DCD53360110FE7EBDA12AC30678607E5931416CF1BCD601A3DAAB6F4A9736F22376746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507135, "uuid": "13742c0d-b9fe-4152-bd3a-a833c4223a6c", "value": "55efd29c0f070c5d716b6d37ecb2ab4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507135, "uuid": "f60ba0ea-8597-4b23-bd70-e6a01b93b83c", "value": "49152:pCIWqK45TFK9ficehbhOliFDXyz2N6CStMOAY6dKynsbU5Y7kAEnSL5r1u:SqK+09fhehsmCzl3zAY6AqWXE85h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782507135, "uuid": "cbe7b227-8d8b-4e30-8acb-a5ba9fb4dc06", "value": 2826752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782507135, "uuid": "3beafa78-5d37-4686-b0eb-aed5ce82cd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782507135, "uuid": "87d94253-b21d-4117-8a42-6dec3657f925", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d45505-710b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443071, "uuid": "76da0e63-6fbe-4396-8bf3-daa531c94c55", "comment": "Malware payload", "value": "98633c1c935670bef0e9661f6a8d12ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443071, "uuid": "9edd625d-0a03-40f8-ab7c-5fc81c4d305a", "comment": "Malware payload", "value": "e05a2bd3f42fd0ac737315878a945b0c902f91691cea0e71d01d7f7a343cc457", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443071, "uuid": "cebac570-de10-4644-bad5-50044eda87c9", "comment": "Malware payload", "value": "798838e2b6ca798036624e4c647ce86ad9f551bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443071, "uuid": "fb01406f-62fc-4f59-8862-e479a9cade72", "comment": "Malware payload", "value": "ef0f8d3875e3b3fab045a3ecc34f54237227aeb6ec241ab8072187ce89bf99145b65759c1832bf8af0627cbba48d8c56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443071, "uuid": "df0bddcc-7f6b-4abb-9e6b-5c0f1d234c87", "value": "T1A6E29F301A30ADBA8ACF79D990FC04E8C75F72E31EC789AB1765F8650E4951E93592F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443071, "uuid": "9954169b-8ed2-443c-8219-bb52f21b17ba", "value": "768:Xhvb1dT2iBoGMt59IclMzX89lTGeB64CLljTfX3UA/nyzvbtsMNu0tV:nBoGMozM9lT01CqMEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443071, "uuid": "c50f6418-0d0a-4bad-85a2-c4362d10d90e", "value": 33190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443071, "uuid": "9ecfbf59-6627-4430-8568-36b642c94585", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443071, "uuid": "558803a4-d751-428b-a04a-40a381dedbe0", "value": "ufino.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafd73d5-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478817, "uuid": "41c3cab0-b1b0-4bb2-b35a-28fd48c7c0da", "comment": "Malware payload (RustyStealer)", "value": "af206791419453501fe13d086252f629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478817, "uuid": "6df25f56-8a44-47fa-8be7-53d04ae74fc7", "comment": "Malware payload (RustyStealer)", "value": "e09d248d6bdb9485c97ac15eb33c7bf6ae991d1c3a95f5c51e7bf1833639b96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478817, "uuid": "901abaad-73f0-41ed-af8a-fc3385670d67", "comment": "Malware payload (RustyStealer)", "value": "9c29b28dfbc33d42b1050215094260023de75fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478817, "uuid": "8b97e634-89fc-4860-b39a-a782a7f12da3", "comment": "Malware payload (RustyStealer)", "value": "c03dd9de6513eed8b430b2a63eb6213277ebeeb4895715a2cd3eedcf0fbcec4492b2f7939b0217bd133c6efd7a4c9ccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478817, "uuid": "8e3e6b7b-f811-4a1d-a6d4-333fe83f2b03", "value": "T1A6166B43F6E581E9E45AC03CC31AD223EBF2BC8D1620B69B57D4DA612F53B605B5E324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478817, "uuid": "c4e61976-64c8-4ef1-8ca9-6d9b7ea0e2de", "value": "49152:Wn+728XtUzS1oGz5tjWk25lV9dGe6QPv/c9VWBFbE+Jf/m+OZdaSSwvkeNwDHbE3:W+7tXc9kK6Q/TFbTJ/iYTbUUWn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478817, "uuid": "9045fb1a-6e4e-4ba2-8183-99c8a3ba5c26", "value": 4243456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478817, "uuid": "efcaa14f-91e5-40a1-aeee-905389729b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478817, "uuid": "37d43b15-68ff-4d29-9332-885b416d32ed", "value": "e09d248d6bdb9485c97ac15eb33c7bf6ae991d1c3a95f5c51e7bf1833639b96c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d66e6e-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479070, "uuid": "fe345d24-9e59-4afe-9db0-5ecdd6a1df91", "comment": "Malware payload (RustyStealer)", "value": "9e264537de2b12881f8b51f624a48d93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479070, "uuid": "ae01b9cf-09f5-4bf0-995e-8b189156bb00", "comment": "Malware payload (RustyStealer)", "value": "e12ced95e4aaec4ed32823d071236a04bdb9fb04c60fcbfcfa4eb8488f14d938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479070, "uuid": "2105d40b-1de7-42a6-9d90-03ba8af9a3e9", "comment": "Malware payload (RustyStealer)", "value": "89f767809c3856706fb02de8eb55829405281504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479070, "uuid": "f0fc7d43-c5ec-4747-90a6-f2a69f518d8d", "comment": "Malware payload (RustyStealer)", "value": "f7bde90071becddf1fac9c2372a0c94379358e1fb083a93b695c17cebaa19b972d83c6409657bb0e0abea90b87d696f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479070, "uuid": "86598318-0b8c-4e55-8cf0-4e4927ab753e", "value": "T1ED168D03FA9581E9C0AEC139C75B9233EB72F88D1624B79B1BD44A212F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479070, "uuid": "11f6c0ce-e749-472b-b7d4-abb440de8f9c", "value": "b512af67eb97253e02164083e7d1aa64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479070, "uuid": "7e0cb888-91c3-40b5-b463-fbc8bd602c3d", "value": "49152:A/ZP9U+uXvw9urPEk27lUzp53jzh2wXiyfQU1ogsLkqcDaHPYC1jxqhyAHdGid6C:A/DBuRVfhP7fQqo0CkyIGFiQHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479070, "uuid": "3c985d68-9c1f-414c-a479-a2cb8a1b7cbe", "value": 4210688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479070, "uuid": "8411fea0-a726-46be-9fec-fe82ad1a3c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479070, "uuid": "d1775fe2-f9b7-42da-9c8f-4fde76a84cf0", "value": "e12ced95e4aaec4ed32823d071236a04bdb9fb04c60fcbfcfa4eb8488f14d938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2830dbb8-70f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782435084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435084, "uuid": "8d29f720-1ad7-496d-8ef0-313de222137e", "comment": "Malware payload", "value": "eef3cf31bb13fdc60ef08cd45379392d", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435084, "uuid": "aee61f62-b3a1-4e34-9872-205ea4cdc625", "comment": "Malware payload", "value": "e2167e5191c46e91b9a73fe36e18f8be93bdabb0435975b61925b26930e3ca7c", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435084, "uuid": "8b9a8fa5-0eee-4a1a-b0ea-e3d06102a9f5", "comment": "Malware payload", "value": "b6aff94a80c60bac2a5e611d60e636603b5ce7d9", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782435084, "uuid": "e73ca2a1-d806-4170-bf4e-b1fa645a0685", "comment": "Malware payload", "value": "8fca90568dae12db745ba674670293993aef132c077f21238895f1479ab0bb328c6a072c88a94cc049f71c6af79eea46", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435084, "uuid": "53681098-32cb-465a-b7e1-dc2365014bf1", "value": "T14E146B0923E91192F4B26B7099F602834E367CA3AB7582FF1784957E0D33AC49975F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435084, "uuid": "6b5b9780-479c-4946-a7af-07e1a9321910", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435084, "uuid": "d533f332-2748-4f2a-a178-f62aa4bc1173", "value": "3072:/RLiJRaxQRsgLY1c5GWp1icKAArDZz4N9GhbkrNEkkZFbxwy:c3axQpFp0yN90QE1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782435084, "uuid": "4a715358-4a14-4e0e-b5b1-8e8eed2b2078", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782435084, "uuid": "31e6a60b-45be-4dca-b7c0-89bc6b746f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782435084, "uuid": "34cd0a2d-f2ff-4e98-8608-8b507c31df72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5766d8-7122-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782453021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "e0308577-4931-49ae-ae0c-f8bc1158b89e", "comment": "Malware payload (Mirai)", "value": "06152a065f255ad2d8b64a94fa26ed95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "180b08bf-6b3c-421c-b5a3-da9463159298", "comment": "Malware payload (Mirai)", "value": "e2e9ede69db21b7c03b2e844e9f4fd7a5308e1596a5cc4d142523bd9f9b4db77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "ab3ac015-210a-41bc-9161-c0ccfbffd658", "comment": "Malware payload (Mirai)", "value": "82e883b22c9c06ee295dacd9d80f55da8d201151", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453021, "uuid": "60336a37-c320-4d94-8434-bf8fff1204fa", "comment": "Malware payload (Mirai)", "value": "046c249f7bd5e90b8cbf2ce1f0cb845269f0f3591ace1a60208449c682f338e8b081d5dd527ffadbdd96cbb24c4435dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453021, "uuid": "f9918d90-bd08-4c33-b66e-87feabaf6601", "value": "T176B3840B7F606EF7E81FCD3745F15B08248CB41A21983B75BA70DA58BA0B95E49E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453021, "uuid": "dd2a5cb6-80d4-450f-b9d2-9cd536fd5ac6", "value": "1536:FWa60gQG7GQnWttSWa88NAjbv68UWX+OHLu76OhZ4G0waBe4X:X6JQG7GQnW/SW8NAjbv68Ul6ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453021, "uuid": "8cc665ae-3705-4e1f-810d-ea0da4cf5aa6", "value": 112124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453021, "uuid": "33d6e6dc-e05e-470b-a4a3-c977ec299d8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453021, "uuid": "8dd1ba32-71b2-4a55-8db8-70cde06d7e7f", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6176133a-715d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1782478130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478130, "uuid": "f501d840-16d4-40a3-a0d2-511c14bc49bd", "comment": "Malware payload (Cobalt Strike)", "value": "1f65544978b8ea0e745e573b8ee9684b", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478130, "uuid": "53cd34e8-0f45-46df-a331-49cd383f487f", "comment": "Malware payload (Cobalt Strike)", "value": "e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478130, "uuid": "93f2e18d-c52f-406f-9b17-b14aa8fbafd4", "comment": "Malware payload (Cobalt Strike)", "value": "139c7a9f824bcf6db4407f38413ef817ebef64a8", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478130, "uuid": "3139dcf9-6c1e-4faf-96a0-92fac35910b0", "comment": "Malware payload (Cobalt Strike)", "value": "3228fc2c2a3160f5962195c79522b16c4a9d4396433ce30dca3a366d52a49c14bd8cec5746dfef84efae3b172b94704f", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HACKTOOL_MinHook_LIB", "colour": "#6D85B7", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478130, "uuid": "7c09a6e3-4b4c-444e-be8e-98aa893d1c7a", "value": "T13036AE85EBED44C8E4AA9076C927892BC673BC541235431F10697F5BEF733120E1EBA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478130, "uuid": "46b1fedf-278a-4bf8-82e8-8b32a4980b63", "value": "b42283faf0bbe2d740256c829c91a237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478130, "uuid": "f5b971f6-33ba-41e4-b3b0-f07d53ef7fc7", "value": "98304:aZNPk6sokUUS5iWlAXIxKWX/XBYFLOAkGkzdnEVomFHKnP:adsoXiIQEfBYFLOyomFHKnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478130, "uuid": "73de1b60-8127-4bc5-9b23-b808bb57fac3", "value": 4982584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478130, "uuid": "1c3ae453-8219-413c-9510-28a5aefc174b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478130, "uuid": "497c6b69-fa5b-45db-aeee-fa60cc54318e", "value": "e534d9032141555d21be8b23f30d8f6dd156d61e986bbeed019d9316973b1ba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed994cd-710c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443498, "uuid": "9366c031-446c-4cce-a9d2-e477565c8cba", "comment": "Malware payload", "value": "e2d3c355e39f6c47e0428311e859973c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443498, "uuid": "320e0abc-1272-4d1d-b2d1-6b03fe8b7de6", "comment": "Malware payload", "value": "e605f39e2e9595c2418ad436b48550c17f699ab45c285c605806a9cec4d503ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443498, "uuid": "79d55fb7-d725-4571-a5fb-dfe6b46ea56a", "comment": "Malware payload", "value": "ea948a4b9e107514832f42abea91d682ccb966c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443498, "uuid": "b54db96f-ce87-44f3-bfc6-b8be647e2d19", "comment": "Malware payload", "value": "5b0ebabc1fc9def2d3ec705f9f43bc22e78befc36b3afcb054121cc3e0bc5e3fec0f34350f4ee837cdda3a64ecdb1470", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443498, "uuid": "01063918-c359-4a97-9fe9-657f27e31cd1", "value": "T17133AE213642DA1EABC32D6B9F114592614DD8E70CF5E35DD30F83CAAE4498CEA752BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443498, "uuid": "014e11b3-5ed9-4ee4-8c72-0157e92b1a28", "value": "768:tB/HYiY3GjjruGS4zlo/snNzHCBlngUauszO5AopGKioDhlx5AElcpRbtzMNe0ts:t1YT2jjwmppCXnXGz0AyHiglxGEloMEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443498, "uuid": "5af69586-7471-48a3-a9bc-fd5ecfd74fa2", "value": 52718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443498, "uuid": "88598df3-a7b2-4679-85c8-941642eb210e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443498, "uuid": "8515d533-88ab-4ca4-a095-3848f795a2be", "value": "ocafa(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a512dc-7135-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782461008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461008, "uuid": "6af85b5c-497a-423e-9764-9cf40023d836", "comment": "Malware payload", "value": "3cc368ce8863c09a6d2e5938acec3317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461008, "uuid": "66cf8b40-ac9c-40b9-a94d-67dfdcb86ce4", "comment": "Malware payload", "value": "e742f18aa446e60304cdb6969bfbd197da48997e011636b3722e60628bdeab7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461008, "uuid": "6ce2b4fe-4366-48b4-b318-049e11510ca9", "comment": "Malware payload", "value": "9ee7336f0cbcf6f675832378faaa6c5045a24b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782461008, "uuid": "704fbc69-8cb1-4720-b849-8d16a249767a", "comment": "Malware payload", "value": "a9e8782fa1f02c9c35422cb365e4ee87c917b0604f195dd2914ac7a2ea82d9a80d626eb0e19bef52d878e98e61bee6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461008, "uuid": "352e8ae0-3fc5-4bfa-a2bf-6f648599fca3", "value": "T1EB245A81358C3E5EE3A76D3DC542991AAC0CCF147842EE2250F9FA4719B7ADB0F3A585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461008, "uuid": "b6c93465-feb8-413b-8ff8-960cca6357c3", "value": "6144:14kQCtPTLUoJrlWeeQz7LKkG8ryw/nvf5ZzSSJ:tLUofy6/zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782461008, "uuid": "e64ca676-d30a-4b0f-815f-5b021aa46863", "value": 226204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782461008, "uuid": "f528418c-dff3-4982-8746-a4923fa6289c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782461008, "uuid": "62058896-3d94-4b65-9acd-8c305e61faf1", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c736f6-7111-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782445549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445549, "uuid": "f26639cc-9e85-4595-839f-a91ae687d869", "comment": "Malware payload (Joker)", "value": "f2f708cee06d0c03aead6b0bf37009ce", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445549, "uuid": "17b46870-4fb1-4c64-a202-e39fb171c6fb", "comment": "Malware payload (Joker)", "value": "e759a82eeb018243cf1e9587cff8643b36df4e0f84f18c3712ae60dc5912be10", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445549, "uuid": "87a1e4a7-15fa-4b2f-a386-c1a717052ebf", "comment": "Malware payload (Joker)", "value": "faf77edacc962a589e81814cc4198d617b5ba799", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782445549, "uuid": "85a29df1-3a5a-4f4b-908e-42cee6bfe9f2", "comment": "Malware payload (Joker)", "value": "4109b11792dadc581d3118557ccede699868e8e9327402dd47146cb375b41d5569b2d5a63d05ac3c95f63b69d97fcc2e", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445549, "uuid": "d25c1301-c40a-4403-95ad-f022d70805bc", "value": "T1D5268C23FA531D76C8EC9374953B03892375658ABA03471B5008EEF5AF9F1C07ADAB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445549, "uuid": "7b9528a1-3841-49ab-8734-43f35d6fefd9", "value": "49152:8DvMHn0bqqSEXYB5V9ADVT+Vya8pjsPcnLtZC7UrNTN:1sDskbC7UrNTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782445549, "uuid": "1df0f637-cf26-4f64-a297-00ca7cf20cdb", "value": 4816220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782445549, "uuid": "68614191-eac1-4d07-9740-7f408a1cb17d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782445549, "uuid": "ddf984cd-21f4-4ca0-8e95-181979611644", "value": "Quick+Junk+Clean_2.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03ad044-712a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782456385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456385, "uuid": "54e6b691-70f0-4c39-9d7e-1b2272ddb6b7", "comment": "Malware payload", "value": "49b249c4870bdf84516516c47df75fd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456385, "uuid": "e2e1db94-3a45-4c36-a589-faa7fb7df39d", "comment": "Malware payload", "value": "e891368efbc94d136b540425db620c40a5acd1c9bd61ae1b57023a358357a8da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456385, "uuid": "d3fee365-df48-4902-8bea-ef4a26913e36", "comment": "Malware payload", "value": "6b429489eb8a54a1e8e165a6f2f6f8349660dfd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782456385, "uuid": "3a9a626c-0951-494b-b0ce-db7f8fc6c96e", "comment": "Malware payload", "value": "9fce364da64f49891d6f59d7b96a9d4fa4a2ac3c3ae77e1895a698ed9841fb03f3134eb50248767de931561631abc4a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456385, "uuid": "b18bee46-1d66-4298-ae2a-f9fa5964c7f3", "value": "T1AD831229134518E5D62685F193FD1B84BE581F69CEE1EC147C12BD89EE333AD3CD2614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456385, "uuid": "c2256cd5-3e53-4b2f-9c4f-41287e6029be", "value": "1536:yYI0XRqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI0XRqw1qAEv7UIFM8oJorFquyjkRks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782456385, "uuid": "0f210e69-eea0-48b7-9713-a15d3052bab6", "value": 85232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782456385, "uuid": "b6a9c3e6-9592-42be-bdcb-da65175c3da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782456385, "uuid": "79bfe286-b123-4f31-bd97-39149c4fa179", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7876da37-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479028, "uuid": "d19d5f0b-2801-4fee-8fcc-96fcfa6afa70", "comment": "Malware payload (RustyStealer)", "value": "1c2e3acf98bef526aa633a7245eef3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479028, "uuid": "c067f4f6-5f01-4c38-88ad-2c629ae839d4", "comment": "Malware payload (RustyStealer)", "value": "e8fc72b7fd7a2f5736e4c076f08753e5a9eb65d76571883a6466b764d68b3b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479028, "uuid": "d1fb397f-7143-4576-bcbb-50a9365836aa", "comment": "Malware payload (RustyStealer)", "value": "78208a0c779e8ebffe9fd860106c263fdcd484e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479028, "uuid": "70070234-c6cc-4293-bc61-a5298ef6448b", "comment": "Malware payload (RustyStealer)", "value": "48f7e2524ae771d5911aba4e6ba1009aabacae4fdee8cc1b51a083971bba506ebb5d9e3ddd2da1e4228a18e6361ddf8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479028, "uuid": "d283531d-6fa2-4aba-871b-419060c57ffa", "value": "T1B5167D43F6A5A1E9C45EC178C72A9233EBF2B88D0721B79B2BD44B612F57B601B5D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479028, "uuid": "ccb97e29-f497-47a1-919a-7af3a8925556", "value": "49152:gYqGJaLNcwf/KVVff5ONkVSyGSq0M+PAE1ogsLkqBW7eaok40dKtJoq9cWI4u9qS:g+av8VztvVPAaou1UJxcwKq8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479028, "uuid": "013bc565-1799-480d-b850-80f1475c4cc3", "value": 4218880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479028, "uuid": "dc090fe8-baba-4cf2-b4fd-51b54458ac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479028, "uuid": "a1909fef-5fa8-4850-ac6a-9bd4deb38275", "value": "e8fc72b7fd7a2f5736e4c076f08753e5a9eb65d76571883a6466b764d68b3b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da9b116-7164-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782481103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481103, "uuid": "26b002e9-56a2-49df-855d-d2abc0ad35e6", "comment": "Malware payload", "value": "f78f0f97cd6bafd3f9cc124d91aa9739", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481103, "uuid": "2c786ad2-8191-4ebc-9abb-40e49054ddec", "comment": "Malware payload", "value": "e98dbc9cf08e13a90c0112c0300b168e84c593c1c95b0a8b2e8b215c1816670b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481103, "uuid": "e6007ca8-983e-44b1-a198-d94771d77414", "comment": "Malware payload", "value": "fb08675629a6a2e5e511027844f657458778acfc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782481103, "uuid": "944ab28e-c230-4af3-b6e1-e20e7de5d192", "comment": "Malware payload", "value": "1df3af68601e82f3edec69033cff6566a6d269d70c8d3782f6cfe1f725fbbea3eb2962b5f40367af9d2b157ee9f9060c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481103, "uuid": "a8ad6e96-4f4f-4c56-808a-03efca9b7dd6", "value": "T1CB21D6E4FCF0D532F04C9F28B05851D458D72DAF62983DA8E4867C22945D944B09F739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481103, "uuid": "9dfa9cb0-075e-437e-a09a-a02151b07180", "value": "12:U+0rQmQtbFsKKlwfYfEZ2fE5F6k7fEMfZfE6JfELORfELOZi+ifEL4vfELYKdgfz:UVQmQtbyKz0DWrjXXGLDxbEe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782481103, "uuid": "fb1804c8-a605-4b81-a9c5-8499555da59c", "value": 1268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782481103, "uuid": "3a0ba7ae-5cc4-4eba-a0c3-fc983ae29e17", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782481103, "uuid": "3f1d548c-93bc-4c49-b87b-0aba7d976cf4", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb60a533-70f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782434123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782434123, "uuid": "7559e3ca-8b7a-4c65-9998-2db235137882", "comment": "Malware payload (Mirai)", "value": "63a4891f6b5d58d90327e874f2ff9fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782434123, "uuid": "5f5253b6-62a6-47e1-ba01-18b127eddba3", "comment": "Malware payload (Mirai)", "value": "ea47c0cf85318989bcb625474229bd9b5ab0263f8a79eb6231b44c3a0ca6bf25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782434123, "uuid": "bc4317cc-db4f-4dc8-b828-86a560bb8be5", "comment": "Malware payload (Mirai)", "value": "67df9dcff1fb2adc759705a1557757c14f4e847c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782434123, "uuid": "9768248b-d8be-4512-b1f6-0abae39b2651", "comment": "Malware payload (Mirai)", "value": "80ce65cbcde2768711ddb26481a34c8c457cbd552b75f31be47d11928df5c8612a48d3c2ddfeef8391240f03b8b1c403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782434123, "uuid": "97a9de2b-a64c-4e6f-b2c3-4802a8d76136", "value": "T177157C9DEB87E0F1F26300F1025ED7F64634A1265013FAF6EF49266774327A16F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782434123, "uuid": "71fba661-98fd-4a8e-9a9b-b5fdf9fec8fe", "value": "12288:b4WOqg/9oh1chNPGotY9S7WzRLp8HNPGRtR7KS4mla98lnJPLPy5/pF6WpiLzJ9L:U/qXh1chXt77iLpmu3R7lTaSFJwpFdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782434123, "uuid": "b9187717-b13e-4dc0-857c-e8d2f0f0322b", "value": 930776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782434123, "uuid": "0f80866a-89ce-4366-a450-1f0a5c5ba9bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782434123, "uuid": "17f9990e-bcde-4957-8d0e-d7813aff089a", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec6f1d7-713d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782464543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464543, "uuid": "ab5c5827-9056-428f-89e0-9f4307df1e2c", "comment": "Malware payload (AgentTesla)", "value": "7f2e6457f365f53aa262c61835cbb0e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464543, "uuid": "07a68b91-2662-4d09-9562-357c2c261f33", "comment": "Malware payload (AgentTesla)", "value": "ebcd88eefbf66c311687c5daf861d92752502d093db2061730cb466cabcece7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464543, "uuid": "e723193d-0d1f-497b-8205-fc49619d1b9a", "comment": "Malware payload (AgentTesla)", "value": "2e48d84a2e8d87c48484dbe28eb3224a474d4904", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464543, "uuid": "f6580166-b3fd-45ca-8572-c1a741b4ae72", "comment": "Malware payload (AgentTesla)", "value": "93c553179c645c3ebf30d283668ad59f535a7a1b0cb079712e06e7fbb550ae8b7ba7f6adc620196e7bae177b66beba61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464543, "uuid": "1c4b9aca-cb3b-4a64-90a9-0395172b9bcf", "value": "T1F385285FCB879015987F58A5FCAAAC028C5DAF211BEFA409D0764ECF5323D4E89B091D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464543, "uuid": "4ff47302-254e-4c42-a670-8b75105ea1c8", "value": "12288:FMPZJGqiwZKaWkT6t3tPsM4CKEUHpPMZ/zLtJVrHPaolV5:+M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782464543, "uuid": "4458904f-db66-4b75-a6e2-93d0ef3cc077", "value": 1858308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782464543, "uuid": "034d1e94-5e83-443e-8941-6346411db43f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464543, "uuid": "bc537080-b6cb-4631-80d6-1ab6dbf4c0db", "value": "HSBC_PAYMENT_ADVISE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0c20d6-713e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782464729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464729, "uuid": "ec4be015-a01c-450f-805a-c6cf81253119", "comment": "Malware payload (CoinMiner)", "value": "4f2f30ee98d1a62a5c24a204e8d294f0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464729, "uuid": "ee2e8229-e218-4fda-878c-8c4612482374", "comment": "Malware payload (CoinMiner)", "value": "ec141b4e1d603702f50d323d382bca4060950d8a4b5034a064096ff4f00fcdb2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464729, "uuid": "6ae8e779-26fb-460e-9877-a18e9b70692f", "comment": "Malware payload (CoinMiner)", "value": "b95190f4e2277702b2aa1185a1f2845bb4644f85", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464729, "uuid": "abb1d06f-2c13-4a01-b8f7-58bbab97bad1", "comment": "Malware payload (CoinMiner)", "value": "cfa122cabf92a54e103b8f98291ac10f92e4df3dff311e0d223246febc8aab05a6ebea648ffb02513936101b5930d10e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464729, "uuid": "a404ff62-c17f-4929-87fc-e77a8e9547ea", "value": "T13BA312E5AD1B5D81EEB3087FAF324F00B73548B40072A066B65943BBE8278D741FA725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464729, "uuid": "24776a1c-42e0-4f9f-9a4a-65e7c389961f", "value": "1536:PWyNk/iVGj68HdnMcaOImrHcP8ZBqTwB4vnuUjbrpGyfpiBkyJTh1:+yMu8HdMccmrHM8uwB4vnpboyhYkeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782464729, "uuid": "87a1d207-67db-4b76-bdf6-f5d3190682d7", "value": 100520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782464729, "uuid": "34c243e7-f66b-497b-bd02-15ed034c2cce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464729, "uuid": "455d11af-2019-4b2c-b1e4-21b98357a36b", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc02147d-710c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443493, "uuid": "d259637d-8705-4694-bbce-1078c15618f3", "comment": "Malware payload", "value": "6eb83219bc884dbd975a7a4eb1d21bb4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443493, "uuid": "02582d02-b679-4aaf-bd6d-745cca814ed1", "comment": "Malware payload", "value": "ec35097f12a2438b5cd17e87d7957a30ed4397906a6b76f6c4bb735bb3457851", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443493, "uuid": "0cd06589-55a7-4fa4-8660-5ba6d548d653", "comment": "Malware payload", "value": "d5254e6e5d11153558898364f52b86c8af987c53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443493, "uuid": "ad4c24f0-69c1-41fb-9880-2ec813a5025d", "comment": "Malware payload", "value": "fb72e05e6ccf4cd5ad9a2811273af8776ec588ef25729a42525092edb22c655e5621c2c3a04cccd5f045b1863d6e544c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443493, "uuid": "707534da-93c6-4989-a222-c1d007c16724", "value": "T17F338DA1A740AE78DF8D39B2D5E0526042EC2C6308C4D76D3F46662199CECE7F9CD53A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443493, "uuid": "352384b7-210a-409e-a1e3-19b0bd7a667f", "value": "1536:UbYY0D8LoonSj3nJBQr48F5BLZrdkQfQ09oM4b:yYYu8LU3JBeR5JdT1aM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443493, "uuid": "a220e0db-090d-4d92-8006-c375e99d1b2a", "value": 52874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443493, "uuid": "cea3c6ef-5bb9-45b2-90e7-063e4dcd23d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443493, "uuid": "9fe107fb-2403-4c38-a41a-61bf755bf6c8", "value": "ocafa(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ab34b3-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "7a9b6682-7ed6-4eaa-b023-2680997b3708", "comment": "Malware payload (Mirai)", "value": "9783f9417468600c0ccab63593db7ddf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "b0eb4116-9e5e-419a-b429-e65d8897c553", "comment": "Malware payload (Mirai)", "value": "eee1faae2ab53f955a65f836bef28b91bee014727c172776dd0e820316a4164c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "f6520d28-d994-40d8-9aa9-9fef67bd0569", "comment": "Malware payload (Mirai)", "value": "f9dc82ed8706a7b2f53b411fb92bd46a30af8a2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454005, "uuid": "1d9e62f2-500f-4797-a82c-f27696ac481f", "comment": "Malware payload (Mirai)", "value": "ef97ecd02736ff9a0659eaa73141aaee6c3742e1b765e897fca68a8d5be904345d60766ef8f48375c4c847f838478e56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454005, "uuid": "252c4d56-6208-46b6-934b-3384e74dd7d2", "value": "T19924E947B991CF12C1C111FEFE5E418D37136FB8D2DA72029D24AFA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454005, "uuid": "764889b3-ec25-461c-abac-02489583bc85", "value": "6144:xmMWDAzSf4sXLCloq+RaPiVv5L5FWe9bmhSjLr2:xYDd4sXGlgRaP8bWetmIjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454005, "uuid": "2ac2ea07-e435-44e4-bd15-6088cb7acb22", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454005, "uuid": "42b81971-8dd0-41af-a8eb-1e40bf49ade9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454005, "uuid": "4649b5f7-8273-4c3a-951d-08a24b134d40", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcec02f3-7124-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782453856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "3f7759b2-580c-4f67-a620-546477b1cc87", "comment": "Malware payload (ConnectWise)", "value": "7c59544ad247f0cbca89043d411b96cb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "becf517d-2896-4838-be2c-8179cfe9542b", "comment": "Malware payload (ConnectWise)", "value": "ef88f3c678809afab4b4e07c76dc1214ed691d92a4144df1455a3ae9da977d9c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "651795da-adf2-4499-8fec-b91b1e03a46f", "comment": "Malware payload (ConnectWise)", "value": "568bb9d42ff84944e3ada61a0b47345785bb9630", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453856, "uuid": "18ecd5e4-1284-433e-b095-5b185b5139aa", "comment": "Malware payload (ConnectWise)", "value": "e3def0b02bfabc635dde8af3d3e46a7795b5f737b834e461b3e016b553ce2725ff5ce27d1819a5f8dc22f6ab2ab1c880", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "daf16e74-d9ce-4838-a7f5-ebc24fbf32cc", "value": "T13646E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "ba30b9c8-5520-40e1-94fc-bfb59b8ad155", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "ade450a2-737a-42ff-963e-3074a74afdfd", "value": "98304:3zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:3hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453856, "uuid": "462288ff-cb99-46ae-b945-4ebd688eb3f0", "value": 5642976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453856, "uuid": "55f278b3-661c-4899-8784-d866cd065284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453856, "uuid": "2f7a4353-fb8b-4b4d-a83a-a8163c5cbdaf", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38760a04-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454010, "uuid": "cbd8bdec-8ca9-40bf-8826-85928f534900", "comment": "Malware payload (Mirai)", "value": "973402085912c3c149197159b0a7c20c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454010, "uuid": "1d961d3d-cc76-4cab-bd87-1bb595709ca9", "comment": "Malware payload (Mirai)", "value": "efe6b8fae7090f98d49f1a5d63e5248090341be38cc158e451c7bd3bd23d564c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454010, "uuid": "1cfb3fca-12ff-4772-b4d4-6a548405984e", "comment": "Malware payload (Mirai)", "value": "8d97ff470a94f135444ec480200381acd5573131", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454010, "uuid": "63a547f5-d5dc-40a2-b0fa-518f5b1f5025", "comment": "Malware payload (Mirai)", "value": "2f73092555278f07f2e73c9cb4d12114e6318fe6d66eab156f1c8fd99df85af769c11f5fe38b67244e50177131c2b2a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454010, "uuid": "031e817f-b7b3-44b1-9a5f-274d03e74b29", "value": "T187548A1A2E22DF7FF66D867047F389305A9876D62AE1D544F16CE60C1F2028E641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454010, "uuid": "b07c3e3a-bce6-41d9-9325-526f6d4a9490", "value": "6144:kRR/4cIFzpz7L+gjX25sCwDrSalSqZD/TZ+jokK:Npz7TT2wDrojoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454010, "uuid": "4a7daa29-74c1-40cb-9376-463a56bd9819", "value": 304656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454010, "uuid": "a2498672-da82-4b01-a6a5-f7f930ead5f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454010, "uuid": "c6333b99-2ed3-42c5-b252-544f190cad37", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655a8c8c-718d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782498752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498752, "uuid": "39020c92-1e48-4388-998b-d9959b7826e7", "comment": "Malware payload (Mirai)", "value": "8a4aca6eeae708cd1fde9692c88ea073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498752, "uuid": "d657ea83-7165-4666-8c07-c7eccf38dd0b", "comment": "Malware payload (Mirai)", "value": "f000c9c9af23d705e397a04afea2cb9be350b4d756f0d392ddff5b63755c6bc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498752, "uuid": "1481afbe-6d09-44d8-8066-d9f4d4b9d34b", "comment": "Malware payload (Mirai)", "value": "e16d945959fdceb3f3de2ea3ec27409c3cf9d2cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498752, "uuid": "f5d76a07-7679-49ac-bffa-b9625ca8dd8c", "comment": "Malware payload (Mirai)", "value": "572cc065cbb6addada53bd34f538efea27b581bfc9dc4becd1408c892a439169f0150621de77ff9fc7245ac0ea1dc5db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498752, "uuid": "b4b338e8-3ac1-491b-85ac-b67ab110a9cc", "value": "T1E553F143D19B604AD5351EB269A851C17AA3F430F176307630488B9DBADB00ABBBDF5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498752, "uuid": "b9dc5b2b-4a78-4b6a-ad1e-0ee52895f1ef", "value": "1536:4KraG14a/cjTv8Vj3Q4OjATYs1uhNq9kjCe6Ep//U2vACEk7yxza:bP5/ACjg5vhNz6Ep//U4ACAza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782498752, "uuid": "6b550189-049f-4b4d-be52-38b20e06b2aa", "value": 64092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782498752, "uuid": "e676f08f-4366-4f19-ac25-7826b82995d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498752, "uuid": "757eb025-ade8-40a0-83eb-62cadaf2c194", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6a9eb6-7132-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782459709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459709, "uuid": "3211e194-34ae-4944-b73a-54e1781f4c33", "comment": "Malware payload (CoinMiner)", "value": "39e9db3654552febecfce7bf354d1d52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459709, "uuid": "cd838c30-81d6-459b-b19b-00a554408618", "comment": "Malware payload (CoinMiner)", "value": "f01c31579d0f88b839d63966dad25b32a9f3189a636e0bf92da9fc987597d07d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459709, "uuid": "d7971890-1a09-4adf-9d9e-e7236f91f0c7", "comment": "Malware payload (CoinMiner)", "value": "508281b415ec40ba501f754427ead4f15c1cf0cd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782459709, "uuid": "68a40ba7-4644-43bb-83d0-aa5d32726812", "comment": "Malware payload (CoinMiner)", "value": "876730d31083eab7fa48798402eb3ed36f8f0dc1bc4e556b9f8ba2fd8b3680bf3a6d3a200818fc326264d16e1b2fa7f9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459709, "uuid": "a664eab5-4257-4e83-beb1-4fee762565e0", "value": "T11EA312E5AD1B5D81EEB3087FAF324F00B73508B40172A066B65943BBE8278D745FA725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459709, "uuid": "8bb8b61f-bbb5-44ff-b044-8752c632c00a", "value": "1536:PWyNk/iVGj68HdnMcaOImrHcP8ZBqTwB4vnuUjbrpGyfpiBkyJTA1:+yMu8HdMccmrHM8uwB4vnpboyhYkes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782459709, "uuid": "0d9ad22c-7ae1-4bd3-9489-638d492b046d", "value": 100520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782459709, "uuid": "960eeb3c-c37a-4e05-b311-8a7645946836", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782459709, "uuid": "d43411bd-e806-46d2-88a5-3575065b241e", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cd810b-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782479126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479126, "uuid": "5442a537-079d-494e-a8cc-427db55a2b53", "comment": "Malware payload (RustyStealer)", "value": "7a933ecb05c9a0f96e97702573e5bc69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479126, "uuid": "2aaa4b0e-d81e-460a-b9fd-dbcb1f7a9a5d", "comment": "Malware payload (RustyStealer)", "value": "f10d37857ced0fb54e7dd54d06b1349e6927764db788976424f9bae936bf3f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479126, "uuid": "cd49d5ed-924e-49d1-a594-fccbf31bc245", "comment": "Malware payload (RustyStealer)", "value": "3e475929a60a68262f656adf2aa40135c8e57e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782479126, "uuid": "69deea2f-618d-4149-b481-e29d1c527f70", "comment": "Malware payload (RustyStealer)", "value": "61a7da7947738499b28572ad41afd415e74406afe249256ca9262f7ac90a785f0d5f2f9a1c6b949503f4163282c57fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479126, "uuid": "8604d15b-c4b5-445b-b0c1-5ea71afbba99", "value": "T18B168D53FA9561E9C05EC138E31A9233EBF2BC8D0760B69B17964B612F53BE05B5E304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479126, "uuid": "4d62808f-d36a-4f30-990c-6c3a82642d10", "value": "49152:9ae5cboVcCU51YpK35sjrg0UlwRfQU1ogsLkqTUhs6UD9MKup5uo8dQRu937f:9rcb6qUgJIfQqoKX15D8yu93j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782479126, "uuid": "661d57ce-a0be-4f44-ba7c-f7f5056e3b0a", "value": 4251648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782479126, "uuid": "bffa3c79-82f5-4191-b1ad-db0547d3f1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782479126, "uuid": "6d759e4e-4b1f-4294-a358-6062c968cf25", "value": "f10d37857ced0fb54e7dd54d06b1349e6927764db788976424f9bae936bf3f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d444f9d1-718b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782498080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498080, "uuid": "f52b2f98-61fd-41b7-928b-c5894667743b", "comment": "Malware payload", "value": "b9455c087b3e05fc8c59e2ff51ef41b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498080, "uuid": "3cc4115b-c3d7-488a-9c04-e94e7dff2a6f", "comment": "Malware payload", "value": "f251d75cbea7ce997ba95ced1af1b852180a7e3c276e8984b0ba5c6234b7390d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498080, "uuid": "8a562ef1-6d9f-4636-a75c-e81d309b6d7b", "comment": "Malware payload", "value": "ae018f562f77602ea6aba59b6f380721ad8ec973", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782498080, "uuid": "08498391-d1a2-4e30-b614-bb26265d407f", "comment": "Malware payload", "value": "ea8227e2a8f63ffb8838143d2d28f1b002d81894d88a2aa8623c57fdb641ad0202574a52e8734eee3d77831088394123", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498080, "uuid": "adf4698e-622a-42bc-9f6a-f3282eeb64b1", "value": "T16637132F193B4DB6EBB91C095DBB56DA3C5D5C80C8ACB2E1D3E9BE24DBC9704204D684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498080, "uuid": "6b6d1f85-fd72-40b8-b43e-80c3fb966543", "value": "49152:qls5lsTlsJlsYls9ls1lsklsjlsvlsolsAls+lsglstlsHlsHlsals8lsWlsglsK:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782498080, "uuid": "648659cc-946e-4290-83d1-13f149e0c133", "value": 24054144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782498080, "uuid": "eefd03c6-5106-467b-a2e7-7fc892aaf3f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782498080, "uuid": "c518a372-9a66-43cd-9fe7-3fc702e3bd39", "value": "David_Jones_2025_Tax_Documents.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f24486-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478832, "uuid": "fd687ffd-f77e-4c6b-bb84-128010800397", "comment": "Malware payload (RustyStealer)", "value": "254f91bb40539160b6e5cf91d17f4c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478832, "uuid": "043bad9a-1e51-4f3e-8766-e4d266138e6d", "comment": "Malware payload (RustyStealer)", "value": "f25762e88d91d3a353ad95cfd958f411e9979626d101f99cd8b5a09da8004ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478832, "uuid": "8f47d4fd-d5bd-4e78-a35d-a91f0cc061f6", "comment": "Malware payload (RustyStealer)", "value": "c059daa4452164f35b321bb303fc53fbd92ea933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478832, "uuid": "e81cb8ab-7526-4854-8650-52601212aee2", "comment": "Malware payload (RustyStealer)", "value": "9555da7bc0ecd94b00b0498fbc1b279356fb1fd82f66b9091ac007598e9e1d749c12de9bd2175a2d9cbd9f18401ef527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478832, "uuid": "d290b755-1e65-43d4-a12a-cd6b4b4c5605", "value": "T1BC167C03F6A581E9C06EC079C31A9233EB72F88D1624B79B5BD44A213F57B605F5E398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478832, "uuid": "b4e1e8fe-0834-4b13-adbe-c4f005ce0174", "value": "f6d92901a03a7b46c4d2cce54121729b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478832, "uuid": "1e1a5d9b-857c-4c66-b75a-c6a6ebe193ba", "value": "49152:9n+728XtUzS1oGz5tjWk25lV9dGe6QPv/c9VWBFbE+Jf/m+OZdaSSwvkeNwDHbEd:9+7tXc9kK6Q/TFbTJ/iYTb39GHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478832, "uuid": "e645151d-70ec-49e1-8f1b-8effee9c166e", "value": 4208640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478832, "uuid": "dfb3fef4-e0ee-4eae-92c2-74b7d8f6ce6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478832, "uuid": "144a4dd3-178c-4e2b-8b64-bf00cd918bb3", "value": "f25762e88d91d3a353ad95cfd958f411e9979626d101f99cd8b5a09da8004ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b1729d-719a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782504278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504278, "uuid": "fe478633-d51e-4d2c-a72e-dd391c358b55", "comment": "Malware payload", "value": "4f3d3ea78ab64ee3e600d3daae967dfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504278, "uuid": "30ea5782-580c-47e0-a031-792e3c5fcfcf", "comment": "Malware payload", "value": "f271ef8ef53476e81b33f00aaec737e14edb942a8447e79565bb468e88ce04b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504278, "uuid": "0bd5bb13-759a-489b-b25c-18d25159bb3d", "comment": "Malware payload", "value": "3cd20cfdcbc6d52530588b092871f9b8ed5c40ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782504278, "uuid": "232eb3b5-5bad-4268-a25a-595c206e2035", "comment": "Malware payload", "value": "9ebea49b0b72e905ab7d024a13a55e63e87e4a6b3009628b67742a89649a2e6561993570cd536d12685840e8feef9706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504278, "uuid": "316b604b-368f-46d1-8bc9-75af4a24042b", "value": "T1C4247C99BA4F7E82D2C6D3F89F8BCB91312731958A4682F53D01132DC5C6DD98CE2B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504278, "uuid": "571c5ddf-81b2-42f5-aa60-e6ec6e0187c9", "value": "3072:YfDjt09HLyWCE5lZTmYqFlwFEOpUCt9OqveGevJjBtljq2o:StWybEXJmY+qFEOpUe4eeG8VDjqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782504278, "uuid": "0b28dcfb-2959-4710-b95c-2395e7ecd0dc", "value": 211008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782504278, "uuid": "5be91204-4728-4d0f-be61-4c06d03c843f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782504278, "uuid": "b207c0bd-c511-418e-bdfa-a90404afdd25", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33a8cf8-7158-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782476174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476174, "uuid": "c2bf8032-eb9e-4807-a7c4-96d00f7a4e66", "comment": "Malware payload (RemusStealer)", "value": "79c3344864afd83d6cfa95aa816e3286", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476174, "uuid": "178fed24-af41-4448-9236-08bedab226fb", "comment": "Malware payload (RemusStealer)", "value": "f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476174, "uuid": "bfd03648-ce8f-4cf8-84c5-f39e8b212766", "comment": "Malware payload (RemusStealer)", "value": "c18fdfd1a053a9c408fb8ae563ea55684be5d4ab", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782476174, "uuid": "7109f2e8-340f-4ca7-a72c-bb98049d8def", "comment": "Malware payload (RemusStealer)", "value": "f2c4f2f8b4ee0cd4e398184051dd1bb86bf92ce6ac65d2c6a7a0a7a6179ddc47c2cf6f392a326b45a82baa4075e02634", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476174, "uuid": "c18406a3-76af-44c0-84d2-a59653cac1b6", "value": "T1A2046B10B1E2C4B2E673053118F89B75597DBD310B214AFB67D80B7E4F342D1AA35ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476174, "uuid": "c340772c-552c-434a-9a6c-81dda181a93e", "value": "44fecc80f9b0222c9a3ac23b1cc2d9f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476174, "uuid": "cb2ffda4-c94a-4dbb-9258-231d2fdaa607", "value": "3072:GVDsce3PgRODbw/g4jmlAQJRSeI01tGrrP/lOAg0FuD0k9qMaf5A:GVrRys/Lfg8ex1twMAOJ9pah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782476174, "uuid": "f7f8983b-7b3e-4154-9589-01a0635b09fb", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782476174, "uuid": "b8c4cede-e663-4478-85c0-321f951bcf3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782476174, "uuid": "e3833bed-d0c2-4828-84d3-1be271dcc45f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3868eb22-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "c4caa8e8-7f50-4df9-b1b5-6ce243aedbd0", "comment": "Malware payload (Mirai)", "value": "a1b823daef9c5120809fda7ef82f1aa3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "91f59e31-7a19-45ee-9155-a8bb6abe42d1", "comment": "Malware payload (Mirai)", "value": "f365800c15f9932894927244ba82f0ccd01464361919fb3bd857ea1c139ab055", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "6838b6a9-4f6b-4d4c-a181-675f4774d43e", "comment": "Malware payload (Mirai)", "value": "3761a882eadfd480c7b7d8b696bdbe290e8ed432", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493094, "uuid": "29da1632-a1a3-4916-8f1b-58b18f16629d", "comment": "Malware payload (Mirai)", "value": "4cd1ea0fd30a7533c86c4cb22f3df6a0c1c1503de98eb56eeba9b2384497eda80bd15248601740bc5e52552676120d53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "c930ed3e-cadd-47fb-b185-081192b8c920", "value": "T1B5930956F850DE61C6D526BAFA5D528833230778C3DA3202EE149F3437EA95F0F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "2afa4fa3-0cf1-4c22-900e-09f811a41aa0", "value": "1536:Kl2TbhwawRD+6fVUx5edOb95O1B1ReyfJzSvRvyCyvRvwSWd9sEdn0GvhSPIHG0w:KUia56fVkSj2usvhvYng9jv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493094, "uuid": "b16310a5-d663-4cf4-ab49-919f4072fb07", "value": 95584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493094, "uuid": "317030cf-a2ea-4f10-804e-7e7d29e1442a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493094, "uuid": "cc447591-008f-4bfd-b048-4aafed6f9f5e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a29798-715e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478808, "uuid": "d72a1b13-5241-4789-af50-8658b136d830", "comment": "Malware payload (RustyStealer)", "value": "6349de7a2dde48ba850d2b9fbae1703b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478808, "uuid": "21a1958f-e484-474d-8b41-d5b9efcab57e", "comment": "Malware payload (RustyStealer)", "value": "f3deff6d564ca838ad782a3a2b77c5bc510160c104f50b2016b1f10d90ad28b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478808, "uuid": "c40e2225-c09f-4399-b81f-3bc6054ece22", "comment": "Malware payload (RustyStealer)", "value": "0d45c202e18303b12ee50df797f1bc7babbd2500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478808, "uuid": "1eef99a6-3f66-4397-93af-476a831004fe", "comment": "Malware payload (RustyStealer)", "value": "211439a72d643d7dce7f5e0a98be556d03ac9ed518852aea96d5da1a4497efea7ac02d9039eaa18a22708aad0b002e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478808, "uuid": "a7b6fc76-e0ab-44f5-bf99-5d158ac92981", "value": "T11F167C43F69945E9F05AC038C72A9223EBF2B88D4621B69B57D4CB613F93B60DB5D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478808, "uuid": "7a64f23d-2ea8-4c9e-800b-c64a5b832bee", "value": "49152:Em1+MFSSTgAiV1uZ124Wnko35mhUEx/GjpjmWFkyRwKnWeELfJmqd6K9/+mwXOfm:X1pASTGuJMv1ZkyiKm9wefnIu8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478808, "uuid": "1ef67cab-a84e-450e-983e-d183f67822a1", "value": 4364288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478808, "uuid": "848a484d-be07-4ec0-a824-21625861b287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478808, "uuid": "6da67571-8139-46ad-9dc9-e47ae5a1f7b9", "value": "f3deff6d564ca838ad782a3a2b77c5bc510160c104f50b2016b1f10d90ad28b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90acba2-71ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782511805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511805, "uuid": "65f301d2-1358-49ab-86e2-7da26c9f0617", "comment": "Malware payload (Gafgyt)", "value": "f459004b0f0cfff6cbbf6162272a36f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511805, "uuid": "b21cfd6c-cc26-4e2a-a649-ac0e6c46a367", "comment": "Malware payload (Gafgyt)", "value": "f443b4c302cc5f9b0b97bd8636c93a12eb21674cfbac2711e8f23b02664d149a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511805, "uuid": "8ba427c0-36fc-445e-9638-d81dc28e3e1a", "comment": "Malware payload (Gafgyt)", "value": "88e4413fc5c596e1da817665d6cf8fa0c62618a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782511805, "uuid": "a76e21ee-b4ba-4dc0-ab87-04a8f075a4aa", "comment": "Malware payload (Gafgyt)", "value": "bebfcea7953923503d1e29c3a15d5a9cbad7eec97d88cc1ff72b63193b927cd141702071e33e438aa2ffd1b5d2cd30eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511805, "uuid": "50f42e95-c802-47ac-9e50-a752bd35df18", "value": "T1B8B32A44F8418B6BC3D327BAE7CE478D3B315A9457DB33116A38AEF42BC17992D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511805, "uuid": "97f07f3b-5bd6-469a-b986-29d7204b6531", "value": "3072:ghRUKoPkU2/dNFRwH+BxhwnT7V6mVJTQwOPHCXQ3o:gIkU2/dzKeBLwnfV6mVJTQwOPHCXQ3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782511805, "uuid": "1ac7f1a3-c7be-4440-9b81-1f82bb83e449", "value": 118162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782511805, "uuid": "47a12956-587e-46c8-be13-d3dc513f7868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782511805, "uuid": "b37a803a-4faa-45c5-8ed6-67dcd9305a47", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecd324a-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478877, "uuid": "a17eff4a-fc53-49ba-9002-60513d83f5e2", "comment": "Malware payload (RustyStealer)", "value": "1dd0e8fd632dd232d9c61eb6fa246703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478877, "uuid": "3d61f804-232c-4a36-9cf9-53e004924343", "comment": "Malware payload (RustyStealer)", "value": "f471c961f7d4c7ebee70b24648385673fb6e8719554d0b85d9ca614138b9f751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478877, "uuid": "969a5a83-bf5d-4a75-a200-ad10ff9ac228", "comment": "Malware payload (RustyStealer)", "value": "0e3343c4231dd879517d55b7dd8996eec688b8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478877, "uuid": "5cbeacc0-2006-4736-b4b7-9965e443e4d1", "comment": "Malware payload (RustyStealer)", "value": "7d8f9495d04a488165759baba44fc24a6a4693a915af76113283469069c55ae39dcec62b4e5951b90c7bdbb98b765a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478877, "uuid": "bc85d5f9-ea67-485c-9280-82f35dfd71f9", "value": "T144168D03F6A581E9C49EC139C31B9233EB72F88D5624B79B2BD44A212F57B605F5E384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478877, "uuid": "f8e3e848-9f54-425a-b061-3f2231eef193", "value": "c027ad65a3a7e550445a6ecb7bcb986e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478877, "uuid": "4153f1ca-3390-4879-a32c-a37fe1b37492", "value": "49152:XHSYxnvUT7lq7Yutzt5ns0W29cW1mI/HL5T1ogsLkqb4yz26ukMGu729+JJGPgvQ:XHzvos4Sn//L5hoqpGd9gJ9vgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478877, "uuid": "c96b4827-e64c-4cf6-a0e6-f6af5080bcd3", "value": 4216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478877, "uuid": "8a43a568-851e-41c6-8c19-ed9f7e5e9697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478877, "uuid": "29d76b01-3e46-4df9-b18a-ca9f4c6acdc2", "value": "f471c961f7d4c7ebee70b24648385673fb6e8719554d0b85d9ca614138b9f751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9cf79b-715f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782478956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478956, "uuid": "d9e235a1-69b4-48f3-a586-7f1b25fe0491", "comment": "Malware payload (RustyStealer)", "value": "82a228c7b33477075bdde3eab3c5c14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478956, "uuid": "fd5d6cd2-35be-4c7b-be98-b7148ae9490b", "comment": "Malware payload (RustyStealer)", "value": "f4ebf635cdfdd17e0f252246dd13c113e10b423fccd1250fd8fb8b26abbff90e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478956, "uuid": "7cd3977e-c250-4a8b-8a9f-a8ddc3387c9e", "comment": "Malware payload (RustyStealer)", "value": "a8c3098075bad3210fa0929536bd2804efc8c8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478956, "uuid": "5d64bc37-5ba5-4c31-8cc5-b5b4e4d73377", "comment": "Malware payload (RustyStealer)", "value": "1f783675643031544f6622bb33f0d9ad4be8f7ab02f0bda5f92ddd000c790d5ccc80cb498819b5acbb0ebc7336435cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KuinaExtractor", "colour": "#F2F264", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478956, "uuid": "d89ab899-70f1-4c26-b2f0-4be0347ebed5", "value": "T18B167C43F69541E9E05EC078C31A9233EBF2B8AD1620B69B1B94CB633F53B605B5DB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478956, "uuid": "fd22b34d-3315-4b6d-80bb-9d88afdde1ae", "value": "49152:SMhRsDEdb3xhdVXod5luocvMOHIFRqkeS81ogsLkq/5lMxTs41f+jre5NmNVhz2:S5w3u+vBoTheSioTM8jS5NChz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478956, "uuid": "5beef3ec-c8c7-4393-a550-06214bafe9a3", "value": 4258304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478956, "uuid": "3fcf0daf-a386-4db6-8f31-259d7506469c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478956, "uuid": "02d08650-a2e3-4bc2-897e-59f353de7ae0", "value": "f4ebf635cdfdd17e0f252246dd13c113e10b423fccd1250fd8fb8b26abbff90e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535bc578-7118-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782448471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782448471, "uuid": "8d60e57c-fbb6-4b5b-b684-5609a5156493", "comment": "Malware payload (RemcosRAT)", "value": "e9476d17b0d33ddce3dc86522b990d83", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782448471, "uuid": "4a86c134-8e9b-449b-b58f-f26f5fd83c4d", "comment": "Malware payload (RemcosRAT)", "value": "f5b246182290991e9ee234a6b4dd3ef20db712516e4a5123670d0b188bda528d", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782448471, "uuid": "5e16b887-a246-4484-83e0-a2b1d70c6458", "comment": "Malware payload (RemcosRAT)", "value": "f0b25980960f3f49acedc49b45acd452568f2d50", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782448471, "uuid": "9964d0be-6d5b-427d-a2d6-396c6cb87d4e", "comment": "Malware payload (RemcosRAT)", "value": "790d089fa07dbda95336b5cf2c82377dbec1dba30e6ce86235f1846b3b16ccbab8b27bea5893ff3591317eaedde54a05", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782448471, "uuid": "18641fd9-2b6c-4ad4-a2fe-446690b77568", "value": "T17664BE718F1614650D6C829E084CEEE3BDA8ACCB7017F177B607D4EA7A772E3585C298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782448471, "uuid": "3715ab19-b7d4-4fd2-8266-c4e2fa5e300b", "value": "6144:OqjOc7phaICseYaPDWpdq27YrC2vB7ay88EB3Q+yrD:BOKphaxxbbS74572iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782448471, "uuid": "1a18317b-ee06-4d8b-b936-bb128bf929df", "value": 322982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782448471, "uuid": "d3d8ff19-d1a6-4217-9c46-1ee051ed7a9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782448471, "uuid": "ee3abdbb-1230-496d-be19-fd7a58fcc58e", "value": "MicrosoftEdge.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840ec82f-7197-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782503099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503099, "uuid": "9aee6afa-7fa4-4e0f-856d-831e8ccd1c7f", "comment": "Malware payload (Mirai)", "value": "85b79ce96ca7538d15490ff7c134215c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503099, "uuid": "23a57da2-8058-49d9-8e7a-57032c3d2884", "comment": "Malware payload (Mirai)", "value": "f5c35c91c3890f1f1d3886dfcb6f878d2be57ecc4485542e4a5c92188488452f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503099, "uuid": "cc54305c-a3dd-4c19-af95-a7070e816ef2", "comment": "Malware payload (Mirai)", "value": "2815144939123218d65b30fcf00726343f2a53b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782503099, "uuid": "a8f2a428-50a2-4caf-88b0-1e89f53ea11f", "comment": "Malware payload (Mirai)", "value": "9033e841f574464e3c3b59c8bb9f8f9dfbb9e2acf3cc9541639e1638641e2fce0f3b21ef80a709e21f213ab4b5b47990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503099, "uuid": "289fe571-664e-42a0-b7a2-ccf14ae8b76d", "value": "T16763020C6485057AEE5656B9CBA317FE3E208E178477CC4E1878C5825B4B9E6FC83EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503099, "uuid": "8e054b6c-04ff-484f-9103-2c7cad92ffc8", "value": "1536:OMLXRLdfRm5S+PM88fs/+CCZg4KwmFklnqNVSTG:vFdJmfEk2ZqKlnIVsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782503099, "uuid": "b350b9dc-1f4c-4a26-8a98-dc16e1a7d072", "value": 70260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782503099, "uuid": "b39137b7-6954-4f6b-8ad2-7a03880ddac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782503099, "uuid": "4749377f-0e1c-4643-9153-29a32176e16b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd89f64-7130-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782458693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458693, "uuid": "92b5e700-f339-406a-aa28-58bb3a3fa8ef", "comment": "Malware payload (Gh0stRAT)", "value": "5248553fe872c655e29ef71f6333a585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458693, "uuid": "033a638a-b9da-48e1-97f2-8654b4c5000f", "comment": "Malware payload (Gh0stRAT)", "value": "f755d085c61879c1805115cdb6f344e9c8ff3b5f7b0e261cd59694c1d82dda18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458693, "uuid": "03326e33-43d0-4ad6-8fd1-bcb0b56340c4", "comment": "Malware payload (Gh0stRAT)", "value": "fc15b444c98d7a016215ea5dfb2d729b608990f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458693, "uuid": "df043f0b-2a8e-4f5b-9563-f25fb310b201", "comment": "Malware payload (Gh0stRAT)", "value": "4c062ee00b2c1cac2325ca1a7e4f10c8858a62cc22122ec1a095aa0c70c9abe240724a29cf4ebb570aec739d7f8286bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458693, "uuid": "83884463-2c97-4d06-b31b-d70bd1d75e1a", "value": "T1490522868946D169D9A098B8D1DF10FD0EFA6DD7F7004AF32508FECA7A72195332B618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458693, "uuid": "7515afe1-ad9f-4403-96bd-5dcf1f1728f5", "value": "8ae571e62a3de0944af5f9fc8966bc7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458693, "uuid": "3f98df6e-8f70-4de7-a94e-9fb15cd7f588", "value": "24576:MiZNG1yTNUMkmkRsLr9sMc1Cb1jaG74BtVFB:ug0vfEbRb4B9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458693, "uuid": "abd87777-7ea8-4c8c-9ce1-821bb1135176", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458693, "uuid": "db4c5302-69be-4eb8-8690-5ff677388133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458693, "uuid": "957ebab9-962d-48c6-8417-f8d99d80e842", "value": "\u65e0\u5e38\u8ba2\u5236QQ\u8bed\u97f3\u795e\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ed1b83-718a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782497698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497698, "uuid": "4e0472f4-cb20-429a-8048-d51b3bf1910a", "comment": "Malware payload", "value": "61abe5b274a31c313f2e4f86e91a3609", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497698, "uuid": "f1705087-2003-47b3-bf1f-9b557ec8fcb6", "comment": "Malware payload", "value": "f801da45bc7d36c3a81b7a23ec4ed85dea9e95b82cf2a75effb0194ea5d05b52", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497698, "uuid": "17f122c6-63a3-4b22-9ce6-0f0eaafa22b7", "comment": "Malware payload", "value": "4d519f33eb6ad3bb3979624d6f3e5b36381fb7d4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782497698, "uuid": "077973a8-5a4e-4b54-91ff-2d03b2398aaa", "comment": "Malware payload", "value": "75828f016c4d5d0b63213ac648aa24c8079883aee64b4ac409a8cee57c66b9ba2da944e9bbce8cf1e387b52ebbb244ae", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497698, "uuid": "273e8d87-7db6-425a-93cf-dc6a780e6c2f", "value": "T1C831DF46402E4D2FC3B5557ADEE235856687C063C85C5DCA799DC7082F7216B1B22FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497698, "uuid": "1ca90a00-b259-4890-afb9-44e1d0c3abdb", "value": "48:+W/0Gg13xgaycslSSRwb6XF+jlRgaCLcSd:pM3xga9slVKegjlRga2nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782497698, "uuid": "3a6d25bc-cef5-49a0-9511-c8d3aeee1d1a", "value": 1630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782497698, "uuid": "617d1475-3017-4d24-92a1-89b942cf782c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782497698, "uuid": "c52cfa12-c405-4b94-88e2-8a9e47085c8d", "value": "nettt.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d18ccd-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782458300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458300, "uuid": "e6c4751e-d6ef-4127-8909-92ff6de05f5e", "comment": "Malware payload (CoinMiner)", "value": "49b0d025f0baa6efff80e319f52d6ac3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458300, "uuid": "dc96a102-d941-4c56-a3ec-e9875337f774", "comment": "Malware payload (CoinMiner)", "value": "f8091c1519b42c4df664302152bd6a78de0548d55c17b87dc2c75df8cae0b457", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458300, "uuid": "6794e6f0-ba3d-427c-993d-ea0615a9e0b8", "comment": "Malware payload (CoinMiner)", "value": "891e22f21edf2cdb08f60740a844f1450a915a9a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458300, "uuid": "570ebb48-4e91-4af6-b08e-24ffacfb9549", "comment": "Malware payload (CoinMiner)", "value": "ed502753ee7c41ef41845d102858601caf57d85374ae901852bf6ee12f7eb57f2edb327938f303b555db70c7cf2691fb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458300, "uuid": "c4abbbfe-e3c6-4e25-b266-7a7d94ff4577", "value": "T14F346B0AF612D5F1F6A72532018ED37A1630AE344156D997FF4B3EB0ECB1506AE1A72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458300, "uuid": "1b9d1d8a-a2f0-4437-8ab2-9d0b661c47ab", "value": "6144:cnNKuk+w1Q2Zv3b+x53F0nmGe7zTNVEOZLklB:cSpQ2J3b053PGMZ6aLsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458300, "uuid": "2079e6d1-4c7f-4b9a-ba1e-b1e3dbfdac00", "value": 239032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458300, "uuid": "5e444cd2-8efb-41c4-bafb-e30f1628d9fc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458300, "uuid": "0254a53e-cd21-4504-9072-cd092291af5f", "value": "kworkerd-cgroup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395304fc-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "6c359b11-df0d-4d72-a244-d9f302e9d93e", "comment": "Malware payload (Mirai)", "value": "dd6a16947908210ff4e40c39b2cab623", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "e751b771-e2e0-497f-adee-070cd46e0fec", "comment": "Malware payload (Mirai)", "value": "f8137ea7660c44525bb55d849b19a2677de53ba374a889dec1400061f479e5d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "60ffbfbf-cc98-431d-b29f-c44ef1f32ee4", "comment": "Malware payload (Mirai)", "value": "18c84c9f97d75f87689b7c47b79c566f15058fa1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454011, "uuid": "2e6941c7-848b-468b-a5d6-14a15799cdbe", "comment": "Malware payload (Mirai)", "value": "3a2375ef330fd2f09f4fa0a8c827d02c9b8220e9a73ea2193ff0ffc6532af2ab90259f6ca3f65e52c892ae49dae71b09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "c3824b16-c7eb-4096-9022-7e1a80c44b83", "value": "T14614F74AB9919F11D5D231FEFA9F419833136BA8D7FA7101DD206F6033C699B0B7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "76808c6b-1d20-4f0f-82fc-538c0a397e38", "value": "6144:1YL5UvebhOc88zc/vCcSaU/MvNL1QH0hP14iWXj66i:1YLWedONqc/vCZaUcNL1QHGeiWXj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454011, "uuid": "58eeab29-2cd7-4bd0-b1db-45e7922a49ed", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454011, "uuid": "7be08662-2ba3-452e-817a-449e44d5bb31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454011, "uuid": "fb84a67a-e245-4a18-876b-af259f4eeca4", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5512a1-715d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782478125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478125, "uuid": "e0a2c35f-91db-4a8a-a94c-9434f6a2c498", "comment": "Malware payload", "value": "94d3ab9fa8439f79b34a769dae17ab5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478125, "uuid": "802a93f1-92cc-4f0b-8a16-0a99a8dd2e79", "comment": "Malware payload", "value": "f87cb46cac1fa44c9f1430123fb23e179e3d653a0e4094e0c133fa48a924924f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478125, "uuid": "8ec284dd-5dc8-49c8-8f3c-13b6f812469c", "comment": "Malware payload", "value": "c920e7853aebe8d83a59613b00c6490e7d4f8774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782478125, "uuid": "5acea794-4cbc-4141-8fa6-bf984a383e3c", "comment": "Malware payload", "value": "3cd2b56621f0254f9ae43799a0e363f5c16c874fc0150782c5eb5e5ee080debd5953ab91247e31cc9b0dc8ee1c1e397c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SharkLoader", "colour": "#0FAD97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478125, "uuid": "e9ad7202-b26a-4678-8bf8-b8fa0293ad65", "value": "T18646C0956AFD00D5E8AAE0B6C917491BC7B2FC912235835F85607B5BEF733120F1A362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478125, "uuid": "9b4bea08-7021-482c-8f06-15af22d056ba", "value": "e622eb1be19ca06c1cffcbd4896ba153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478125, "uuid": "bdceb1ee-ef7e-4cd7-8e55-3d5afc292f72", "value": "98304:csL/bxZ0y2oYzsl1y6mBYFIfKsWIuV0lqL1otB3RrFLOAkGkzdnEVomFHKnP:vbxN3y6mBYFIKsWI60MWt1RrFLOyomFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782478125, "uuid": "7ee57dfe-6dc4-4322-8712-88e16ad7e42d", "value": 5757240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782478125, "uuid": "48c7d231-aeab-4041-9a28-1dcbde955e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782478125, "uuid": "49611285-e78f-42cc-827d-7cac815660d3", "value": "f87cb46cac1fa44c9f1430123fb23e179e3d653a0e4094e0c133fa48a924924f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3713647a-7180-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782493091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493091, "uuid": "8babcdea-985a-4523-862e-48c894b90c92", "comment": "Malware payload (Mirai)", "value": "a9d856445b1c47d1872329482fc59d07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493091, "uuid": "8fe94e51-7148-49fb-9f69-dec48345ccb5", "comment": "Malware payload (Mirai)", "value": "f91084d7245cc2c2c74bbe15091e85aea3cb6073a719507d78c8519e28761b84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493091, "uuid": "8aceeed2-ce03-45c3-abb5-1ddea1943f8a", "comment": "Malware payload (Mirai)", "value": "b676782f05bda3f9ac18e8a3d27ed0bdd6114b9e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782493091, "uuid": "5c3fc4a9-5325-425d-a5d2-63659a27d677", "comment": "Malware payload (Mirai)", "value": "b6ac5414ec14cbff1c42af50cafc6b006b2865724ed822b08dff3d46f87dc76335f46de76d8bb0be89f991ac4d66efcb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493091, "uuid": "e206d976-a14a-4095-a41f-e93f39a213a0", "value": "T1F9B37F68D50EAC41D6C6E379EC594FA2B33738B4C325C2B26E00536DECEBDD88DA5512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493091, "uuid": "c9ea27ce-a8dc-40ae-8b80-b48fdd87d79f", "value": "1536:1ED9LkzrT4SSomHa11yJTKNmS8X4gLsBGlzcuvR4E1nbo003KauTViPI3WTIrlT0:eOn4SXmHaq1oT5u+EtP03Krt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782493091, "uuid": "b826d8e5-a9fa-4dc9-bac6-ae17c208b737", "value": 108352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782493091, "uuid": "b1ca61e3-37e3-46b4-ad71-b7bb2396b911", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782493091, "uuid": "92ede0f1-bb1c-4bd2-8328-136b22493ae7", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514cbc21-7123-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782453192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453192, "uuid": "17603792-2217-4ac4-a9a7-3b2f414629e0", "comment": "Malware payload", "value": "9077f8a7e5b4d3d548a7d5a944998bc9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453192, "uuid": "9f43b83a-d88d-4a31-b1a6-9d72b064a135", "comment": "Malware payload", "value": "f9911fdac209474def68080e7f6dea341390bf9fcbf72bcf73f7d111a3b328c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453192, "uuid": "9b88e9ef-3fa3-4ecc-b74b-53321aced28a", "comment": "Malware payload", "value": "9ef9d0c9681a17b61a01c0f48b915372a24d9d32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782453192, "uuid": "e29c788c-83e2-4c00-85c2-f0a8c06d232c", "comment": "Malware payload", "value": "51c18f0390977f06db36b9bd71a08d48ddec6be8f4f141f0e2029a7bfbbb343f8b888da1abd49a4448c9965bfd839f3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453192, "uuid": "1e9f0d5e-a570-4f4a-a998-6b78d6eda385", "value": "T104D097B3A2B311B49026C831F9C6A840B0408B7E4C01E82FBF2723302F81289F9D2394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453192, "uuid": "dc7af351-ac81-4707-81f1-2d9565cedb46", "value": "6:hTQiFifo7FCLYzUAulNXYq9DG+NjVsNXYrkJ:VTIw7geUPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782453192, "uuid": "4c064ff3-efbd-4135-b460-d80366333d84", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782453192, "uuid": "bc1e17d4-5007-4a09-9391-cef523864f54", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782453192, "uuid": "ab38e1db-6902-4c85-8adf-a760ec91760d", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9968e55a-713e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782464910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464910, "uuid": "173695ec-34e8-4d8e-bc6b-86e91e7364c1", "comment": "Malware payload (CoinMiner)", "value": "a9e4ca6ce25a24b6d451e373f289aeda", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464910, "uuid": "48c38606-603d-434e-935b-b68ee63e06cf", "comment": "Malware payload (CoinMiner)", "value": "fa5410f4aa035782d0c0ccd8cb7ae228e35e3049702d60fd574dd414d111896e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464910, "uuid": "e7b11d4b-def6-459e-8997-8f867eaf94c1", "comment": "Malware payload (CoinMiner)", "value": "d099cef0f6372e1c421930dedc738130e9fb9cf3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782464910, "uuid": "51ca62f1-2081-4b52-9332-1d72a6af3c8b", "comment": "Malware payload (CoinMiner)", "value": "189791b0396d25d011f292705c152a0bc801334cbea6b91e4e15c7b42e61d0f6937e7b36a43c34ebc9342c1af1a1e0f2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464910, "uuid": "7b6b5aa2-acff-4626-b267-4c45964433fe", "value": "T1E5D312069116D4E3F963B07D975AD3F295F247ACC884EC0A38BDA0CED0915E3AE5F168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464910, "uuid": "53d80126-1fc4-4e86-9756-529c4feb2221", "value": "3072:EWiecVcRNn4/UAZXzwc94jSNd2o1qxHlH2fPDrG+Lw9BgfV+:dcVcrniTNzw04SwxFHC/G+Lw9et+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782464910, "uuid": "fb391fe4-6209-402c-abed-75a528c7fa30", "value": 132140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782464910, "uuid": "dcbc0b32-303e-4d94-b707-484d426c4cb3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782464910, "uuid": "293c6f9e-4eb0-4304-94d7-e2af7f743568", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412287db-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782458319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458319, "uuid": "018325de-6b3e-4ec4-8bd6-8c44b293286b", "comment": "Malware payload (CoinMiner)", "value": "ae624296c841b43512f93f20fc836c37", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458319, "uuid": "eadefc98-4e38-4621-80d5-cafb3a6eea85", "comment": "Malware payload (CoinMiner)", "value": "fc32a3eba0b0f20f3bad91ec7e407c384108a59f1cb8fed2c0bef554261751d1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458319, "uuid": "4ba622c7-8452-4114-aef6-293d3879c8f8", "comment": "Malware payload (CoinMiner)", "value": "b4791e2d054ab1edcec8584f5edeb409b8131eed", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458319, "uuid": "7ee56829-4259-45bd-ad65-5bcbb7f5c530", "comment": "Malware payload (CoinMiner)", "value": "e87df25734c0087caa91408aef74e13e4326fbf4f54dbf1656fa5e0cc7085e5afe8f26da525a4bdb7a5dc4e87e46b8ce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458319, "uuid": "97cfaf44-c6d8-4f17-8e72-226f1b2d4a81", "value": "T1E4644B02FF845A43C5811FB15D7B07B6A3DD48816CA9E13D990B7F2506B38BAA5DF388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458319, "uuid": "e67c786f-9642-4974-a95b-33846bf8b585", "value": "6144:gMF/hRgYGQiIh7EVQ4/h0GRbGGH8a4JJW6ebEdS7t8UDZgq/V:bT4RojtXU9gq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458319, "uuid": "91db9315-d753-405b-a8f7-f7934ab1f749", "value": 329172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458319, "uuid": "411e9bac-bb79-41fe-962f-c855f45b912d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458319, "uuid": "a3eda377-a9e8-4c64-b8db-7d027c66b970", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f38bec1-712f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782458477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458477, "uuid": "579f93dc-f0f5-4312-88f9-80ec1621c840", "comment": "Malware payload (AgentTesla)", "value": "900196a4a464dda4beae76cfe037f70c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458477, "uuid": "7ab2090f-d3fa-4934-9597-4158f5a71ba4", "comment": "Malware payload (AgentTesla)", "value": "fcdfc76171113214b35508c7dc5c92e111d89b014d7ffd7affe8665ae57efe28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458477, "uuid": "1b6d004f-6c7c-4690-b5e8-6d672d484c5c", "comment": "Malware payload (AgentTesla)", "value": "3e12eefa4272626a55c2988d88d8fb99aa79e114", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782458477, "uuid": "270d3326-5a78-4717-a364-1b6ee30c47e2", "comment": "Malware payload (AgentTesla)", "value": "1114ca7530bb7c0014ecdff6688451ada55b6bfbe0f606d1476bcc870dfbf7e377242d74c981c606a7db4e692eec0e93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458477, "uuid": "009fb73d-e853-4b2e-906c-27175d7c0a26", "value": "T1D2D43892A63BE0A9F61A94B34E0F0FEE8152DC12E6BE64D5DF1072C84DF2D91D435D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458477, "uuid": "bd9c63e4-6f29-4b83-a52e-e127b823c492", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458477, "uuid": "3a9f0d2f-fd8f-4114-a3fa-d82efa860379", "value": "6144:3bfoprb/eSgnR253b6nhl8X4zlcrKnBppyMa2vIct7EH:3ba/etn+bc8GlcKpy8/wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782458477, "uuid": "6e919945-704c-4da2-85f9-2a62654c8060", "value": 610456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782458477, "uuid": "3c7543fb-9621-4787-9585-da6cd7c17381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782458477, "uuid": "e87d248b-a17b-4eba-b025-889fa348f98e", "value": "SWIFT_Payment_Receipt_25062026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb2888a-710b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782443066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443066, "uuid": "0326f2ac-55d3-4a8c-9538-dd8f10374af6", "comment": "Malware payload", "value": "c8a5c8a8dc56b2eef50ae86b3fa6c8bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443066, "uuid": "33a09f2b-dd3f-4ba1-8254-69a4416ddc26", "comment": "Malware payload", "value": "fdeb52305559089696cc299e3d29e7d444daff908bde25279f44381cdf22f152", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443066, "uuid": "85ca9dc1-980d-4db8-a044-41085b8575f8", "comment": "Malware payload", "value": "5b83aef5d618a3fd1c7cc87728ee0edb86bac317", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782443066, "uuid": "e51cfa6b-ef2d-41cc-9cbc-d962761800eb", "comment": "Malware payload", "value": "8d9073142b3c0dd4d6c29380a2efffadea46bd387c015f797f4cb78aeb7817dd636a647426e1baa9e2fd723c335e1aef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443066, "uuid": "7392d06e-c7a9-41bb-aa7a-57a01c790068", "value": "T1C033AE43CF218E726BCE099B697A9DEC136AC6B5E38C7E189F0578352CD8C4770970A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443066, "uuid": "39fce380-2277-4e87-9e68-0ac8f2b8b44a", "value": "1536:cpU7Xanq86QatgUfFw7j3G05ewBsrRxdLGMM0kWGOMsT:FXaN6QaS4w7j3G0AwBuRx0okWjMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782443066, "uuid": "74f2c3ad-3822-42da-8a12-2f37d6116aed", "value": 52894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782443066, "uuid": "a2308dbe-ad56-47ff-95da-6fe7f11a28e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782443066, "uuid": "662ac65a-b2c8-4363-8f65-4b6195c7b431", "value": "ocafa(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a342a43-7125-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782454012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454012, "uuid": "3c02f430-7eac-4a50-beb6-c0e15cf1e751", "comment": "Malware payload (Mirai)", "value": "0b013a9522535962007b45fdaa681791", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454012, "uuid": "31f9fbdd-2af5-494a-88e9-493a7df7fcf0", "comment": "Malware payload (Mirai)", "value": "fe30b06d86bc2b20f28be3822488b0a4079c27c6063540929f418752c4eced3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454012, "uuid": "026480e4-cf98-4a54-b90d-aacfdcaebdec", "comment": "Malware payload (Mirai)", "value": "925cf60ad77fdd5662b54f6bcd8f2002c11053e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782454012, "uuid": "f061b589-6b99-4879-b7b7-f59b26a4c728", "comment": "Malware payload (Mirai)", "value": "71a94e484e3e4fc56d1611f66db9e0f3ca4484134d8254daf557b7d318a681772087868434ef3f65fff5a21a41a75a02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454012, "uuid": "7d247fda-84d0-4abe-917d-c473fe057c12", "value": "T1C2242B037A81C9FEC496D1F04BEBA5319979F82D0635714B3794FFB12B09EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454012, "uuid": "bcd0af8c-54e3-4aa5-930d-915026c84ea0", "value": "6144:KBbbTJgbFZpLT6BdrPG2er/+PlNLO/4X9:KgFT6Bd62er/3/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782454012, "uuid": "6e04afa0-2eba-4a6a-b80e-ec3b2a77827c", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782454012, "uuid": "528a855f-2ea8-4768-af47-7349380805b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782454012, "uuid": "ba31706a-63e1-4071-b3ce-b9be7ea45450", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375a1bc0-714b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782470329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470329, "uuid": "007c12df-4837-4212-add5-4a09dbc9711a", "comment": "Malware payload", "value": "e5ed46156a51862e9111a732d5a42947", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470329, "uuid": "7646e9f0-2a0d-4ead-88eb-bc1e3e0cb9c8", "comment": "Malware payload", "value": "fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470329, "uuid": "a33d56f2-4adc-4adc-984c-7232af4318b5", "comment": "Malware payload", "value": "9c61f782063c36686d22fedb296f93784434518a", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782470329, "uuid": "47b9ff9e-1f2f-44b5-ad43-c6f70308f7f6", "comment": "Malware payload", "value": "ab0658d752ccf5b41359dd01ed3881e774f9990c9773192982ff059a80eb297967f986502bfd1d6b5cd6e9356a2e8147", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "node-js", "colour": "#D9E910", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470329, "uuid": "da44f114-0f43-4c5b-aef0-fde2cffa7eed", "value": "T148A2FE8EAE9175B66537F33CC72F8508FA65152301849A523E9CE092AF3186483F5FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470329, "uuid": "d66cf8a6-fe37-4d98-a307-1472db6935fd", "value": "384:fPbbGCoFTRB1Oohfuck4Lu6CdoBuwzs2IBAnXpl:GCoF1BUoUck4tbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782470329, "uuid": "0b21ac31-4714-4b71-bd02-8fe9fdb7c7e8", "value": 23131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782470329, "uuid": "9354d8f9-4314-4ede-9168-fa4e59109b1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782470329, "uuid": "883a3ea3-3891-4cca-9bf8-11eeb8783d75", "value": "script4-from-2nd-obf-script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb83364-7120-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782451899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "574807cf-0352-4f90-81f7-30b1633096b0", "comment": "Malware payload (Mirai)", "value": "5d45ea739fc400ab7bb00fc8ad208dee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "dfa12d06-c531-468d-ac07-93456b002de8", "comment": "Malware payload (Mirai)", "value": "fe86f8787009d2dec67edbc0914feadeece8a1edc50b2df5b38cb93ec97b79cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "ce4e5135-965d-42de-bedf-10c380337a5e", "comment": "Malware payload (Mirai)", "value": "0203f262daff04abcb3e0afc9e7beab65d08f372", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782451899, "uuid": "d99d00ea-3633-4a10-8717-0cb4152cbd15", "comment": "Malware payload (Mirai)", "value": "7f22ce29907cc09ed121a04dfaff84bc4c4804f0c4de6f48f16952cf53d5ce8ecb563a176b9b24cdb3e48cc5aaa76891", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "39f552f6-3e9c-43b8-b450-3a3b68489122", "value": "T1F5535A21BDBA2A27C0D0A57A61FB8765B5F503CE26A4CA1E3D720F4EFF215401603AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "632b61e1-4bac-4407-b6bc-ac42fd222270", "value": "768:QroKQQs8sVWgdDZweJ6ls0m7hCG/0irtLeAopFpcVqO+A7gnCgN:QrcQnsVWgdDZwm4FC//0i4OV4ANe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782451899, "uuid": "289f4fb8-2b2c-4d75-bfa1-0a2e59dc5662", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782451899, "uuid": "9b8b3c14-1395-4137-887f-f93d08a1f49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782451899, "uuid": "c66bda23-533d-40d9-876e-f19a0101a851", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }