{ "Event": { "published": true, "date": "2024-04-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-07", "timestamp": 1712534581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "11ea3535-73fd-476d-acc1-ea7339deadce", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9441e1e-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504348, "uuid": "790b2c19-4b2f-4fa5-b1d6-f8ab43fd8793", "comment": "Malware payload (Neshta)", "value": "baa87b871cefe5eae104de7c0eb8fd67", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504348, "uuid": "c0036d1f-4f0b-4f69-8d86-7104b087aeba", "comment": "Malware payload (Neshta)", "value": "009e272f31002936c47b7b8bea9f1dbcbd4f106f57787cf9d76588781202adcc", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504348, "uuid": "4ca9d6a2-d919-4dc5-8b3f-65be9678856c", "comment": "Malware payload (Neshta)", "value": "f9c909fffa7bafbc6dcf7f832981b3e4790d0744", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504348, "uuid": "4a63176a-0fef-4d37-9094-ecd4bc5e3ad6", "comment": "Malware payload (Neshta)", "value": "b13f8559cc2ec9a8aee1b434d223c1ff0df40075d58a5f4e919ca0591f933a5f4455a3278fd9d2edffc92bd0d19c3ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504348, "uuid": "7895ded9-880f-4b6e-891c-b46b97f19579", "value": "T10DE38D4673E054F9D0265678CCB69614D3B3BC364A78934F37A43B5A5E733822D2EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504348, "uuid": "c0f8d07c-8468-43d9-a44a-48e43374bbfe", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504348, "uuid": "af1ea6d2-874d-46fa-958d-94eeb1f1081d", "value": "3072:sr85CkkbAYn2GgYlBYN2fHYTo+pNt8wDSRUTT:k9xbAMpgY3gTR8DRUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504348, "uuid": "568d76bb-89b8-4525-8690-836f00def017", "value": 149896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504348, "uuid": "75c4efaa-0f55-48a5-84f9-97cceb690988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504348, "uuid": "a6c11afd-d5e0-413d-8b64-49f57770cb99", "value": "009e272f31002936c47b7b8bea9f1dbcbd4f106f57787cf9d76588781202adcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a6520b-f4a3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712469341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469341, "uuid": "54a490de-46e3-424e-919f-09a45c91060f", "comment": "Malware payload", "value": "68ab70189c18ea0f01e27846bf44fb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redteam", "colour": "#66A32B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469341, "uuid": "dbe67501-b07c-443f-bb62-e78a0e5a1fcd", "comment": "Malware payload", "value": "014c71aaf8d2bad59079b20cfa748cc4ee25fef57d3aafd4864410fb05b2c23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redteam", "colour": "#66A32B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469341, "uuid": "a29fdaf1-c1e7-4ec1-b8a8-267d3c1e8708", "comment": "Malware payload", "value": "88d5dbff87ef4f35a533b058675d2b8dec1eb7bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redteam", "colour": "#66A32B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469341, "uuid": "9335cd8d-d4a5-4266-88ea-024b8a18b31d", "comment": "Malware payload", "value": "4c899677f0b826db61139993716f50ad804239453a7f9148cb667fca3fddc11f296b49d0414f5fe9421b1b690dd3ca22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redteam", "colour": "#66A32B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469341, "uuid": "f5713eff-7ccb-486a-a64e-989b7c2010bc", "value": "T1ABF5AE0F77830EB9F166AA32466392A5E725BCF129D16A4F202DF34C1E36B414FF5948", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469341, "uuid": "304aa0ad-a91c-4fc0-89d7-08472b3694f5", "value": "cd89a08ea1160ef07f07bb71de292e49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469341, "uuid": "89a7e0b7-2399-473d-974a-227caa73b7f8", "value": "49152:DOwgIV/wsfa9LLP7eruqQE4ovYqtyFV3aipRrVaKS7ZF5TChL8gpIzHrylucI0hS:XVoQCAjA0hkIS2j8wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712469341, "uuid": "259fa7df-6a08-4140-938f-035e3b0b4cfd", "value": 3325608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712469341, "uuid": "83ceb725-6a74-4a33-b8b9-98f33db71896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469341, "uuid": "35988c35-0d37-4399-91c9-7d3bfb6f3888", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad1c523-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503814, "uuid": "94843c44-f6ea-40d4-b42b-6c20304dd61b", "comment": "Malware payload (Socks5Systemz)", "value": "5693ac58ff470df74680e972d0734b9b", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503814, "uuid": "bc1e178c-9fd0-4f7c-8ecb-08160f086712", "comment": "Malware payload (Socks5Systemz)", "value": "01873a7ac9178b902292e2d9b232dcf1646cb6eb76e03de4770fe7ba2e73279b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503814, "uuid": "bbca0b72-5de4-4bab-813e-1f963c61a33f", "comment": "Malware payload (Socks5Systemz)", "value": "3cd4b63a8dd58996c151bdaea484311c8ec43b23", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503814, "uuid": "61164ccc-8e24-404c-ab91-f03bbcbbba3b", "comment": "Malware payload (Socks5Systemz)", "value": "41d8d4a8f38a5b16c6287e9a4c819fed29885de61f5c651428ce4d3759fc7186ead8e3ae66f0dcbc3f7c53ba6239dbaf", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503814, "uuid": "f5985c59-5050-4a2e-a354-dfd7f2f96082", "value": "T1BAE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503814, "uuid": "e8f49d09-1472-46e3-8b29-94cbe8de68e9", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503814, "uuid": "fc4d1ca8-7fe7-4056-ac7b-84a34a830ca0", "value": "12288:O+XssgiZdvAeRwO+aFHV6du9zO0txWFNx04xY9kOjjI1Y4hwfS9wxjby657Rk2kJ:KsgwdvAza16du9zO0txWFNx04xY9kOjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503814, "uuid": "7fa1b287-2651-4c5d-a765-18095c558019", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503814, "uuid": "c93bebfd-4f1f-4f68-b766-87f1c882fbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503814, "uuid": "c264e065-415d-494f-bcb6-ebbaae2e7b53", "value": "01873a7ac9178b902292e2d9b232dcf1646cb6eb76e03de4770fe7ba2e73279b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b7797c-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532857, "uuid": "be72203f-0622-4670-817f-1639894264b6", "comment": "Malware payload", "value": "474a59385c497167f2d71bf7dfb839a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532857, "uuid": "112b59cd-5c3b-4746-ae50-9fb8c0cc4090", "comment": "Malware payload", "value": "0195f851785ee30eecea90bc5cf745296719b51306c7d4070c0b48c92c63141e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532857, "uuid": "0484c514-7ab7-4f5f-85a9-eedc9ca1b720", "comment": "Malware payload", "value": "c078f71203017a3a622aacdc02fcdf58282321a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532857, "uuid": "26226ef2-64db-4fbc-b0e1-65d42935e635", "comment": "Malware payload", "value": "dd2d31afc54d707d8e35aa116014e200b2b3421936b7a4d48657358375e0602d8ba5fd566815632d63c51f7a8d7dfae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532857, "uuid": "f330b06e-a24b-41f3-b9ba-5d2219f84077", "value": "T161331A49F352D0A5D1B3D6B0302E87166771EF249892B7A3FF993A7938B1314E51139C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532857, "uuid": "3b7f3e2c-117a-4bd7-84c1-f7e62c28fb2e", "value": "768:QXhyD2ALhxy/QvLx9cNPsyzdGB25FNSYCKe62YkQV/ds8+BU1:TFxWQvLx9m0OdGYDN1Crq91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532857, "uuid": "7796ae74-85b6-44eb-996a-80f28ac1e923", "value": 55096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532857, "uuid": "0a3a2b65-772f-4de1-81cc-dc500d0ce092", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532857, "uuid": "653bf03b-1023-43fa-90c9-77c4cc68895c", "value": "libv4l2.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff4f87d-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532760, "uuid": "777b57a6-1cc7-43d6-93ff-1461bfff1317", "comment": "Malware payload", "value": "4956bfe409eb7e5b6ce1e3a23ae39adf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532760, "uuid": "3cccc50b-2b6b-4b74-ba2f-9ace422c54ac", "comment": "Malware payload", "value": "0210e96c2239c03e38317fbc1c68c99f25e38c52f5856c08eebc8d29b65a5465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532760, "uuid": "f4d0fec5-8ddd-41c9-81e1-08b09f77c094", "comment": "Malware payload", "value": "820370202aed1df588a1e2f3fa9c6f6460f01f5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532760, "uuid": "5a12cadd-689f-41e3-8d2d-5ff2f3f3ee07", "comment": "Malware payload", "value": "934be78c19a0a8a34380250e31a2f06c1500681a532b8c866ea13a28d4f4be82bb09de5be516ce29a79f894ae252db68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532760, "uuid": "a0a08c9c-21f6-4afc-994d-d60c8dfeb9fe", "value": "T146955C5BB2F364FCC09BC530439BD552A975746402322D7F7AC4C9302EA6E742B6EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532760, "uuid": "7309f409-5c4d-4cf3-acea-4b730fa2e881", "value": "49152:RCqvjmad2jpt+O7EWt5TfGvPy4ZOx4x8O4DLAdDwezL37L8Tx8XUYDbyPoVMv:RCqvjmad2jpt+O7EWt5TEPyti37Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532760, "uuid": "1b8474ee-0165-49ed-bb02-53ec89e2e4f6", "value": 1948952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532760, "uuid": "e4487e95-b907-4f43-9968-2e9aa17431a8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532760, "uuid": "c2a2386d-dd8f-49c3-93e2-5865621e2827", "value": "libc.so.6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde1b497-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503819, "uuid": "bea500f0-1127-4631-afa5-d273e9ee9fd2", "comment": "Malware payload (Socks5Systemz)", "value": "9b876d9dd6b5077dc1b54a019225d55e", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503819, "uuid": "931c6a74-c40d-481e-b3b4-af2fa23ac6ee", "comment": "Malware payload (Socks5Systemz)", "value": "031c3a416b0736fcfef021adbe95ce07db63783698774c5e47b8fc0bb543789a", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503819, "uuid": "1974ffb8-e8e2-43ae-8343-b74e30e5c80d", "comment": "Malware payload (Socks5Systemz)", "value": "8d8c3ea3538f4d7769bb5f8d816d4b7623fc6f12", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503819, "uuid": "13332424-ac9e-4426-96bd-c2b35370ddd7", "comment": "Malware payload (Socks5Systemz)", "value": "0bd9ec6198340a3f2d7e618fc575bbf3450794b3b5854ac836be7d1480045e06a414392db26b837b362c594ea6b823fb", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503819, "uuid": "4c1f13b6-10f9-4a4d-b09e-19a23b9a6d72", "value": "T19CE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503819, "uuid": "f4b18782-7e18-44bc-8602-b77856702f99", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503819, "uuid": "ea37c97a-b7ca-4304-83e1-e7aaead2dee2", "value": "12288:O+XssgiZdvAeRwz+aSHxoHu9zO0t/WvNx04xc9UOjjI1Y4hwfS9w/j1S657Rk2kN:KsgwdvAKdRoHu9zO0t/WvNx04xc9UOjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503819, "uuid": "aa49c377-819f-4120-9bda-c6cf1a7d45c6", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503819, "uuid": "2a07ac1c-b2cf-4e5b-977c-3de1f644b17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503819, "uuid": "883bf8cb-da42-428d-b4bb-f79a56c506fd", "value": "031c3a416b0736fcfef021adbe95ce07db63783698774c5e47b8fc0bb543789a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064c9397-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509094, "uuid": "8ba1546e-7b38-4dea-87f8-4e38c72f152f", "comment": "Malware payload (Mirai)", "value": "4856035c97b011ba90de21e3105cecfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509094, "uuid": "1d0d45c9-3248-4ac6-bc08-43e75208864d", "comment": "Malware payload (Mirai)", "value": "03c3f52b3efb06218fd83fb6efa0ba447da6b65b80446c5e08dd7d1150bcc1e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509094, "uuid": "f534c54a-e090-410b-81b6-53486ffdbd88", "comment": "Malware payload (Mirai)", "value": "730859e2d19cb9ea976a2aae9037c16d9ca79d20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509094, "uuid": "7818ba33-b7d2-45bc-9c29-ad39c106f451", "comment": "Malware payload (Mirai)", "value": "f1276f2485215c2fb224490c3beb35dd42c585dc0c20e56c57d275d7250a247c135391710106b384b83945a66c1a6c68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509094, "uuid": "864e2935-1f6d-4d92-a1e1-87a4ef24a52c", "value": "T1F5634A65B8814A23C5D4237BF66D468D3B2563E8E2DF32079D212F513BCB82B0D67A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509094, "uuid": "42183c5e-1a65-43f2-b32e-66e8a31b7a03", "value": "1536:fS1XalswyLzCTUcLjpMp2YFFEjNRvoBrJa10Q:fS1Xas3pVnERkr41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509094, "uuid": "96dc1571-63e7-4175-a222-9c930bdb05a0", "value": 69012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509094, "uuid": "134be46c-11ea-4f86-aa0a-5915772b28ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509094, "uuid": "acb7b221-d2d5-4bd8-9d8b-54dc06b34225", "value": "4856035c97b011ba90de21e3105cecfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef7ec9b-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503821, "uuid": "839ac72f-9f6f-40d7-95d2-ab6b383c24fc", "comment": "Malware payload (Socks5Systemz)", "value": "56b646f1045ae914b570f9e049315b27", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503821, "uuid": "d5d08dab-8bff-4ad6-b726-9f25c7c74e68", "comment": "Malware payload (Socks5Systemz)", "value": "043076f88d04050fef4e55ddea2052227dd8b023cce15210fd991f163cb3d960", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503821, "uuid": "e7eff1da-cea6-4937-be93-08881ce9145c", "comment": "Malware payload (Socks5Systemz)", "value": "e20d5ea8dccb5702ab29e02ca08948e5bee98378", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503821, "uuid": "99cfe2b9-cbfe-4eb5-8c64-d4c5b0e7dea4", "comment": "Malware payload (Socks5Systemz)", "value": "249a68c7c48c152f7ddb76c1ee76dca3c7849128397332399936142399a0e066924515f012f330a0f87a6485e3d612b3", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503821, "uuid": "067ed86e-ed9d-4054-b847-5d71bcd6aee6", "value": "T114E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503821, "uuid": "a1996ea9-12a5-4c9a-a953-bd91dca36a8b", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503821, "uuid": "2b0d6f18-c551-4a45-9f22-6b9f368fbdf4", "value": "12288:HjsgiZdvAeRwwk+a9HR50cCN5Bq4FcvpWwFjm9RKLiTOkMRpsHoGkViIjcBDQg5V:DsgwdvAuWx50cCN5Bq4OvpfFjm9R+iTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503821, "uuid": "97b9aedd-088c-4159-b7dd-efbb6e4abd61", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503821, "uuid": "809bfe04-a550-4ce7-b410-c5a6a0bbe95e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503821, "uuid": "f0d2066a-d1b7-438f-8dae-8b0a5c47779c", "value": "043076f88d04050fef4e55ddea2052227dd8b023cce15210fd991f163cb3d960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00a55b8-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503823, "uuid": "ca71b751-354e-4742-9dad-1fd1828d7135", "comment": "Malware payload (Socks5Systemz)", "value": "a1a3d67c7ff3b97547170899edaa0cd7", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503823, "uuid": "19093d1e-4fd7-4ca7-9d35-61f1dbbf74e5", "comment": "Malware payload (Socks5Systemz)", "value": "06763ded711128494a301b20aadf21474f7a2ceffc4c707819292609bf16c8a1", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503823, "uuid": "0cc85124-bc85-49e0-9625-97626e60eee0", "comment": "Malware payload (Socks5Systemz)", "value": "01a884f62603bf983e941fb47d2ce4ef6175222f", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503823, "uuid": "d1cb7725-d7e6-4443-833b-6aab4daf88c9", "comment": "Malware payload (Socks5Systemz)", "value": "e41e22739493c74fd1d82b963301fd1633b05727b7362ea9c84649e3eb2598c2ee70e66dd58a1d5dfae0b4f5ade5a41d", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503823, "uuid": "1179ee98-70c4-40b0-9ed5-4d45aeb6eaa7", "value": "T190E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503823, "uuid": "9d574bcb-7591-4135-955e-208afa5a272e", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503823, "uuid": "3033ea9d-681b-4533-a94a-59244c6afbec", "value": "12288:HjsgiZdvAeRwp+akHr50cCdkBqu4cvpWwnqmTRKLiTOkIRpjH14kIiIjcBDQg5Ee:DsgwdvAgrL50cCdkBquJvpfnqmTR+iTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503823, "uuid": "694f57ae-1c81-48fc-8bc1-7f594e405384", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503823, "uuid": "eb71770a-bb2e-495d-8fc4-dcdc7887a568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503823, "uuid": "400c872e-cea5-4605-89d6-c57f9b1fac55", "value": "06763ded711128494a301b20aadf21474f7a2ceffc4c707819292609bf16c8a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbfd622-f536-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532434, "uuid": "e46bc045-ebbc-4c97-869d-74b83e0f53ec", "comment": "Malware payload", "value": "515a67d66cf918d95cd4ff7eb3400b0c", "object_relation": "md5", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532434, "uuid": "ea37bcba-3924-43fb-9897-e0ee9dcd3d1b", "comment": "Malware payload", "value": "0678d45999c74be28f7ac23b78cb74ad543d177c19e8ea0090976e879772fe76", "object_relation": "sha256", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532434, "uuid": "269587e4-cd10-4d47-b36b-b0edbf6574de", "comment": "Malware payload", "value": "cfc05e14214da054b87f2ae5d5006d8f0fb67886", "object_relation": "sha1", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532434, "uuid": "dd36a7b9-bf50-4ff8-8885-b1e228a3fd88", "comment": "Malware payload", "value": "408028167b39ecd9611988a5b6b9fb1cf8001b9ea2146fede169e91bc4cb9ba06c33c0eee6f875128d8d91ba76d69fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532434, "uuid": "c80bd527-6a10-4bd9-ab5f-e24a1310e2b7", "value": "T17CF62947A7B105E9E6A6DCB8F1DE6922F5207C1E40203517BBC88E623F94725990DBCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532434, "uuid": "a557bd51-28a1-4765-beb8-1c187c2f8c4e", "value": "196608:mhOckM8nVznrJ96kpdRTtyNeDYCvM3B7yJ:m+V+SENeQNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532434, "uuid": "d8070e71-93be-40af-b533-fd51e5e18660", "value": 15533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532434, "uuid": "3a6fe908-7a93-48b0-baa7-5c144bc3a869", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532434, "uuid": "2818f571-7605-47da-9aa1-266b11a7d723", "value": "libclamav.so.12.0.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f4941c-f4e6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712497986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497986, "uuid": "fe62ab59-1f84-4113-9854-2131c0aaf0b5", "comment": "Malware payload (AgentTesla)", "value": "c15b90fbaa2800b331e9216b77a29725", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497986, "uuid": "f88a591e-2eb8-44db-94ae-583a9bfc69f1", "comment": "Malware payload (AgentTesla)", "value": "071fdf3d332a5a7dccfc49c2db122868a4c0cf104e60404fb180bb414a3ae943", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497986, "uuid": "18e491aa-6c65-4d92-af61-169995aaa633", "comment": "Malware payload (AgentTesla)", "value": "2880392527958868e6456b93d6fe97346f9de22d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497986, "uuid": "d57f0ee6-c062-451e-9a46-a51662ead65e", "comment": "Malware payload (AgentTesla)", "value": "cfbe2dce6e37cdcbdd6c6bebcbb633207b9465c4789356037d203510f89abd0f8d9696619cd7006431477d900f197fce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497986, "uuid": "666d9b07-5d56-4de8-bf78-c39feda1478c", "value": "T12DE4239232EC0EC1F6FD073B95A5192A0139A0077075EAF859D83AD72FB5F2D264821B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497986, "uuid": "956302f1-9feb-47b5-8483-109280ffcdbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497986, "uuid": "ddcce94b-a668-41f8-b277-ba7fd13668d8", "value": "12288:IbGFm/1COTBpb0lhd+4tLnrNjouykQdx+rJWNTo32YedtUZlxMvwDB4auXotqD:IbGiISb0FN0uykQdx+0NU32XdsA4Dmac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712497986, "uuid": "94dc735d-f607-4cd9-bb0f-f5a4c7498954", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712497986, "uuid": "ebcd1141-97f0-4352-8200-43e4a2ba6916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497986, "uuid": "d5a22816-438f-46c6-87ec-9ce98e385fe0", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa14aa25-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504349, "uuid": "3fe276cf-2f00-46b7-b0b5-fecbd0a3e532", "comment": "Malware payload (Neshta)", "value": "dcd95d497146a75436d64297f5793aae", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504349, "uuid": "51c152bb-1246-4e72-aab5-5858e2094e86", "comment": "Malware payload (Neshta)", "value": "072ec2d6bd4561da9af511f0fdd7c81942944384bdb8506ed6e63579e909aef9", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504349, "uuid": "816216f3-a103-495e-ba6c-a8f7b72d71e7", "comment": "Malware payload (Neshta)", "value": "e363b41aeb11ccf10d8c67c381c6c235d1ff03b5", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504349, "uuid": "97eb67f4-6330-4c47-8cf6-ccaf25562f77", "comment": "Malware payload (Neshta)", "value": "a9e9ad5d2d87f1c8948ee63fca0b20b9bd2a7ab967b9f32954aa552fd1b57679d2e7bbb24508c555a3ead808911b9bd3", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504349, "uuid": "7208d7fa-2dd6-4385-b6a4-762c4abcafbe", "value": "T167837D96F6E1C872D1340EFC9C268228D57B7A317D2A2AB2BAF51D4DDC6D3D12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504349, "uuid": "84cb2187-54b1-475a-957d-20ff180ab0bb", "value": "1536:32xqjQ+P04wsm13xqjQ+P04wsmJCcBJB:3Xr8lur85CcBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504349, "uuid": "434ee565-3944-4bba-b385-f90588433c9c", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504349, "uuid": "9d9c80bc-6963-4d49-b455-51f76accd264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504349, "uuid": "c8863c78-2309-4f67-9fff-dc2b4980d97d", "value": "072ec2d6bd4561da9af511f0fdd7c81942944384bdb8506ed6e63579e909aef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380af9d6-f473-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712448619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448619, "uuid": "346f1547-b36f-42d7-a2c1-ed55c5db69df", "comment": "Malware payload (Socks5Systemz)", "value": "daac1c200afa890482773567deae1dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448619, "uuid": "621a4345-1e32-4e95-82ad-aeee7508eb60", "comment": "Malware payload (Socks5Systemz)", "value": "075681f085776e64df7244b06045f44ba8ce90b5286012f4841eaf6b54b869db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448619, "uuid": "c99a6266-fada-4b92-8f5a-e9e462bb8b90", "comment": "Malware payload (Socks5Systemz)", "value": "73de0b1a64a2030c3e51082a9bfcc9aff3d9afc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448619, "uuid": "04f038c6-10a9-4745-9e8d-1a5d9d4ffffc", "comment": "Malware payload (Socks5Systemz)", "value": "90720e89c4bbc169893bf15bf8d9e5016c755bc1fe45b0ec879caebe62a2f0f67b78d887ffebc0874a3445b758386f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448619, "uuid": "7918b3c5-0a9f-4559-9312-8382eaa0f8a3", "value": "T1E816338165B1B4B0CE538CB8CC436D8B96227F555831EA0E7ABE4DEF1B63D72B44A11C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448619, "uuid": "9c959e31-bbb4-4210-beb2-baef24ca13c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448619, "uuid": "c8b5e8ff-1950-4e77-a664-2e75af7d5759", "value": "98304:COdOaTeUeuvAMQJs063zvbdEdr/cRdQCZFgPml8Qx6E:7nTZeeAbQ3Pd2/KaeFOJQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712448619, "uuid": "ce64f6a0-d7ac-4243-be28-b449aa21fd44", "value": 4332787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712448619, "uuid": "3f00bbbe-4ceb-477f-b415-61a81835879a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448619, "uuid": "1f0ab2ec-d61b-4791-b08a-f8fe5e5ae528", "value": "daac1c200afa890482773567deae1dc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be061ddf-f534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531737, "uuid": "ba6d86a6-db48-451d-9f77-9061aaaaf88e", "comment": "Malware payload", "value": "66dab8697e68b347cd9838281b5da971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531737, "uuid": "6bc890e1-2a49-4db5-bf31-f90bab9eb43c", "comment": "Malware payload", "value": "07f7837e4beb75ea044010d1f6b35e61f77c5b70e77140d413f306b64e014865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531737, "uuid": "52c116b0-676c-410d-8447-aef9ba6d185d", "comment": "Malware payload", "value": "d6b5f99d242be0857c32ceb021bd0b62cc31bcb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531737, "uuid": "2d06b2ce-181f-4c1c-84d5-8b5dc5bc98f2", "comment": "Malware payload", "value": "832f32a1a4d219e04910643f6ef1c0241f06022b2fe61fe69f468adcf9c09dc5a8f45f3b7b10e18bfe0549e54c4fff80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531737, "uuid": "592126af-0176-4499-ba58-ae3273c72b89", "value": "T193A54D0776F248BEC4C9C830966FD2569D30B0C44232697B3E9499B11FD6E786F2EE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531737, "uuid": "b17d4ba7-8d4d-43db-a919-f4e640c2d600", "value": "49152:zAQfHYahKVBje21qwtSSSt0z+1AmG0ft1:THYahKjwwHO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531737, "uuid": "cd242ea8-2154-415e-bb03-4f3ac7a38895", "value": 2126240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531737, "uuid": "c9a64aa8-b35d-441b-a7f1-359ff7f9bec5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531737, "uuid": "02ae8fb8-2e62-4029-b3a4-f56acc31de06", "value": "qemu-hppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996cc9e0-f482-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712455225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455225, "uuid": "bf369f20-1f4d-4584-bc0a-40dea5cda225", "comment": "Malware payload (Stealc)", "value": "2610e965a06e11cddd08e637b2620da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455225, "uuid": "701a980f-cea6-4d1d-85ab-f0447e360d55", "comment": "Malware payload (Stealc)", "value": "083cd293268c04593aed4ab2a89e31b7c694980aa32e6dcfde239a4cfdc28afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455225, "uuid": "ccbd4cd6-d047-48e9-927f-4aceaddf18bb", "comment": "Malware payload (Stealc)", "value": "a0e7b3c36964613e2060b4c07d6b581221c9502a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455225, "uuid": "b938b995-ce5e-46a3-b533-0103f12f8456", "comment": "Malware payload (Stealc)", "value": "dcc1971295b028ab543d469edb2a2403b7bcad991557c699c0e6bef06cdbce8e7cd85fc127f44aa4cb4dd1fbf51a9d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455225, "uuid": "7dc52546-a3af-440a-ac8f-85e4d5c571f4", "value": "T1B6645C839AE17D50D9274B728E2FC6F87A2EF9608E5D776A2218EF1F14B01B1C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455225, "uuid": "3cccabfe-3358-43fe-89a2-6d1f38ddd2ff", "value": "184895d232d8f733bc6c4bc24b3348f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455225, "uuid": "97e91a25-6035-4cd5-8ce4-882dbdf1e20c", "value": "3072:77+9mRLwmKaU2dQ1citrsV+FdgsH/4iyjjHTzJGvkTzX3VE51zdR6+B:v+sLI2dHUi+l4njjH5GeWzdRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712455225, "uuid": "25b82701-d4d8-40ec-a859-8453e9dadd2f", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712455225, "uuid": "8d94c052-57d0-41e7-9a2b-dccc8c67f33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455225, "uuid": "b2dc4b01-f5ef-4a44-a441-544c4e2b2150", "value": "083CD293268C04593AED4AB2A89E31B7C694980AA32E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bb0b51-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506604, "uuid": "2ce1ddf4-3aae-48ad-b7d7-4c469f697f6b", "comment": "Malware payload (Mirai)", "value": "29835143503e135e26123e83164fd049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506604, "uuid": "edaa4734-e3f6-4aa9-a56f-5a664ba282b2", "comment": "Malware payload (Mirai)", "value": "08abbc0ff270f6872092c713f99b3f389485eea7dc3c5eb54c506c88958fed1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506604, "uuid": "ed4d0258-35fc-4885-9f7f-e7cc567d1a9c", "comment": "Malware payload (Mirai)", "value": "5a1f42d7a5e08a866f4283617bdc3153e7d71ba9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506604, "uuid": "8f30a2f6-ffa4-43f3-b54a-a88b8ca8e0da", "comment": "Malware payload (Mirai)", "value": "98bca46f91183eb788ef1c7ebfcaedb59c254b1dd9d62b4608859bc31f0672e7dcab18bef1cb0e2565d6cd33f281f271", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506604, "uuid": "d10496e6-1c24-4a1b-a857-96ce316cb506", "value": "T1C363954D3E668FBCFBAD863447B79A225299379A3691C584D19CD6012F7024E300FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506604, "uuid": "ee5eb682-451c-425f-b191-a47d855ca1b9", "value": "768:PX0Kl09ZHpe/zlx+fhuKKCHreFJqU5sJOkcD4F9NHwFR0B3kGrDyfGccyi2ZvB8P:wrHs/zlOuKpfOtD4F9ZNCOpccMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506604, "uuid": "e763e513-2970-42b1-a43a-6863833c23cd", "value": 68336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506604, "uuid": "11d948c3-21f7-4fbe-8c7d-8ab8fb00beef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506604, "uuid": "55862697-eae7-44f2-a092-4f43f77d6f26", "value": "29835143503e135e26123e83164fd049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023c0bd8-f476-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712449817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712449817, "uuid": "67b5e455-502a-4bd1-ba36-674ba7e64965", "comment": "Malware payload (Socks5Systemz)", "value": "921bb6e3a86de7e4d28447a4cec13e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712449817, "uuid": "702f0992-6040-41bd-9f9b-fb83a0018665", "comment": "Malware payload (Socks5Systemz)", "value": "098a35dc7ec119ef4f9ee52734366b96942a5f594dd343a7763b63e188ef2590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712449817, "uuid": "6cba325a-4474-4ea6-b3db-37e4deb8414a", "comment": "Malware payload (Socks5Systemz)", "value": "c58eeaa11a1ce14b6ad3dfcffb4152647d00efcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712449817, "uuid": "5907305a-aaa7-412e-8d25-7b255246526e", "comment": "Malware payload (Socks5Systemz)", "value": "678fa6636f058b25d91d6768ad7319e2bda94030d51cd9352db778df7c1cca9115cd3b9a1753b5da912833d316e5da46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712449817, "uuid": "354ad0f5-40ad-47e7-9026-f13b49d6f259", "value": "T14116336BD08EC9B7F8D6AEF52E78C60DBF731F219420461534B85D9A97B6023A48C3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712449817, "uuid": "23609695-6882-44de-a990-3675461eb249", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712449817, "uuid": "114831e0-5dd9-437d-a1ed-6cda4b542684", "value": "98304:CcCFbVUdWyGUOv9bp/GGftB0yPc7UZoHFa/8670o6GZRNQx6E:HCdVUWdGODzo8/Bb1dQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712449817, "uuid": "28ea3ab5-5dde-4fa4-9572-c4749a378c9d", "value": 4347163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712449817, "uuid": "01d3ff3f-068c-4e1c-bd35-3a0c3c91e1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712449817, "uuid": "4381b2dd-6bfb-4979-a100-5537fce77c6b", "value": "921bb6e3a86de7e4d28447a4cec13e70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d187898f-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509435, "uuid": "c63077fb-1e13-4bb8-b35c-981852b2cfb4", "comment": "Malware payload (Mirai)", "value": "0c10fce1ef994bd79459747ad52a1b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509435, "uuid": "06b09458-ecf7-4b4e-a772-043f617dbccc", "comment": "Malware payload (Mirai)", "value": "099a8c12f304320b3eeda78169a1493f078e12ff166652b851dbf9da4b4e569e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509435, "uuid": "18213106-6e15-4002-a152-60d052edc6ae", "comment": "Malware payload (Mirai)", "value": "2c635bd189b7c9c142fc26b38fb63d9ffaecb2be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509435, "uuid": "68248f4c-1980-4e2a-aa09-1b2c3fc997b5", "comment": "Malware payload (Mirai)", "value": "e7c45e4ea574daee471025c3ebfd572b746d25b173b3cd12cd4ac7d0ac248e2d685297bee6c1f376e201e6ed8d4e7e6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509435, "uuid": "889a6f1c-b95d-4309-9f99-cb50008b72c7", "value": "T1B4B35AC0F98BC0F6E81708758067B33FD73295255039CA9BDF999EB7CA63A42561B20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509435, "uuid": "4c6eda17-6636-4860-9e56-e5ffc267123d", "value": "1536:XSZkBwfjSPnYzAgBE5df3dW0UeokeXIBQih7CoWjux27x06:xBpgBIdgxpk6ImiSS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509435, "uuid": "811e6cb0-fd2f-421b-8372-3882d6da3248", "value": 116140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509435, "uuid": "b70ca920-4e21-4b69-a7b5-1bcce9d40a14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509435, "uuid": "f532c876-b4ec-4905-86df-f1e334c86a0c", "value": "0c10fce1ef994bd79459747ad52a1b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f81b21-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503826, "uuid": "6dc21b8c-6c4b-4a72-8534-780cb7e15481", "comment": "Malware payload (Socks5Systemz)", "value": "b71ddaeaa9ec76e9f4ead5a1ed93c948", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503826, "uuid": "6520c670-a9dc-40bd-a8f3-902f1b267a3e", "comment": "Malware payload (Socks5Systemz)", "value": "0a1aaf146eaca021dedf875919a4f7f13e0c8245147263c506c22e91da3f2d53", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503826, "uuid": "b45f9e4f-d6cc-4876-a981-986f33382b95", "comment": "Malware payload (Socks5Systemz)", "value": "8f4e0fb1b7e446a7921bd3723407a841e2a2fd69", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503826, "uuid": "92689b35-5121-45cc-a19c-64ac79b3cfd1", "comment": "Malware payload (Socks5Systemz)", "value": "3e02cadb47a1381b50cb125e3bed262871a5f1e00e18ef4bda9a05d759c98742fcfc10dc0bc15d31d226059122a0e7f4", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503826, "uuid": "ebc6b47d-f9ec-4826-9da9-140579d87693", "value": "T182E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503826, "uuid": "79c4d9a6-d39c-4ac5-8bc8-7b3411096597", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503826, "uuid": "01b74231-e1a7-4028-a242-e13487f6f947", "value": "12288:HjsgiZdvAeRwd+agHp50cCV3BqIXcvpWwJVmtRKLiTOkoRpGH6GkviIjcBDQg5Ei:DsgwdvAkLJ50cCV3BqIMvpfJVmtR+iTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503826, "uuid": "fea5e3bb-1b59-467a-95e5-1f331e2b6744", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503826, "uuid": "6da3275f-9f3c-46f0-a2be-6a1c0135282b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503826, "uuid": "adff2ba8-1b80-4792-95bd-2f0fe917b5b6", "value": "0a1aaf146eaca021dedf875919a4f7f13e0c8245147263c506c22e91da3f2d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783ea2c8-f4c7-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1712484804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712484804, "uuid": "2b7f5a28-aff3-45a9-9749-710c5960f4c5", "comment": "Malware payload (NetSupport)", "value": "b08b5c82306385f052353c7deff767db", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712484804, "uuid": "a1c6a395-43b3-4eeb-9447-0410d54bc80f", "comment": "Malware payload (NetSupport)", "value": "0acb4b0b9141522ba0daf85ea29ea2c2808426ef241a5bac4c9141116ebf63ba", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712484804, "uuid": "b2136138-bfda-434f-8bb5-61032ef8fd0f", "comment": "Malware payload (NetSupport)", "value": "ddbafa71ec2063ba62f35184afb3462eeb36140d", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712484804, "uuid": "54c22539-fe79-4804-9b5d-fca17ed5e4df", "comment": "Malware payload (NetSupport)", "value": "9107a569163480552a6e80d8f0160371651ca182223b15872207a9a37e05989cafbcffbfa89c36c79cac1b164d6ab367", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712484804, "uuid": "89f2181c-103a-46a8-9a2d-bc6db128451c", "value": "T156E533064B6247E3F03790BD41252F2340A4927C73B8B437756939E7B8BBA71965BE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712484804, "uuid": "2fd9d24d-11ef-4c8b-8c13-e47ce7562be0", "value": "98304:Z89i7JDmWKwOA4qJtVqFLCr/L6BP+UomU:Z8oDmWKqtcLCrGl9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712484804, "uuid": "b5ee1b9f-23c0-44c4-aa07-1b12f2ceff04", "value": 3148994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712484804, "uuid": "e708320f-c5c9-4046-affa-e317a0297b61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712484804, "uuid": "24c624f5-babf-4587-b692-66a670a22a75", "value": "WWW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f6b3ad-f49e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712467267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467267, "uuid": "1690ac09-0741-4bb9-8f70-8796c0509311", "comment": "Malware payload", "value": "802809d3c38d888f5c6be39f3b387a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467267, "uuid": "ed4c463d-f830-4b76-a58a-7b766221c1f9", "comment": "Malware payload", "value": "0be6a9f06fac70193e315780b49052185255c614c8b94c73ba7e3afac2f018c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467267, "uuid": "6dd11ce3-598d-4dcb-b1fc-54ccdd14f338", "comment": "Malware payload", "value": "c386e6f19c1b857435ab7f88dc4fc45654f1da9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467267, "uuid": "01f1cfcb-7fe9-4875-a12a-214265dc7ae6", "comment": "Malware payload", "value": "6df69c3796e741b35f877ae86b6a8f1c1f152ac78f9c47fdbe48134205347cf42655315b6067f5ecc739d61550f21fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467267, "uuid": "bc880789-05f4-4ad7-9227-06a8fe2770a4", "value": "T12F163326742540BCD65368B809E9A337127B1EE45950BB4B1FA37F8C7537193FAE0A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467267, "uuid": "da1f4df3-97ac-45fc-a4a7-242d6f1c4644", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467267, "uuid": "bd41acba-4e38-4cf7-87c2-7076c2d86c51", "value": "98304:5iTpBEi+oyNUpQOQ6mViqKrXe3eVvely8dJ2caohpzc:spooyMQniZO3eVc9Mc5pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712467267, "uuid": "0c232755-5457-48b9-abe4-4ce801105933", "value": 4328488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712467267, "uuid": "b4260493-3ce8-40b1-bc76-5b9f5b63e417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467267, "uuid": "260db924-b45e-433a-8559-e15c4fd70b3e", "value": "SecuriteInfo.com.BScope.Trojan.Casdet.30917.9881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96ce1ef-f4c0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712481988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712481988, "uuid": "4bc3491c-4298-445e-a546-1db002767567", "comment": "Malware payload", "value": "0c550ce9bb3efa8c3ce80a507cadfffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712481988, "uuid": "d319de1c-7463-4840-b36b-c62dcd025e02", "comment": "Malware payload", "value": "0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712481988, "uuid": "835a47e6-1237-45bb-a3e3-10919c64c3b2", "comment": "Malware payload", "value": "6559cb9db9c13147da5139cc3b8d9c60b914b667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712481988, "uuid": "0911c04c-33c1-433c-b48f-d769949f1456", "comment": "Malware payload", "value": "888ac418f5c6d3c00a579fddfcbe94f9ad433f64d77242436a388fce15b742f283ca63d2fae14be2780a7e4c195738d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712481988, "uuid": "3727ecc2-a503-4d18-b91f-19c310ddfcb7", "value": "T1CB520B8A929C04D3F95A02F11A6B9E7FABE8309523525CFFD139D0650FB4723391E252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712481988, "uuid": "ecc8e257-b464-40c0-b86f-f45619c5bf49", "value": "30d35e90c7fc045dc052f4030df3d03c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712481988, "uuid": "655bcfcb-8358-484b-b0e3-0576af8fe809", "value": "192:yh4gD1GAhChMSXhCUFaBoU3rKgjwQx5K:S4gD1LhChhXhCEaBo+sQx5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712481988, "uuid": "4e4d9232-7c98-4c31-8866-0a2e97168a7f", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712481988, "uuid": "57dd8cd5-1cfa-4c55-a834-38a76caecdc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712481988, "uuid": "8fe28dbe-40df-4e55-af07-cc5cbfbd7389", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16769.10991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d23bac-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506594, "uuid": "79a75641-05b0-4129-b974-9c7442ad0157", "comment": "Malware payload (Mirai)", "value": "e7338fac41e4dd2dfc526db5883b0128", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506594, "uuid": "147e592f-16da-478d-9a45-396593912545", "comment": "Malware payload (Mirai)", "value": "0df50f0cb25d0f3eafcf25a49ffa0aa2a3e728a359cc8119bea18b286bb27b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506594, "uuid": "73fe7004-7745-4b65-8e2d-87cf3481272c", "comment": "Malware payload (Mirai)", "value": "a4ef969a7129d7fe2b0bc6dd19c81451daaf500f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506594, "uuid": "09970e96-a1d5-4af5-8895-7aab934810bc", "comment": "Malware payload (Mirai)", "value": "81b262e64bcdfdacecc06790dd2fde55d24b13b8107ece9accdc12a7f8e94061b694d997bcd0f2ccc5c93efda10aa67c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506594, "uuid": "4926ac3a-3d74-4455-8ec5-c1b8aafaf106", "value": "T19A336C21AD3A1E17C1E4B87A22F74715B2F5265F69B8CB4E7D720E8EFF2058069071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506594, "uuid": "4e7ca3c4-4659-47d0-9c47-42ef301d7434", "value": "768:l8Qo/3lQAFsH76pyTQkZgxXOgTIe90ndRiLnbO+2m5UDEXm5vhH:l8QcKAFsH7zG+gTI0/2dDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506594, "uuid": "8887f1dc-8aac-4fd5-9dcb-849ce011f15b", "value": 52448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506594, "uuid": "0923fd6d-ca8c-4be6-b4fc-e15d547ca81b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506594, "uuid": "c417c6ea-3c26-4c3f-8ce6-b64c33b7e0a0", "value": "e7338fac41e4dd2dfc526db5883b0128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136918eb-f486-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712456718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456718, "uuid": "062d8e48-0130-4bd7-b0e7-ef0174055da8", "comment": "Malware payload (Socks5Systemz)", "value": "aeeeea60909700ce674759cfd29d38f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456718, "uuid": "856ebcc2-b19a-4e4b-b5a5-ee5b092bf88f", "comment": "Malware payload (Socks5Systemz)", "value": "0e17ca40c6abf33153ab43e203fd8a50686128e55f0254e907f3e81864eaf118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456718, "uuid": "84b11e03-b6f7-4d49-9ae0-48240623bcd4", "comment": "Malware payload (Socks5Systemz)", "value": "7c3dafdfe6f026471252994bbfc96d2b8733335c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456718, "uuid": "8c11e5f2-011f-4c3a-ac2e-e948362e3b9a", "comment": "Malware payload (Socks5Systemz)", "value": "00db1f86bd6af893217e05d6e56b4818bfebde78e7546d1f124e4275ef886e51a5953e8e7df2f53058e1dbfd648a87c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456718, "uuid": "b0071729-3ebc-4f4c-9f74-b6b2892a6343", "value": "T1DE163347709A5ABEC6B09C32C48381B546BAFF4A1E717706344CCF6E7F266F0990D25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456718, "uuid": "5812a9ec-8cc8-4d5c-a3b0-340ae31ffcf8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456718, "uuid": "c7bcf280-cf1e-42da-a767-4b918ac76233", "value": "98304:CAs+iWhEhbPKs4hlvqwiUfvlnSk4GKthcti6pc4AkcypjEQx6E:Jh0AvqwimvMkGtKtxpc4AkJjEQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712456718, "uuid": "04d0eba1-7d4d-4c96-b765-f03dcdce28fd", "value": 4329464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712456718, "uuid": "33a90b03-3c79-4946-9032-fba69ed1f214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456718, "uuid": "cd7175a7-9228-474a-a46d-e73e86a5ef68", "value": "aeeeea60909700ce674759cfd29d38f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb5ed7a-f486-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712456975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456975, "uuid": "1df3d973-59b8-4273-a534-bed82189b7de", "comment": "Malware payload", "value": "768e34f58f474eb9f56ba14ace880927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456975, "uuid": "9d2d3f57-3be9-498f-88f2-af79e410566e", "comment": "Malware payload", "value": "0e583c8f9ae9941abf6744388e812aceca3a97578e8ad8aac001309faf2ffb05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456975, "uuid": "faa7d6b4-36ed-42e4-a555-f2cc1b8be1e1", "comment": "Malware payload", "value": "96c7d08c544f03b62aeff9ff0bbc516d2ec203b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456975, "uuid": "8eb42f23-0e14-485c-aaed-028485de1fcb", "comment": "Malware payload", "value": "102b5f71609e61f849c4afc0c58ea02737aa78cc9d0d5aed020306590ba34cc32ef681e920023dbe224ee2fe17b95880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456975, "uuid": "364d2b9a-7808-41f8-98db-9cd27b98ca25", "value": "T13936232611541AB4CD4509793DB38708AA8B15983B38B6FEF7B3C13B563A7343E12E79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456975, "uuid": "17949edc-2550-4fb6-9097-73668b784ab7", "value": "c80f08407c2acc5ddec41f11be16001e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456975, "uuid": "0acbb3e9-26f8-4421-8006-5ecb1099547b", "value": "98304:GcSHc0VSaJLUNja5TJPXLeCs3kbU/r/XO51Vabl1Dv9xLXY/01LhJawt:Gc90VSaUNja59beBDXO51VabDv9xbA01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712456975, "uuid": "cfccd200-3bdc-4c0e-a286-9a0aa3722763", "value": 5275928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712456975, "uuid": "64a71c78-b8e6-4a27-90b0-12c15d50441c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456975, "uuid": "b3335a83-dd42-4541-9c6b-1e243cbbd237", "value": "SecuriteInfo.com.Win64.Evo-gen.22367.19686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2093033c-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506562, "uuid": "097635a9-0156-43bb-a515-146cb47174e6", "comment": "Malware payload (Mirai)", "value": "2efb826d759fe946a0d002d6dc6f8a79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506562, "uuid": "d9e8e31a-294c-4f78-86e1-3bdaf3aee940", "comment": "Malware payload (Mirai)", "value": "0f0a1255fac5e594a98e9899bfcd129aaee340c59dec29b40aec1d147b0a183b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506562, "uuid": "c77de544-b160-461d-8703-d7edb56c4fe9", "comment": "Malware payload (Mirai)", "value": "c4ad932e8ec3cdc2d7e8ed4cd6c9950296bba092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506562, "uuid": "47286673-4c03-4faf-87ff-b5e63aa96fbb", "comment": "Malware payload (Mirai)", "value": "e7d01f0bad21fcd12d748f9b82a99793daa04d6826b0daa6f119e50514a0cbf004fdfdc3a8fbc4bcea6e4a960cac4ad4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506562, "uuid": "f1fe5604-5d8d-4fd8-a404-b209a7e2e01a", "value": "T1E804885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506562, "uuid": "81cc7bef-a7cb-49f6-85c0-bae758c6b6f0", "value": "1536:Cl2JvnXPvLEQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zIt/Y:Cgv/acwZsCK9VRhAX+bShFSP0HbbIlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506562, "uuid": "fcdf61dc-340e-4dd3-8eb5-ca8a03e2cd59", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506562, "uuid": "eaf34382-bbd0-4d68-b5b6-a2b5ce8da494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506562, "uuid": "a96e8ce9-4268-44f0-90b3-1f127520727e", "value": "2efb826d759fe946a0d002d6dc6f8a79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3112da3-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503828, "uuid": "c69d2f76-05f4-4040-aad8-fecd9c7f9bbd", "comment": "Malware payload (Socks5Systemz)", "value": "5ac589b9caafaa808018bd70750203e9", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503828, "uuid": "1244184d-89c2-409f-9e6b-a98a5992029d", "comment": "Malware payload (Socks5Systemz)", "value": "0f45facf70f43ae4280f89d332b0ac68c4921e975eb8055bd2ae370824ffc9e4", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503828, "uuid": "d24f634f-bc1a-47bf-9767-a55d37448d36", "comment": "Malware payload (Socks5Systemz)", "value": "4cd082044a656c6cf8fa076b55abc43657ad10e4", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503828, "uuid": "8427091b-f07b-4241-bdc3-4faf58353d82", "comment": "Malware payload (Socks5Systemz)", "value": "21afde79a159f126762cebc70af92aac301a70f466bfc5dcb0cb7dcf03ffec8c28c81edb2b0ebdc6c5c2445d94049e55", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503828, "uuid": "16cdab3b-e630-4f30-af22-480b13bc3bf3", "value": "T1C7E49DB13A0AD1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CC6A34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503828, "uuid": "a5e9c5fc-0ae5-404e-95a1-fc7757afcce3", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503828, "uuid": "f3dc53fb-3ad4-4e13-8a55-23aea12a4886", "value": "12288:O+XssgiZdvAeRwZ+arHBUru9zO0tDW7Nx04xU9UOjjI1Y4hwfS9wbjpi657Rk2kV:KsgwdvAwAhUru9zO0tDW7Nx04xU9UOjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503828, "uuid": "a04c793a-1a9d-4fb2-be6b-241c6fea30a9", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503828, "uuid": "97257ff8-86de-49bb-a4e8-4f207a7e78c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503828, "uuid": "c60878ae-3dea-4df4-b4be-8916b438ed38", "value": "0f45facf70f43ae4280f89d332b0ac68c4921e975eb8055bd2ae370824ffc9e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1147411e-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517703, "uuid": "0f1bc86e-05e5-4003-b201-934fe7a5b303", "comment": "Malware payload", "value": "97a8d565ccad8ebd1d1dbffd6d313766", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517703, "uuid": "bb04c92b-f41b-458c-b5aa-2471fababe67", "comment": "Malware payload", "value": "0fcda99c66e3484947f7e2b41f669ea28db5ec032a944ef8827e7e1625cfc937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517703, "uuid": "6b84a8eb-5cbf-46b1-922a-2424d461fdc1", "comment": "Malware payload", "value": "a4bff25dd1a02bd5f5a2d73f6b541a8af4587322", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517703, "uuid": "cf4f9cda-29da-41ba-956d-ce59568c2c76", "comment": "Malware payload", "value": "6d337193d566e19e123ce6c808a35a914b0fc2af28a586d3b803f1a4db7f9956b642cdbd9912f7e245cc792db8ee75fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517703, "uuid": "18f1d243-bcfa-44b4-902e-a660e5ff1ea3", "value": "T121B3C517AB618FB7C85FCE3306AA450120CDA15A12E97B6FB2B4D92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517703, "uuid": "4b59a519-1c33-412c-bbad-3256fc763b8f", "value": "1536:ZLeTukthhSMOCMQS+ZjN4pjuIxreg2OaRWk9wUmkiSFxfC7xbXe:ZVHC3S+dUrenRvwUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517703, "uuid": "299774fd-af89-4fda-8d24-b80cd7581f7f", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517703, "uuid": "22482884-f1ff-4844-9f3a-13067d98924d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517703, "uuid": "43c2c868-17df-4a58-8814-3fa5b091c922", "value": "97a8d565ccad8ebd1d1dbffd6d313766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033dc498-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509089, "uuid": "0abe49af-002a-4b49-8508-7f2b49d488dc", "comment": "Malware payload (Mirai)", "value": "e1885f9f01b125854a5a0695f0e16530", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509089, "uuid": "b184fcb4-5f93-46b4-a926-a199a6e862a7", "comment": "Malware payload (Mirai)", "value": "1004d46c2549b464111c49d683723a27008c4fbaf3e938a0d187607269ce3ebe", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509089, "uuid": "b7bd6b7d-0d81-4012-bca4-f30ad36963d9", "comment": "Malware payload (Mirai)", "value": "9d9826760adaefa7407c48be087cb38b660c1afc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509089, "uuid": "4803b18c-2a6f-413d-9af9-9acec6ed0466", "comment": "Malware payload (Mirai)", "value": "d7bb58fdd0a2953804564dedee589fe9edfe0122d3cba8fbb9185dd562488412e5499b4d0a743548879686b4d343f1cb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509089, "uuid": "e24d1dc6-535c-48b5-83e7-7fc5b5ccb01c", "value": "T199F35B0AB5C1D8FEC49AC1744FEAF236D972F4194238B15F27D4AB272E4EE215B2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509089, "uuid": "d4776709-b4aa-4c0a-99db-6322b4ee2263", "value": "3072:cHB4i8isR47EjJrZZzXnxFvbzllib4pcShn7BLJGj:cWi8B4u7hbleATGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509089, "uuid": "0547de82-19bd-4cc0-917c-6cb219da9b80", "value": 168200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509089, "uuid": "e660f662-ebcb-4b8e-ab3e-61232be0afab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509089, "uuid": "0c9dfe25-829c-4fe4-929f-00eceecc80e6", "value": "e1885f9f01b125854a5a0695f0e16530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaa152b-f4b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712475339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475339, "uuid": "c1534a85-3cf7-4848-a3a6-4783fd7a33cb", "comment": "Malware payload", "value": "5352cc70bce05f5289334e32dd8954a1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475339, "uuid": "b05be90b-921d-4a04-bafa-11fb29eb2f6a", "comment": "Malware payload", "value": "115ad640eacd6b18f1869ec290051846048d531843753aebd664447ec07273ce", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475339, "uuid": "21c6923b-dc74-49e7-8219-b2fc4689a4ad", "comment": "Malware payload", "value": "fae2b5d069b051dcd64fb0e181a3e7bb18a1818d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475339, "uuid": "76e2d29b-ee10-4776-b555-fab7559b0cc7", "comment": "Malware payload", "value": "d606cf6f70c1ebffa36b3dab1101cab8a7fb1e1768f1e8866ffebc81619468d22f6280173e0d67d100b355ad6fb8e5a0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475339, "uuid": "9910c29d-d601-4148-b0c4-0a41f49ffcb7", "value": "T138362357D52F167EE1812230D3CF059985AA9DF863F8D1C69E5084EF30AACACA176F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475339, "uuid": "7bde031f-1bde-4dbf-9ff4-1bc9c7d7c12a", "value": "c80f08407c2acc5ddec41f11be16001e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475339, "uuid": "3d612eee-9934-4945-a666-7a03859696dc", "value": "98304:Nol23oIFt3UPk/TMG7u9VDbnLMnXIjSMfCM7ZJHT0GkWPx3WEiRy1jdtRdaHl:GkoInoGqHwcggzV5mDRy1jTaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475339, "uuid": "ed76eb3a-14b6-4fcd-9679-bf0c5ad158e7", "value": 5275416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475339, "uuid": "49dbcb82-be99-41f6-94f9-2aef4b248ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475339, "uuid": "f738fbc7-8282-4a4a-b363-a5dc7ff4cae8", "value": "5352cc70bce05f5289334e32dd8954a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831c0cd0-f4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Xtrat)", "timestamp": 1712502432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502432, "uuid": "97309d21-135e-4a05-9af6-972186a24ba6", "comment": "Malware payload (Xtrat)", "value": "f924be51ed320e7524fa43124bbb5f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502432, "uuid": "f5ed855d-f397-433d-b028-f6b797dbbdae", "comment": "Malware payload (Xtrat)", "value": "11b28a718c603f77aee26bb1b31dc6fbf105744e2823711452f60de77d1cba74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502432, "uuid": "2b8159c1-dd19-4a75-8081-ed4d6b179de1", "comment": "Malware payload (Xtrat)", "value": "f26c677f8df0962f01b1fc90346a24f597a8ef29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502432, "uuid": "74bbf05f-5f69-475f-bf46-4728f61036fc", "comment": "Malware payload (Xtrat)", "value": "60e3651236544d36a4019c243c6639fe79263489370308dd093b72ca61d7e9bed1899533231c4d469a1d78ea8f9b3aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502432, "uuid": "7815ea3c-f291-4a33-8b57-4444b96d7442", "value": "T192547C12A3D049B7E0351E7CED194229653D3D312EB29849EAF26F0D9CB93E24BDC257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502432, "uuid": "0565ceec-d5c0-4100-bb32-2426a55dfbc6", "value": "768:i8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGizmjOsOUFF:Qsq+QV4rObAdXWpf/y+G3zNwiEohA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712502432, "uuid": "788780b2-6d70-4ac3-904b-f53e191d91ce", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712502432, "uuid": "44570e07-e571-4583-b329-cc8e871a43e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502432, "uuid": "d7eca008-c584-4a35-b984-1598b524ab79", "value": "3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb9678f-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504352, "uuid": "86996383-f2f1-44a1-aadf-9237bd9f52dc", "comment": "Malware payload (Neshta)", "value": "105ee08a114730780069a4ab7ee98434", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504352, "uuid": "c38ea8f6-9efa-4a79-9d9f-5746f9924017", "comment": "Malware payload (Neshta)", "value": "12847fdf80168c4373ba7f9cbe5095a3d347ed9577624e8c60d1a84a482850df", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504352, "uuid": "169753cc-8b2c-4f55-bde7-196c25f65bf8", "comment": "Malware payload (Neshta)", "value": "83287190ba3601ba28769620c5a38d5a45dcc4d1", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504352, "uuid": "abae900a-3eb6-4573-b6ee-7473769c1e9a", "comment": "Malware payload (Neshta)", "value": "32859582af8fd4a80e51c2d009be15a080b79ec801563cf16f0f80658661ace02b8a2548c6f1ac016a6b9102e80b9d5a", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504352, "uuid": "7d269358-6a75-45b0-836b-e602a71c2a02", "value": "T1FCB47D117AE0C072C26636724E93D239A665AA645F3457C77FD42F3EBE701D2AA3C306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504352, "uuid": "22e74231-56f0-4e96-b031-913990f0e26b", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504352, "uuid": "a26f1a87-46c9-4c58-ba44-5d4815b30b68", "value": "12288:8jD4QP6wpe9aU12rkDWBPd3IObUczUQR7nwk:46F9ae2jBPWC7nwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504352, "uuid": "41e720f1-2dfb-44b8-9950-57eb05e4919a", "value": 529968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504352, "uuid": "492e4b9c-9a79-4e14-be1d-92ba101fc113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504352, "uuid": "7a0a480a-1cda-4090-a44a-15ac3b51bb92", "value": "12847fdf80168c4373ba7f9cbe5095a3d347ed9577624e8c60d1a84a482850df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c422eaa4-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503829, "uuid": "9938ad83-74a7-45d9-bf64-cb2d33a4e5b7", "comment": "Malware payload (Socks5Systemz)", "value": "3eac9ed5c2bd862b6c99e39defcd1c47", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503829, "uuid": "cb7aa2ab-5af5-4119-8184-50a3a4ed15f0", "comment": "Malware payload (Socks5Systemz)", "value": "134c49b813450c479bfd1a26f023b72654d091c2419bdb2d77c4891c2de5bad1", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503829, "uuid": "c8ca6297-0045-4352-89e0-60f748d276d6", "comment": "Malware payload (Socks5Systemz)", "value": "6c05fc9ce22e23de8ba8c6a5ba5da352c20ea4f7", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503829, "uuid": "0243e1fb-0378-4c87-b0f6-3aa3cb069de7", "comment": "Malware payload (Socks5Systemz)", "value": "895aa9bca48c472ead8e62be2c38c978539b4cdd31d724047e37b920e87e1cef18d73e912a6a2935b735cd159e8863ad", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503829, "uuid": "7024f6c2-a82c-449f-86d2-edde0e07ee2f", "value": "T150E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503829, "uuid": "56e964e3-d94e-4b14-8c7e-9fb8dab06a9a", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503829, "uuid": "7df28ad4-bce9-47c4-90c2-844759c309f5", "value": "12288:O+XssgiZdvAeRwn+aTHHrku9zO0t2W4Nx04xW94OjjI1Y4hwfS9wAjki657Rk2kp:KsgwdvAeQnrku9zO0t2W4Nx04xW94Oj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503829, "uuid": "980c0d3a-6671-4c76-b237-3d4eb8e60bc7", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503829, "uuid": "8e5fd67b-7bd0-470f-ac91-ee9ef9d710f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503829, "uuid": "75e0828d-2f2b-4175-a2ee-d1c0894c5329", "value": "134c49b813450c479bfd1a26f023b72654d091c2419bdb2d77c4891c2de5bad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1ba6a9-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503413, "uuid": "87b7f65e-6ef5-4b9c-bd7e-5c7cab347745", "comment": "Malware payload (Gafgyt)", "value": "ee8565641abb54843033a66b5e0dd684", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503413, "uuid": "eb8c1394-5e5a-4e67-97d0-49791ee6e81f", "comment": "Malware payload (Gafgyt)", "value": "1475e55aad611e1a28edacd88c3b9c17a6690e0997e49cbcc34a5319b9e96863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503413, "uuid": "1df1e1a0-ca4e-4abe-8e1e-da572c18fa40", "comment": "Malware payload (Gafgyt)", "value": "aeea5c0bd95748b9d21c12995720deb2bc24f7d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503413, "uuid": "2d2f2807-c504-476c-96b2-ae523befa172", "comment": "Malware payload (Gafgyt)", "value": "06785c1b597d23726b6464ba77ba6bb9e0a074d0380f6a0402afc05cda7032c42515f1c90af3bc0a7e0afa0ecf81e372", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503413, "uuid": "643232d3-27e4-45f0-9497-6d81704264a3", "value": "T1A8D34A37E4518F73C0836AB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503413, "uuid": "f1f244d3-ec67-43e3-81e0-f51fd6424315", "value": "3072:B1E8x83QHjqmgjHmhQXn55hZttT5I7mAK0qW6MyoQ6:/E8q3QeXrHXn55hZvT5SmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503413, "uuid": "0a72834c-23ed-48af-9c94-fe397b92e930", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503413, "uuid": "c0340b14-8b15-421d-b034-8bd762398029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503413, "uuid": "da2c0827-c563-4f0c-9694-6c8615a720a7", "value": "ee8565641abb54843033a66b5e0dd684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b6f5f9-f516-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712518599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518599, "uuid": "c7b10e6e-7523-4afd-a58b-a113202a07aa", "comment": "Malware payload", "value": "73f27839453a62fb155d59906863550d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518599, "uuid": "4e5ac760-4f12-4459-aa70-741a29dc3149", "comment": "Malware payload", "value": "14f570dc8b296106bee56861d4b1edbccf975dc60bb45d9676f2815c48940c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518599, "uuid": "5148b9f6-448a-44cf-8ece-e1b9249dcf6e", "comment": "Malware payload", "value": "90e062ecc5552d176e60035677e2eee0af4f5d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518599, "uuid": "7e8f33c0-c876-4dce-96fd-a27f390c57bc", "comment": "Malware payload", "value": "2c68b7c5a17d286fb365139be7129018e10396ee31fec9fd6d4b099a7575d320b53ece361bd80125f73a68c7bf606d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518599, "uuid": "d280ac1d-a119-4d2b-b64c-3536992b5deb", "value": "T1F8D733303E4AC032EA510173857CEFBA566C6B258F2741DB67DC2D6E2EA09C36B31D56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518599, "uuid": "c3f251ac-a56b-4565-852c-7eb7fb02d181", "value": "309f506cfe46168a7512ee5016a9e974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518599, "uuid": "db8bfe1f-51a0-4e40-ad7b-a9a9e064134c", "value": "1572864:MOwqgbIWvSJqxJr+jTUphg+aTs5dKRkeeywB:MRbIS/+3CKxI3XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518599, "uuid": "8add2bf0-0c83-465b-a6d5-1fb47a9179a0", "value": 59456008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518599, "uuid": "6b1ed9e6-5871-46de-bab1-e5d631ead144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518599, "uuid": "db9a2670-d95f-47bc-ba55-49de5e6660a8", "value": "SecuriteInfo.com.Trojan.Win64.Krypt.29551.22727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc50a679-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509427, "uuid": "ab379254-1af1-4aba-81bc-01158f9d7eb5", "comment": "Malware payload (Mirai)", "value": "11c4fd3751bb623c8ad7ffd0f4a00d7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509427, "uuid": "5791bfde-bfe2-481d-8c68-58fb9b57ed1b", "comment": "Malware payload (Mirai)", "value": "173a1002ee18bd89cad61ebf62f35fed0be4e602d94e43e14526343c8c225721", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509427, "uuid": "fc7e68bc-6ef7-4521-87dc-5c6fa30a16c4", "comment": "Malware payload (Mirai)", "value": "bdbfb77d0b550155138e66499c667946b0d5fa75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509427, "uuid": "557d53a2-25c2-4b0e-8149-55ef5b76b610", "comment": "Malware payload (Mirai)", "value": "a275f721f9bb11f3553ca13555b87fd609494aeecd5161eea50ec7b4b5ce4202fa5ae9525656df85cd11f1c37a813dec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509427, "uuid": "b29665b8-9512-43b2-b53f-5df3e89285ea", "value": "T18D430956B8829B3AC1D0627AFAAE568D333073E8D2CF3217DD605B117A8A41F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509427, "uuid": "6a91a077-0d65-4f55-9808-3294ff1f729c", "value": "1536:b3NnHZqNA40F2IAQHIExMqMFEjJkdhjJa10KL:b3NnHd9XxpIEtEp4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509427, "uuid": "4b9820c2-7897-49d4-90de-e2d894722c26", "value": 59924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509427, "uuid": "02180c4f-9fe8-4f29-b04b-3f0d1ad30d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509427, "uuid": "d7388993-4a3f-46d5-88fc-2bbd390532ac", "value": "11c4fd3751bb623c8ad7ffd0f4a00d7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5300e3e-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503831, "uuid": "61e37879-708c-4fd5-a1fb-fd9fc684d996", "comment": "Malware payload (Socks5Systemz)", "value": "cd781461fffaafbbac4961efa738c621", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503831, "uuid": "ab3f62c7-b8fa-451d-96da-bb7348da6d59", "comment": "Malware payload (Socks5Systemz)", "value": "175c4bc03461de385b16c153f09e1b6463bd9b2d9d664b566125595219a8dafb", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503831, "uuid": "eee142fb-fc14-4176-ba97-bc57291bc946", "comment": "Malware payload (Socks5Systemz)", "value": "844dacb188cfd669b84d9ab108eec6a4f9178d07", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503831, "uuid": "94d7045c-46ed-488e-8251-d6b554242a2c", "comment": "Malware payload (Socks5Systemz)", "value": "0e8cef9b014b5752ed99e4f81fe522f93d7c287996bbffa23ea3ce10b3bc9b5207f80ca6721bd05a00c30eec656cf67d", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503831, "uuid": "087e2915-35d5-46e0-94e9-e8c3b803eacb", "value": "T12DE49DB13A0AD1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CC6A34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503831, "uuid": "e1e27b8c-5e96-4305-95d8-3e07efa1bb85", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503831, "uuid": "c2949a95-35bc-4905-84c1-4d3c00a96429", "value": "12288:O+XssgiZdvAeRwp+aqHXDMu9zO0t+WANx04x29oOjjI1Y4hwfS9wojsS657Rk2kp:KsgwdvAgp3DMu9zO0t+WANx04x29oOje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503831, "uuid": "cfe08e8e-1fbe-4cd5-a876-61c357d5773e", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503831, "uuid": "254ff243-e92c-4b01-bb31-4cfef06a6c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503831, "uuid": "5ea47833-d074-414b-9954-13a8312c63b4", "value": "175c4bc03461de385b16c153f09e1b6463bd9b2d9d664b566125595219a8dafb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fbe658-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712474741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474741, "uuid": "bb3fb5e4-f517-4037-8d78-36384c1830db", "comment": "Malware payload", "value": "e077d8a42570b2c29d291e44373743f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474741, "uuid": "f0ba4d25-9ae3-4934-8ebf-c6feeda8f632", "comment": "Malware payload", "value": "195be0e82fa36a8e7c5fff0a7eee2eee09f3fa030892f58930056e6f45614ec0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474741, "uuid": "9982ee61-3453-4cfd-aa30-271e13663331", "comment": "Malware payload", "value": "54c7de156e980e14d12fdea8f6cdcc24f577be71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474741, "uuid": "36e76da1-8d83-498d-87c3-7151f6eebd8e", "comment": "Malware payload", "value": "2c19484c6cebda6fe060fdc89c389a19eee265ede1529b1bf7f2508a39943513f46b833bb23e57c4b00bf21b374597fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474741, "uuid": "66ae3725-705c-4974-8acd-922db60a0993", "value": "T1DF839D52748180B7E2CD017AA8774B3AE7FFBD610EE1D9839FA4A74D5D318A0C627346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474741, "uuid": "acaa7e70-a943-41be-919f-ee60ca54e915", "value": "88140c18f5e99bc6a021bffc50b5f406", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474741, "uuid": "b7e72556-ed1b-4e0c-b136-850df97ad890", "value": "768:mLn7QRff6GrKfjonZlUBTUTEp4nuITyS1iB0HMu+aJJXd5mQ+q+RatM0Sy:mT78fCfwsTU64uKy6Ofraxg+xtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712474741, "uuid": "cef44f2d-0ec4-427c-b042-04897a6f95c4", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712474741, "uuid": "ce590f67-50cc-426c-962d-20a8f9373b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474741, "uuid": "caecd47c-2cab-43d6-9927-05aeae34de84", "value": "e077d8a42570b2c29d291e44373743f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163aa803-f4eb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712500102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500102, "uuid": "5ee0e8e7-a61a-4032-908b-9da03eb1d857", "comment": "Malware payload", "value": "bd65d387482def1fe00b50406f731763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500102, "uuid": "dbdc5c03-6e2d-4b97-aed4-5d883f8e081a", "comment": "Malware payload", "value": "1ab7375550516d7445c47fd9b551ed864f227401a14ff3f1ff0d70caca3bd997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500102, "uuid": "fc99370b-0b86-409d-b84a-19497436b2c6", "comment": "Malware payload", "value": "d06a2ba2e29228f443f97d1dd3a8da5dd7df5903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500102, "uuid": "cfb0ff3a-b5c6-40e3-9b4d-bd4f50bf7f9c", "comment": "Malware payload", "value": "f3e62092d1d221a2202c4d1c0f0dd71c3fbb99b7728399ecda16f47d625d28ba2924fe42a64e732b135f72cb25fc5c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500102, "uuid": "d799cd2c-df03-417b-8aac-3b469b2a5fab", "value": "T16BD37C00B0C1C4B2D5B5193118B5FAA64E3DFE740B249EFF77D81A6A4EB41C129B396B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500102, "uuid": "c08a65a3-76a4-4bbd-b8b4-56b15b6313f5", "value": "be95c75b01e2531df9bc609ed71114ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500102, "uuid": "562def81-6a0e-44c3-98b8-8957cb41aee3", "value": "3072:yC1uNIhRRMavV44UAh1fwNoDiAG7BNS0O6WBHMz/:UehRRtv24UAh8oDvMg0ORBH2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712500102, "uuid": "cfc0875d-9af1-4f74-b824-f99d1a527bbb", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712500102, "uuid": "4d819a92-970b-495c-969a-bb83d5fc65b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500102, "uuid": "0f6263c6-b118-448d-9fcb-f6c3e3093de4", "value": "SecuriteInfo.com.Win32.Malware-gen.13279.32020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436a5246-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1712474837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474837, "uuid": "9dfd7469-a0e2-4735-a7c8-66ff43612a19", "comment": "Malware payload (DBatLoader)", "value": "dcc3b6dda1529ad517aab7a372b8ffd2", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474837, "uuid": "c8390ba6-60ab-4406-90fd-a86724eec5e3", "comment": "Malware payload (DBatLoader)", "value": "1aedcb18ce4460c5eecd34016cb42308b2f8ac1ddc51fb265b45200116a19de9", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474837, "uuid": "20cf0877-c5cc-4aba-9804-5b15a0df2b7c", "comment": "Malware payload (DBatLoader)", "value": "a833a247d26bfa0990eff23348e33ca940b44b7b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474837, "uuid": "0f466f84-9f19-4b0d-b445-5abea5762cf1", "comment": "Malware payload (DBatLoader)", "value": "476ff9f56ed2cf2a4de784744e131c3598fe3f9246ecf2ea9b95914e19fd86fe145f597db3c1e00eac4e03d2ec644a0f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474837, "uuid": "eadde86c-164b-401a-a5ab-e63af9db3eb2", "value": "T12615AFA36E507532C142133759E69EAD696A7F2C3CE87D5B6ADC3E0CDF38386281501B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474837, "uuid": "9973cee3-2198-4483-9222-fd8905bf9e08", "value": "31fb36d1622e56e67410f4bb8f46c8c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474837, "uuid": "0b506858-1c62-4b98-9b72-0a3d713c848a", "value": "24576:nvIUBqyyF1eovgDUYlEz0QjZe6y/+0yF:vIUcYlQ7jI68w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712474837, "uuid": "849c6c76-4b9c-42b3-b981-2d972659cbe2", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712474837, "uuid": "588cb545-1c7b-4744-b9c3-15449592a264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474837, "uuid": "bdc8074f-b955-4c30-b128-a46cad70bdd4", "value": "SecuriteInfo.com.Win32.Evo-gen.25660.20544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c819fbf8-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503836, "uuid": "09c75fc6-8050-4038-ba04-b01683849007", "comment": "Malware payload (Socks5Systemz)", "value": "56fa63204912fe168ea21071beaa5d5e", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503836, "uuid": "a9293c93-d03a-4dde-8db3-374398240533", "comment": "Malware payload (Socks5Systemz)", "value": "1cac1b8684ca48bd84522e53f4772a973af8c25836109f27567243e473f10136", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503836, "uuid": "129f4026-ee99-42cb-b9cb-28ccc8f292ad", "comment": "Malware payload (Socks5Systemz)", "value": "49c2b221772efa3017f4f000d25cd3026efd7fc6", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503836, "uuid": "7a719a83-8bc6-4c9d-9060-41cfd58d8414", "comment": "Malware payload (Socks5Systemz)", "value": "07b1f4e53b43fb214b0ec8085ac9b1fd6448c2f81912b692269a0a1e81f2637b1a7c96140a5d2ad3588d6b2845a151c6", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503836, "uuid": "02fdce8b-c942-4a2c-ae43-38b0511e776a", "value": "T1AEE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503836, "uuid": "e1397f3b-15ff-4ad8-badd-381d53694793", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503836, "uuid": "2b1587f0-da98-4f85-ae97-dd57798b660b", "value": "12288:O+XssgiZdvAeRwC+aGHLB6u9zO0tEWGNx04xC9kOjjI1Y4hwfS9wGjCC657Rk2kt:KsgwdvA3RrB6u9zO0tEWGNx04xC9kOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503836, "uuid": "136dbf1b-3db9-4166-9bce-2e94ad6258ae", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503836, "uuid": "5e67c4ca-c0bb-4e07-be21-386f0508914e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503836, "uuid": "7d553b74-9714-4448-9e04-b2f2a6366009", "value": "1cac1b8684ca48bd84522e53f4772a973af8c25836109f27567243e473f10136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175b2fd6-f486-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712456724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456724, "uuid": "d0f5752b-aba4-4850-be3c-e3b3d7c9ad23", "comment": "Malware payload (Stealc)", "value": "2b4753b31c97e20e1b05248a072777a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456724, "uuid": "49f4196c-722e-4b5b-aed4-de869dc93348", "comment": "Malware payload (Stealc)", "value": "1d4923625c054327eb063bc0dfc74578ff43847e9d57d3332664326b264b12cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456724, "uuid": "384b9072-c512-4161-b320-c774a7297c4a", "comment": "Malware payload (Stealc)", "value": "ba028965fb79b894ab0b65a563805768d229825a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456724, "uuid": "eba5961b-bdd1-4ca7-b26c-b00cfe94f8ba", "comment": "Malware payload (Stealc)", "value": "7412235da28cc2d0701962e85a0c05e37621bc72f90794b89bea82fe96881a809c88b74723fd11bd042502c0355c6374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456724, "uuid": "b5d04f0d-0724-47f3-941f-8d557cdba7ad", "value": "T10734AE11A6A484F2FFA647395935C6910D6B7C226FB790CF36AC3A2F5EB31D04924327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456724, "uuid": "08925cd0-9616-4e8b-a53c-2056cb5d20ce", "value": "fc6d7c79f5e4d8e4cda8e0f4b7bf6458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456724, "uuid": "a90cfeb8-7a85-4084-ae6a-142ecf6e5b3d", "value": "3072:BW9dnF3MZ+55A1Xrb8xIaHYorTGp14UyDxQuKwZQ:kfnF3o+5qAploKxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712456724, "uuid": "8894ad0e-169b-4c59-ad3a-9a66b7b18cf1", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712456724, "uuid": "3129b70c-85ea-4857-8058-af4ccd9b8237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456724, "uuid": "b63639b8-9e6b-45c0-a7b9-0f8f733017c0", "value": "2b4753b31c97e20e1b05248a072777a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302a5506-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506588, "uuid": "89e10c37-8c6f-4a9b-a640-c9c17114c947", "comment": "Malware payload (Mirai)", "value": "8c5539f82ca07034cc566d8317d4c37a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506588, "uuid": "31afe45e-e0b9-4431-ba21-835380142310", "comment": "Malware payload (Mirai)", "value": "1faa4e676517392782c22d15bbeb025f27720518330cb58524eabbc4e7ebb3af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506588, "uuid": "ddbd15a9-e570-44c6-8c34-1a5ea4b96cff", "comment": "Malware payload (Mirai)", "value": "e974fa619fb76a9f6bf8f04814d5ef7f18c1dc6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506588, "uuid": "ef73de23-00aa-46ae-9ad5-a99ae8228e3a", "comment": "Malware payload (Mirai)", "value": "a36a2b6b1ef9bd594a0d8ed4070476da5aa66de5278c69275453b6e4f3318ffac828c15ccd8f7cf467c235025f633aa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506588, "uuid": "52569434-645a-4b93-91c5-399f94d4fc73", "value": "T11104981E6E228F7DF668873547B74E25976823D627E1D684E2ACD1101F2038E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506588, "uuid": "a205a84b-18e4-4157-9529-a356d8aee755", "value": "3072:4Zr9C/6XNX3P0sgomHlzBwJ6+E2NVdcXj6:4Zr9OsNvZaNv+bVyXj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506588, "uuid": "6dc13d86-1434-4ee8-8ad7-450c647cba6f", "value": 177836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506588, "uuid": "eda08087-e146-40af-878c-ab241a925f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506588, "uuid": "db5b400d-842f-4ec1-8840-4f1b42b20b38", "value": "8c5539f82ca07034cc566d8317d4c37a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09e740a-f495-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712463478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463478, "uuid": "e2091935-6e40-4530-aee9-56506a03ea52", "comment": "Malware payload", "value": "a3bf461fd4518f0362a20139078f1df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463478, "uuid": "afb62e97-6f5b-4e82-a848-31fbfc87e3d3", "comment": "Malware payload", "value": "208405d104277282ee1074f928d9037742c74099bd91fa4d14568f8a8b45c09c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463478, "uuid": "0d51d3fb-e184-4b57-aaba-61442502f2d7", "comment": "Malware payload", "value": "26842d288d4f8ac8908014043a29838d3f2d20b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463478, "uuid": "cba05637-4459-4ca9-9644-beccbe0c6ded", "comment": "Malware payload", "value": "f3b2d807820b4a72ede4f2e1d71cc11b712ea1ec0c800ac48ce41b88c9d9a9b2454192c67410fd3a309ee769b3f81761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463478, "uuid": "c26b3a3c-7c3e-45cf-afb5-46de7496592a", "value": "T13F769E20BB05C132EDA151B5A47CBFFA55FC6D20176A59C3A3C81E7ADD702C22B3295B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463478, "uuid": "86c5cccd-7cc0-40ed-9073-9ad2e461a5e6", "value": "8c285559adb6a5b70062a46705ffa8a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463478, "uuid": "9c7ba766-6138-4b80-9752-8a594ea4ce2e", "value": "98304:XPsgzUg14udZKRYktDiHEPU02Hw48gpnOVp99g1106LFUHBDg8:0gzUg1FdZgsWgS9wLFeBD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712463478, "uuid": "863b9826-9ca4-4945-b504-734391dbd84b", "value": 7133184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712463478, "uuid": "8a257316-3360-4ae0-9e79-bc9d50e7a9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463478, "uuid": "8fc78b1e-3b76-408d-9e63-b2f8de7c178c", "value": "SecuriteInfo.com.BScope.Trojan.Packed.11863.30281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1a624f-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503840, "uuid": "e88d74f3-0f17-430f-ac1b-d6e99a60df05", "comment": "Malware payload (Socks5Systemz)", "value": "44c4a241f90800e72ba7a1411eec2c78", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503840, "uuid": "f0bdba5e-96bb-4856-aac7-90e00472157d", "comment": "Malware payload (Socks5Systemz)", "value": "21a2e4aaa6b514bcea3d3e6bd66d3a5347541b56ae29adbe14d2082f86373568", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503840, "uuid": "c65c4a71-7fcc-406d-8485-450417620687", "comment": "Malware payload (Socks5Systemz)", "value": "5077c3994ff2183f3da7812a649ec88b7a49f074", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503840, "uuid": "10d02e43-5d0d-4607-a435-d962ba5161e3", "comment": "Malware payload (Socks5Systemz)", "value": "0ac526f16931640e769447fbfed39a0a0ae40de564e9d6b260d11bab1e9fcd384d9a6e87d9d07a32190ab90bc6acb37a", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503840, "uuid": "63479c0b-2d08-4042-9862-9de2c12c5ffa", "value": "T123E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503840, "uuid": "ae6fa708-862e-4df5-824a-489c8a993a88", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503840, "uuid": "54e781fe-5c27-442b-a767-d6b9d11a424c", "value": "12288:HjsgiZdvAeRwP+aeHB50cCl1BqABcvpWwl/mlRKLiTOkERpAHkOkpiIjcBDQg5Ee:DsgwdvAG9h50cCl1BqA6vpfl/mlR+iTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503840, "uuid": "23a343d5-5560-41b1-ab5b-3c4cd37c2e3c", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503840, "uuid": "9c346fae-fb1a-4cd7-9762-6ebb56b62e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503840, "uuid": "464f6504-0c74-4f41-a812-8b7df230c5fd", "value": "21a2e4aaa6b514bcea3d3e6bd66d3a5347541b56ae29adbe14d2082f86373568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887dedcd-f527-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712526063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526063, "uuid": "df3f05f5-606b-4217-bef8-16762cedb2c1", "comment": "Malware payload", "value": "ad429013c23fece896d44024860b06b8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526063, "uuid": "e53fa31e-57b2-4c43-96e5-ad98fd171335", "comment": "Malware payload", "value": "21eaa68eee2d10f0969cc35235409dfb199b2e8465e65711dcad9d854b1d9034", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526063, "uuid": "69c3603c-525f-4485-aae5-429c4800ab18", "comment": "Malware payload", "value": "7d72698972c01823689a9a5ee3ed78c75cbc09d6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526063, "uuid": "6da28f33-c473-4df7-ac16-f93b10a6766c", "comment": "Malware payload", "value": "b98e22409b6a4699e5a7f60244c34446480fdd16768b9ddbd24c13b9917b25280c2cdc736507d1c9309f170f7055fbbd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526063, "uuid": "4568f28b-a6cf-4bd1-ac4c-fc40b2d96496", "value": "T19C44D633BB4AC5F1C684573ADAFB851407A4EB81F363D70A798E27650D037BA984D60B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526063, "uuid": "c28f692e-a8bd-4f45-96ea-ec011373f06f", "value": "6144:qI2YQe7GwutkgEF+b3NnOkKcsHFkvcuaL4+:qI2leqwIk1F+b9JKZHyvFaL4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712526063, "uuid": "c0099549-64f4-42f3-aedb-276f3c9a859c", "value": 257832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712526063, "uuid": "b3fc09c4-f9a4-4131-8890-6601cf80e9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526063, "uuid": "58382e57-d5e7-45e0-aab4-97bf7431490c", "value": "ad429013c23fece896d44024860b06b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2bb519-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503841, "uuid": "33c39a9d-aa5c-4310-815e-2afed27f1ef7", "comment": "Malware payload (Socks5Systemz)", "value": "c191278dfd7293eea109af90d6979130", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503841, "uuid": "05865fdd-784d-46c9-8787-2e6f92fc67f8", "comment": "Malware payload (Socks5Systemz)", "value": "21f3c1497565ae8e7107e053d4abaff759d656b7e85557ef074506cac342fea7", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503841, "uuid": "51ebd9a4-dd8a-4803-81a4-b56679325e27", "comment": "Malware payload (Socks5Systemz)", "value": "07d3edb92f86b79e0576e48e51f558c6591c72dc", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503841, "uuid": "d9e89336-090f-470e-9025-b33628f71b05", "comment": "Malware payload (Socks5Systemz)", "value": "9f91c9911ba14f3fa768d54fb7e0ad0263190e6a438462d97ec074f96cf763a14093e40b978f413c7fe76c386d1b85be", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503841, "uuid": "c332a0a4-4265-46a5-971c-379e37f508b9", "value": "T1FAE49DB13A0AD1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CC6A34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503841, "uuid": "79bd6b4a-aede-4f84-a312-8ad36b46b023", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503841, "uuid": "c5670a00-94b2-4995-944c-32285a33885e", "value": "12288:O+XssgiZdvAeRw/+acHhgPu9zO0tnW3Nx04xs9UOjjI1Y4hwfS9wnjdy657Rk2kN:KsgwdvAWrBgPu9zO0tnW3Nx04xs9UOjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503841, "uuid": "8f86b919-688b-440a-844c-7299590849dd", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503841, "uuid": "80b2c2c7-96db-4884-b2af-9fa3f4871a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503841, "uuid": "ce3cc370-3ff7-4203-8a3d-a22e0e3a36e2", "value": "21f3c1497565ae8e7107e053d4abaff759d656b7e85557ef074506cac342fea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc85225-f531-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712530236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530236, "uuid": "610712d6-f0ee-4d4f-a76f-e1fcf7aa9984", "comment": "Malware payload", "value": "e1c31cdbfd858e903c4e18d35f7d9d2c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530236, "uuid": "3e0204ed-35e4-49f3-abfa-57b6da19f800", "comment": "Malware payload", "value": "22db81acfdadc4589b6eb280fb839a7077341b356c45b8a57d39cc4ba62ee157", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530236, "uuid": "362ca2fe-ecef-4893-8afd-be9615c03330", "comment": "Malware payload", "value": "10806e20e1150126c5f59a05c8a772fff095cef6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530236, "uuid": "a19b8811-6602-462c-9edb-ed94e093d429", "comment": "Malware payload", "value": "af93d71076fc2ede1e3fbc2f8daac25435999e16fc887d4b344266f7d7ce81ae35b4045bd38484add438e9d2352c06de", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712530236, "uuid": "82586ba0-0720-4ac3-a215-b1b50809a87b", "value": "T1A8B77CC2FF9E2455C7822EB08F97A36ED732C0617D92A651C72C07777CC259AAA13319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712530236, "uuid": "63a3c37c-bfa9-41e4-8017-dd60ab001341", "value": "786432:xD5dZURR6jWhtuT9lSAGONJ0SiRgH00Wz/sjwrj5NGTjW:1WhDYEmfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712530236, "uuid": "981df3ae-4c09-4b01-894c-5162bc16870b", "value": 48407940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712530236, "uuid": "5a31601f-6189-40a8-ac7f-62025a43e3c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712530236, "uuid": "33cde0b9-aa82-410f-ad6b-a1f8851c6657", "value": "libgo.so.22.0.0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612371af-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1712504522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504522, "uuid": "ea23833f-1120-4912-bfa5-567af3fdfca9", "comment": "Malware payload (MarsStealer)", "value": "33b96fcceb00475b31415e2a2fe17ac5", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504522, "uuid": "6f96ddbf-878b-4c25-9e01-f150bddbd10b", "comment": "Malware payload (MarsStealer)", "value": "24adb4992ad63d101916088a48eaeb5f62a7a1ef35a28a02c0d34d0fab51e910", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504522, "uuid": "87b3bcbc-d6d9-4b01-a1e2-b45e2a85cd06", "comment": "Malware payload (MarsStealer)", "value": "b9412d4157d27757d173838e702044a270fc5c8d", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504522, "uuid": "dc645314-a24b-4a29-9548-33cde6dff7c7", "comment": "Malware payload (MarsStealer)", "value": "a684bfd8c8a6604f522ea596c9308fd717f86c0166fde101d459bbe572fcc19bb198b533848fc37eb36ba0ecc9dafd2e", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504522, "uuid": "b77d005c-1813-4b4b-88cd-3986b9890b48", "value": "T1CFA584242DEA6009F2B3AE764BE076A7D95FFE733603485E20922B462713D42EDD153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504522, "uuid": "af41f2c6-f06d-4113-9628-0c10e9e3b515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504522, "uuid": "6365e1c5-b61d-4dac-b0a7-e2582eb47ae9", "value": "12288:4dlcbU3ucnv02SS8M9zNYhZB2/FoooEeBHoUojP:4vDb928tFWB4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504522, "uuid": "a9f2fe4d-906d-4bc8-9f1f-bd52f0f65e24", "value": 2225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504522, "uuid": "df59f2b3-1474-416a-8215-5293853c8f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504522, "uuid": "00546c87-7dfd-4a3a-9786-e06bcbbd53c9", "value": "360TS_Setup_Mini.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4317364-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509440, "uuid": "72367053-fa5c-4792-97c5-ab9c32ff19e4", "comment": "Malware payload (Mirai)", "value": "bc890df0b10fbb196456e22e768f8ea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509440, "uuid": "e7f60cc0-da5c-4cbe-9755-9db70c47c2bd", "comment": "Malware payload (Mirai)", "value": "25330fc885cdd0652390074c9277b5a1d86a7145ac6cba85465f9bba9513ef61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509440, "uuid": "ec29a481-bd1d-49af-b779-d2aa691fada5", "comment": "Malware payload (Mirai)", "value": "d730337a4ee4e0536079d6c9bce582f6e3b0d47d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509440, "uuid": "ee8ce527-6938-4327-8141-d4b61adf9f9c", "comment": "Malware payload (Mirai)", "value": "09caeb7347e311df1ecc1bb43650c4ef84ce2a3abd8a50d877547ae19eaa165f7c1b0acc681fa200ee6dfac988f4c341", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509440, "uuid": "2894431e-8000-4e34-a3de-0db94258fbb4", "value": "T19224C70AAF610FFBD86FDD3702E9074529CC551722A43B7A3674C928F54A90F5AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509440, "uuid": "901cf0df-8667-4102-b40b-1c81bfe36657", "value": "3072:P2cSLRiZ6g02KgC/ijw5uWD3J8ZLt1PnpPso:P2cSLRiZ6g0Xaw5Rqbhds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509440, "uuid": "3173f974-5710-4359-a2ad-cc05105c016f", "value": 214688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509440, "uuid": "e07a4a85-a89a-4079-ae40-616d003ae21e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509440, "uuid": "ed856c60-c830-40b9-8aa4-95e32a147add", "value": "bc890df0b10fbb196456e22e768f8ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5308106-f4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712505173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505173, "uuid": "d2471140-c541-4c6d-a0fe-6ec385c18afc", "comment": "Malware payload (Blackmoon)", "value": "03f222939f16f167c9b72815d2373e63", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505173, "uuid": "2a24e93e-9086-45ec-9750-4ea757caa377", "comment": "Malware payload (Blackmoon)", "value": "25717069aad6d04a78aa4f453f24c6d251862f7b742977f83390a76ab796fbbd", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505173, "uuid": "603a2b43-b9cb-4609-91c6-e2509c810c67", "comment": "Malware payload (Blackmoon)", "value": "b383597a54094c1389bd92a9cf47a8bb5f8a984e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505173, "uuid": "40e7ea3e-c275-43d2-8db8-af94823165a7", "comment": "Malware payload (Blackmoon)", "value": "7df2300ba21d4f229bb343ae9625f3c7309fcb774216fcb7b9b4ae4716fe4ba7a321e38b1b9845603ba0b6cbf0d61afe", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505173, "uuid": "138f2cf8-3269-4a7a-add2-42b5fff91d0f", "value": "T11223AE03ADD248F1E825167639F6077DFF3881816D31865BCBB1DEB02D73229762658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505173, "uuid": "ddb5be9b-4b4d-4b3f-a8ba-d7c4087df5ec", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505173, "uuid": "e41a1dc9-dd01-4742-8ca8-8e27346fb0f5", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+L:w0hAW1iqdWNzI5Pd4CSyDt+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712505173, "uuid": "e2976715-10a1-458e-bbeb-7f82e2fe6d1c", "value": 49656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712505173, "uuid": "0496f92d-dab4-4816-8136-491188ef0e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505173, "uuid": "37dfbab3-4994-4400-9c02-48aeb1896649", "value": "25717069aad6d04a78aa4f453f24c6d251862f7b742977f83390a76ab796fbbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7ecbc8-f48c-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712459419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459419, "uuid": "c2975a36-2cfe-45bf-b648-6219f15fecc2", "comment": "Malware payload (Socks5Systemz)", "value": "8899be32b819ad74907939e904221dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459419, "uuid": "f42ed468-4dc9-4cbf-beeb-f18382162e07", "comment": "Malware payload (Socks5Systemz)", "value": "280705276e5ab2ee6c95796e53f3336b90ec767f629531cf47dc04a545ff23ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459419, "uuid": "03f42a2a-e2b2-4e95-82ea-eaa5ed9055a1", "comment": "Malware payload (Socks5Systemz)", "value": "002c1c1fbdc68fb0b43e03fc9a7ac2f72d8dda7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459419, "uuid": "a42f7885-56d3-44ff-883a-47029e0d679b", "comment": "Malware payload (Socks5Systemz)", "value": "a55781aa98819a7d7abdcd1915e5295393e44f8f1d4ce9014b4af77fc931ed5514cdbf174b47f1e5d117aa3dcb99dc65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459419, "uuid": "655fb549-f216-4266-ae10-686f526ca94c", "value": "T104163396B3F8897BC2CACF328966ECA9417375D21C72BB1E785B5A0C1F27831445C782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459419, "uuid": "6f2bd9c6-6216-4997-9548-98f6349be3a6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459419, "uuid": "f16cd76a-d1ae-4705-94ba-11dec671a83a", "value": "98304:CvKJg5VNoTF5xQPMDZLAIhmEUZgiu77d/S+kxZXSA6rwUtj+F5Fh0Qx6E:CKJo3oVjD6Ew47k+pTwUj+1eQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712459419, "uuid": "054db8a3-0de9-422b-82fb-ecbca667cc31", "value": 4336853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712459419, "uuid": "b8859a9b-b65f-4400-b3db-4f65822dfe77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459419, "uuid": "d2f9547b-7997-41da-b00b-0f9a066f1690", "value": "8899be32b819ad74907939e904221dbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d815dd-f484-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712455974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455974, "uuid": "0dfc031d-bcbd-4543-89ba-473db780e24c", "comment": "Malware payload", "value": "e3c6ddc8353d1ffb4654ff52db98b8f5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455974, "uuid": "edde0943-dd03-453f-9aa3-aef18e170c5b", "comment": "Malware payload", "value": "28ec791dd63b066522c90b6f18e322640eeac05eb4ea05da322f6fc00dbf5b79", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455974, "uuid": "c6327e7f-59ee-4a23-9b2c-5ac5023c4233", "comment": "Malware payload", "value": "32c30cf27cfdf7b7537f4a62e51a0026ed432e90", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455974, "uuid": "53422962-db3a-4515-8ad3-183a7faa67f7", "comment": "Malware payload", "value": "bbf3dcbe7ccbd25b23f51692a145a796e385c6c1115cb90ff95057989277907945375f3eab383884796cc47af18599c2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455974, "uuid": "229fa20c-7861-44c3-ba8d-cfa747a30527", "value": "T1C1E51207EA569567D4FAD3369A66222920365D1003438366392C3BFF727F8DD0F9ABD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455974, "uuid": "2d44aae2-8550-4e8a-bf3d-4ccb3db61c12", "value": "49152:88u6hknA5W4IPakZGszDjDDnQVBsHqFyQZIqTWHngicsltqVB4As:88u6+nMxIPZnjQV+H1/qNicoe5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712455974, "uuid": "aef334a5-b5a7-4e32-bd2a-6da8b8ef9008", "value": 3226551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712455974, "uuid": "1bd1647d-c1da-49c0-a095-658ecb5e7a91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455974, "uuid": "1a7cd6ad-d5fb-4b97-a11d-57c76627ef41", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7b14cc-f4e6-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712498049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498049, "uuid": "44db1bcc-7a81-4987-8a9a-4d7b4465b477", "comment": "Malware payload (Formbook)", "value": "9352aacc0cfc4705e987ad1170255ddc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498049, "uuid": "deff95c5-9c6f-476f-b938-c34faa5e46eb", "comment": "Malware payload (Formbook)", "value": "28f97b4c8d62f489f741bede6f460561091d16444a5511fde96ff97d79224800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498049, "uuid": "6464865f-0908-4a3e-8d3f-d1473a4bfb98", "comment": "Malware payload (Formbook)", "value": "ad1e5fd69da5dc4dbb443f17d0ed8de9c7ca3db5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498049, "uuid": "f76c596b-c6e7-46d3-b229-4cadd45f7064", "comment": "Malware payload (Formbook)", "value": "fa91aca6b5d71f0eadfb482670eb06255106af9dba838c9414173613df91e196a8a0162ca6d0c412be5da5aeb4d71aff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498049, "uuid": "2c546a21-9922-4afb-ab1d-c2dc7d03f29f", "value": "T1A9D4230C07E71C3AEB2FEA3594660181E3F6BFA21B5395CBB294002779976CC5F17269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498049, "uuid": "32b2ba07-9d47-438a-9110-0a531a5e89cb", "value": "12288:WWJGd7DhfUeUP3f7U80wqRI3RK9GIAZE4AP8D1jJlMpdz+D84i9:HJC7DNQfg85qRvZAZ1nD1mz+Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712498049, "uuid": "f4d3618e-ef0e-4910-9889-75426589feaa", "value": 627824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712498049, "uuid": "563c2524-a9ee-4a90-a3ce-3e2d7b9f98c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498049, "uuid": "f708cead-1340-4c93-a368-ccfbcd0a3df3", "value": "AWB-Ref-#32122432 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd175663-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503845, "uuid": "9899797d-6df3-41dc-9522-402bd6c63048", "comment": "Malware payload (Socks5Systemz)", "value": "92b90eeb303f20455e6bcffd3f71cc40", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503845, "uuid": "f614fc2a-cb39-4f03-8469-cb1bc7507711", "comment": "Malware payload (Socks5Systemz)", "value": "28fb77bafcb3160636fd897f499379b92e7f40aed71eb978638c1b8b8f3ac662", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503845, "uuid": "f3edde0b-e9c2-48a6-9665-55ecd426e174", "comment": "Malware payload (Socks5Systemz)", "value": "090d19cfd72f6dd3241f27c26e7c1db0aebc22a9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503845, "uuid": "f87a2277-a4c0-410b-9b5a-8b273252dd10", "comment": "Malware payload (Socks5Systemz)", "value": "99fb25e930c9fb0598117d2c75ee9ef459d81a04c8a24ffaf2cd4bdd6e706213b1f0aa777476d704fb91e240bc337eb8", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503845, "uuid": "2629fc80-2682-4ec9-867c-819529c6d0c8", "value": "T107E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503845, "uuid": "5b408cae-0e21-4c0a-92f8-d2a156236d86", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503845, "uuid": "d3e5034e-5beb-464d-a617-85947e5463ad", "value": "12288:v+XssgiZdvAeRwE+aOHHPEu9zO0taWINx04xu98OjjI1Y4hwfS9wsjo2657Rk2kd:LsgwdvApJnPEu9zO0taWINx04xu98Ojy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503845, "uuid": "d525ea41-30f0-42c4-9f0e-bc73fe149793", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503845, "uuid": "1c1d2c9f-d9a5-4312-9a90-7a84b7e13657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503845, "uuid": "ecb38c57-68d2-4379-b5ca-d049634ef0f6", "value": "28fb77bafcb3160636fd897f499379b92e7f40aed71eb978638c1b8b8f3ac662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0528ed-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503848, "uuid": "d3ffc538-3eda-4197-8be5-171b3b325839", "comment": "Malware payload (Socks5Systemz)", "value": "9cd4848defff9c937f2a624c4cd8e85b", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503848, "uuid": "2676f9ad-2de1-4539-a909-f5d3f4c25c35", "comment": "Malware payload (Socks5Systemz)", "value": "2b5fc5099b7412e3cc545693cf0ddf3b6139cdf54c9b4eb31a39ee991e5c4577", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503848, "uuid": "4ca57689-882f-489a-b6a2-9dc8a0f0c6ba", "comment": "Malware payload (Socks5Systemz)", "value": "58a0631bcf106a49c4f245bd2fb644d00db02ed6", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503848, "uuid": "26bc3282-6ae4-4758-af29-c5f959ba7635", "comment": "Malware payload (Socks5Systemz)", "value": "3ceabbb304c5eef8d54036ffc2776fa2366b05d3ae7fc4bc81007686adc40425051d0a8adc73782ba7916eb1f3fda31c", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503848, "uuid": "389fc000-3f93-42b5-8b8a-d59528147011", "value": "T18AE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503848, "uuid": "36feebd2-07a1-4cb2-835f-c611409dae14", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503848, "uuid": "758923ad-6a9f-444b-9471-a5a70be06260", "value": "12288:HjsgiZdvAeRwm+aCHL50cCt4BqeccvpWw/+mzRKLiTOkARpfHpIkkiIjcBDQg5E2:DsgwdvALBr50cCt4Bqe9vpf/+mzR+iTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503848, "uuid": "bdc7008c-440c-4f82-8d70-a481e912c626", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503848, "uuid": "e75baf2b-9019-4257-b447-53c67f457046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503848, "uuid": "5c7c16b0-0157-41aa-98ea-1a78252fe155", "value": "2b5fc5099b7412e3cc545693cf0ddf3b6139cdf54c9b4eb31a39ee991e5c4577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71614dc4-f4a3-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1712469331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469331, "uuid": "6e0a94f5-be08-4a6d-afc8-181c6f6dac84", "comment": "Malware payload (Amadey)", "value": "6aed3301263d22d1f1c8a7d152862ffc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469331, "uuid": "47615a96-8ed0-4c61-b316-ba333aa34f73", "comment": "Malware payload (Amadey)", "value": "2bd6df3a98337e2b75e9fdb9815538c84eff19ea760374a47db979b828918fc2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469331, "uuid": "b4e84a51-0160-4d0f-bb6c-bedef29456e2", "comment": "Malware payload (Amadey)", "value": "9d8f5ba8e6d580ca341337a27fa0f23a4948d249", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469331, "uuid": "feae6a5b-8519-4034-b0c1-ed5fb2a645a7", "comment": "Malware payload (Amadey)", "value": "bdd04412c55d31d79c86eadd118f22e8ef6dc339104b772b5c40d63c9c55255b1916394bb22452d66708b0ca5cd592be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469331, "uuid": "2ca8dbdd-6d36-41b9-bd2e-70f808ad2a2b", "value": "T19F36BF927A80C0B5E54203746579BB7D45BDFEB01B21C2C32F88366EC9B35D1AA36397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469331, "uuid": "d2e042fc-f0ec-4358-a5cf-3b4cf7b4d26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469331, "uuid": "509002ea-e0a2-48e7-a4fb-968d40065fe6", "value": "98304:VNYdBwyMWieDN4+F/8njOyiiqTrAGlucx:X/EwnjOy5q9luc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712469331, "uuid": "29c415dc-ee21-4f1a-ac34-d31d6b196080", "value": 4925568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712469331, "uuid": "ffe27504-e717-497f-ade3-db3ad6fc8b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469331, "uuid": "674b3a79-a29a-4119-a6f5-9b819645ad65", "value": "Software_1.30.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf77de85-f495-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712463476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463476, "uuid": "44942ff7-f6a9-41de-a258-4b38b3d7fdd3", "comment": "Malware payload", "value": "b3be65d5b68ca17167486582005bf73e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463476, "uuid": "e4c54e88-401c-401d-9351-d75dc184775b", "comment": "Malware payload", "value": "2c83928ea9deb1dde02c824dd04464fd7842bdaaba5191e1f087e619608b4506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463476, "uuid": "39918282-65d6-46b5-9cd7-ee24ffa65ba3", "comment": "Malware payload", "value": "1e2ef9fab9fec93c8f24d198b0b16ba6bb8b0eeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463476, "uuid": "d60e5e83-60d0-4389-b905-20aa50ba09a9", "comment": "Malware payload", "value": "f3756192676de38f6e35c17cb447d373ccb4c37f47e613ff386e81002e14aae34f88e3676a2d630c717baf56baffa45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463476, "uuid": "272fc666-3c99-4418-89e0-46e70bf4bfbf", "value": "T1B4B24B578E241C63DE2B8DB432D4DD1ABE71B7C2AAE5C0E7902AC1585FC578239BC52C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463476, "uuid": "a9670062-bada-4c6a-bcea-82d58afe9327", "value": "3b48f8a8b35a31b9ef7a1b118d5f85c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463476, "uuid": "e89dc78a-263f-45bb-bfb3-4458171c1cae", "value": "384:4ySfpVJ4Dm8MD64j64Sg4QeR3KyhU1M9rDGPhCFdxKjKj39/EggzGBkSYE:RUVJlVeg4R9KyhaM9rDGenKjKj9MPgkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712463476, "uuid": "8a021933-cf33-4cc7-95c5-ccdecb048dd4", "value": 25408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712463476, "uuid": "56a90c1a-47d7-475e-978d-f74bae66abe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463476, "uuid": "4703dbfc-b5e7-44a2-a35a-d7fe148fd58b", "value": "SecuriteInfo.com.Trojan.MulDrop20.64844.17056.16907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde0d375-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504356, "uuid": "a8ef9e36-e17c-4b20-9ed9-8ffd4bcaa354", "comment": "Malware payload (Neshta)", "value": "6a187789b51c2e148c645ee78f34fab2", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504356, "uuid": "b3f81c89-ae95-4dd8-af98-b29d4cef64db", "comment": "Malware payload (Neshta)", "value": "2d24515551a8e9a4b49a6e7c1146670436244ec30a0325629347170e0c6e388b", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504356, "uuid": "7a856b67-f7a6-47fa-aa8f-2b23e9bab0a7", "comment": "Malware payload (Neshta)", "value": "b6f8b996180aa43603f20998b11a4d6b24283dd3", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504356, "uuid": "23bf3127-6884-4a06-bd34-dac76758a196", "comment": "Malware payload (Neshta)", "value": "9040446460c08327fb473b942e819d675061319efab5cdc27f0f81a013543b3407ec5ab640837f0f4eeaa1ceace9a389", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504356, "uuid": "6368a307-cdee-445d-b8cd-2395045575e9", "value": "T10404B052B9D08470E5360D34886CEA759A3FFEB05E608DA733683A1F5F352C18D3996B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504356, "uuid": "2d66cb3b-121f-4945-8e54-0484e95b14a3", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504356, "uuid": "e4d5b126-e34b-44f6-b7a7-25b0c4711111", "value": "3072:sr85CV00I3M+52nolIxh1KhkSaBIaLNAwxdSvs32BUKqsL6FBqrL:k9XnoEw52LNks3Uq+2q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504356, "uuid": "62b2f131-6700-45ea-86bc-22a9b473fbda", "value": 177816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504356, "uuid": "81c26874-9289-4464-98a7-db229a9650c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504356, "uuid": "4d96a0a8-ec19-48e4-8893-2036d550bf4d", "value": "2d24515551a8e9a4b49a6e7c1146670436244ec30a0325629347170e0c6e388b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f188835a-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506483, "uuid": "e0995739-725c-4c43-9d52-e6a2684f7914", "comment": "Malware payload (Mirai)", "value": "5efb55bd6b865bd11a49acd098b2f5a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506483, "uuid": "23d47c58-d46e-4b4d-954f-064d6b14a542", "comment": "Malware payload (Mirai)", "value": "2e8506e12fee8c55781e2ceab0864d64781f4d8d422f663e67867e0118f3d501", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506483, "uuid": "76c67fad-8524-4b4c-8799-459f92bcb555", "comment": "Malware payload (Mirai)", "value": "23f58f291d23012c06179c69a3b361ab0d66c9c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506483, "uuid": "346b4ff1-bff9-4073-9120-edda9f5a2043", "comment": "Malware payload (Mirai)", "value": "979bb3ff005ea53fbefa6f20198af501943afaf242699eb1a2ffbb78d2dc180c9d86a6abba32a93ca7a3f72493d5bc7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506483, "uuid": "7f9f3a15-9865-4f98-8dac-ea99b6653952", "value": "T1C8C32A46EB808E13C0D5177AB6EF42453322AB50A3DB73069918BFF43F8679E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506483, "uuid": "5f414904-47e9-4e60-accd-1c76ab8bf4e1", "value": "3072:XuhGgoQjTtpVaOExzNtYftf91HGalMoM/9jYkW3:ehGgoQdpYOExzN+VfWalvM/9jYkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506483, "uuid": "1d6d18d6-08d4-44e6-bddb-9dd67738f42b", "value": 126715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506483, "uuid": "705795aa-9bde-495d-a5d4-2feea8ddfdbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506483, "uuid": "0e03fa45-c427-4ad2-b283-673f79aa6b9b", "value": "5efb55bd6b865bd11a49acd098b2f5a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb1aee6-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504357, "uuid": "3fbd0aef-ecbb-4700-a037-af9b74d38b6e", "comment": "Malware payload (Neshta)", "value": "16243b38defcebf591c1d8d577b6e581", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504357, "uuid": "6e8dbf2d-6598-4806-8024-1b4177d6b456", "comment": "Malware payload (Neshta)", "value": "2f1c32ebb0f67ae2eece78f6b34fff3461e6864576126c2d26dee506803b5c68", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504357, "uuid": "eeec9fd2-c470-4873-8cf2-f41a73dd654a", "comment": "Malware payload (Neshta)", "value": "e0ed94634b76c4855b133e5884a3d8c9dbd4ba29", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504357, "uuid": "d3119f17-70b1-4977-b31a-baff411b61e5", "comment": "Malware payload (Neshta)", "value": "6a509861696fa2c101e5924228d00e303280662c50debaf7dfb247de75451dbe98441f1d7cfac850fb3208f9a241cc8f", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504357, "uuid": "0372af45-747b-4ce4-ae8a-6b5d7af0b690", "value": "T1B0046C47F2A942F8E0A69378C8625645E7767C260B7993EF43601B5A1F773D0DE3A302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504357, "uuid": "5b403d1b-88f6-405d-ab11-cc33394dfcc7", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504357, "uuid": "8aa1fe4c-32ce-49a9-9ebb-6228ed61245a", "value": "3072:sr85CYk/1AdNR6LWaoQNtlPnqthTL6DhOHYMjlkvH:k9Dqf6LVtmjBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504357, "uuid": "f544bf3e-fd2c-49c6-ab91-03e33b39d19a", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504357, "uuid": "9aa68680-0e08-4320-a94d-9a22835acbfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504357, "uuid": "0a993e42-793a-4f6d-9c05-10db83fbedb7", "value": "2f1c32ebb0f67ae2eece78f6b34fff3461e6864576126c2d26dee506803b5c68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478e9982-f535-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531967, "uuid": "c5e4beea-840c-4ed6-afb0-96ad766aacd1", "comment": "Malware payload", "value": "fe2ca62deb761b27ba0a233dd9b8b043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531967, "uuid": "f909d402-8383-4fd5-8d2d-4d4ccdb72009", "comment": "Malware payload", "value": "2f51e2fdee44b49e883e066edf7fa914b37accd79250b604ade4d380134a3147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531967, "uuid": "c69729f1-5ec5-4507-a766-551ae06b7433", "comment": "Malware payload", "value": "08e886fb34b937c536eda1e6ffeb1c4fce69c265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531967, "uuid": "5c6589e3-e9c4-4459-b74b-74d64ea2104e", "comment": "Malware payload", "value": "8978fce18a335a656ed4ed313df8881671dd0737e16abe9300430eb68ce47195d238d3814d8e02b3a3c100dfbb0515a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531967, "uuid": "5d79f4b0-870c-40b5-9c7e-14f8f2f55f34", "value": "T17427BE1AFF06DD82D69341B25E9EC3EE06602810A11BF1D29A8DB758357FE91FD47238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531967, "uuid": "b7e68333-8099-4b9b-9db3-3ca1eb824404", "value": "196608:zsTb0ReA0nZl2p3v6fO4Rv8T1APNsN4+lFSYJ:SgF0nZl2pf6z2hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531967, "uuid": "e5b51d4b-7fec-42a8-b55e-ac87d5c2303f", "value": 21647560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531967, "uuid": "920a1ce5-3006-4727-9f97-61b00f9226ac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531967, "uuid": "29c60ad9-557a-415d-9696-cc3e69a6eaff", "value": "libgphobos.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7251af-f4f1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712502719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502719, "uuid": "e5a3f6e6-5e84-43b3-87e1-0e0b3e5a78ea", "comment": "Malware payload", "value": "75a28db68a020da28cf223010f7c9f9c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502719, "uuid": "7d998f3d-c4a6-472d-99d0-73232b1c5a68", "comment": "Malware payload", "value": "31475717735f9aee20def2a4044b42a52cb92e8cf885b92a042099a273688135", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502719, "uuid": "46c6d274-f964-44be-80cb-ea4301278311", "comment": "Malware payload", "value": "361aa10961eed91b277ffea70641ed6435550d7d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502719, "uuid": "031d4d9c-ed63-45b7-98fe-5bc281e709c5", "comment": "Malware payload", "value": "c3b5145c3e215bcce55f21f588234b420aacd7901bf8f5241516374d9b9f6cf48dfe327f297e056dcc2d6a5892034b3d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502719, "uuid": "3951ae8e-4ade-4530-b40a-c7e4b6027822", "value": "T14544236EDDF2CF82F893DCF1AEE1D25C99F46625B4B66159F69D50282F1A0801323DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502719, "uuid": "03e6ec0f-8753-4a8a-ae77-00616e6c85c3", "value": "6144:dem485iuNrJhuJGd0AkfX+Yk3xonVBio57pMN+UM8iNuiYwLGZTqUdJP+TDu:dempTJAQd0AmOX3mVBp1MN5Ri/YeGZTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712502719, "uuid": "66094469-45ea-409f-9314-977e4a8d60a0", "value": 268769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712502719, "uuid": "2f7bea4d-4567-4daa-8593-242db2db7c05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502719, "uuid": "de82c624-2ed9-42cb-9d0b-09736a7efa62", "value": "mshtml.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8fe942-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504359, "uuid": "75cb392a-c392-434d-ab11-50430ea0a40e", "comment": "Malware payload (Neshta)", "value": "b9fbb019b76c47b444f1352edadbfb93", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504359, "uuid": "847a5e5f-0872-4924-920f-64bd8c61611b", "comment": "Malware payload (Neshta)", "value": "31b6401cd95090e05221db25f0088979067facbcfec4df6d7b68efb6a57eaaed", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504359, "uuid": "7626f941-b4cd-4bab-bf61-e3c73eb5611c", "comment": "Malware payload (Neshta)", "value": "6545f7d24d662ff1be2add4884cfeaf8ecae597d", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504359, "uuid": "d15cf995-0f3c-447a-bf4d-9fc22ac81f36", "comment": "Malware payload (Neshta)", "value": "4f66535c6efd1cbef61e62a662ae4bbe3c572955b4c64200754aee8bebfc9c1073d6a3f344db6788a4db053dbfa3e7ba", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504359, "uuid": "4cda6e9c-87a3-4bfe-930b-a61f9c7ca20c", "value": "T1D7448D22B9D080B2E277597008FD67B6B579BC504F319B876794EF2E2C36AD1193B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504359, "uuid": "38770966-556d-407a-8284-2a0189119ed7", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504359, "uuid": "40459ac5-69c7-4f61-82f9-8c06a24990a2", "value": "3072:sr85C1niR9hcixh3u55ihp64xnJq3wca73oAUJaQSMQmHIdzrRklk8d5:k9AR9hzh3Sif9xmaQS7Vklk8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504359, "uuid": "fe69c6e8-e97a-4e55-9eb8-e828ae3b6eae", "value": 266272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504359, "uuid": "dd454c57-93ed-418b-9fc1-3cadac7f48e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504359, "uuid": "d21d560e-f70f-40b8-b6b3-189de2749517", "value": "31b6401cd95090e05221db25f0088979067facbcfec4df6d7b68efb6a57eaaed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e974f556-f4b6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712477693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712477693, "uuid": "c57c4a1f-6235-41ec-9384-b54060ea2339", "comment": "Malware payload", "value": "f332bfb0de3f5a7e2f0633812001f5fb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712477693, "uuid": "45de3ec7-a0b7-499b-af96-39cb1448b9fb", "comment": "Malware payload", "value": "31dcddcf125e29e61fc75a20c2ead6449e4d95a0cd65f79c29922bd05fca4602", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712477693, "uuid": "c4ccb0d4-10ef-4ad7-88b7-b593b8e3840b", "comment": "Malware payload", "value": "f01652200c3152ce276f0ffa56158e6751d8aa04", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712477693, "uuid": "eb10a852-903b-4413-9a2f-be4d302ff424", "comment": "Malware payload", "value": "d608d388226192cbf56fa72f4636fa99f47ce154f41be6439ff0718525eee53bfd15a25e8b13838fc500d3839343e858", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712477693, "uuid": "867ca7a1-c456-4cd0-9603-0fac9cf4c740", "value": "T1A3C53336B712C96CD745D838F15B9791E8D87091139347DB3B5840B07AAC6F88BAA3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712477693, "uuid": "61994e60-1c74-4276-9280-0d84ffca4c4d", "value": "d5ee67a5d17ebe4b53d6509020438cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712477693, "uuid": "5a747a10-cffe-4b2c-b3fa-4bb913bb829b", "value": "49152:wu+5ogc2IDvFtmILI6Ah9Hrr8YuVkNUE+39Di+h//ZpC/byn4Tt3O:L+5svFtxQh9HHmE+tDjZ/ZpsbynEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712477693, "uuid": "36efc005-9d30-48f2-a323-03ed83fa2fcb", "value": 2675480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712477693, "uuid": "8270db12-aed6-4ce7-99cf-cabcd3e83295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712477693, "uuid": "44b75b63-c961-4084-ad1e-21758911f016", "value": "f332bfb0de3f5a7e2f0633812001f5fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd21c282-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712475041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475041, "uuid": "125f5338-05d0-4b16-9cf0-84441f255459", "comment": "Malware payload (AsyncRAT)", "value": "0eec3b50636ae6d37613e6a2c7617191", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475041, "uuid": "571785b8-edbf-4f4f-9fd2-53c9908d35a7", "comment": "Malware payload (AsyncRAT)", "value": "32dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475041, "uuid": "187119b5-edc6-4818-b797-175d935f9c58", "comment": "Malware payload (AsyncRAT)", "value": "630d5e3b88215d88432db42d2bd295c6d4b55ee8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475041, "uuid": "aa5e1fe5-ff8b-49d2-96d1-7add0683f20a", "comment": "Malware payload (AsyncRAT)", "value": "8ae7beb802bb2b1ad38dc99e0238d5d2df054247a5d6654c8c0257fbd8465d3ef6d5ecfabcf80583a4611f8d4200a413", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475041, "uuid": "ce40b082-3c14-463b-98c2-342af9834edb", "value": "T1D3B41281BBEC0359D9BA4F7102A3958037F37F33A2AAD30C199570DD4974BC85A92B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475041, "uuid": "c65aa880-820b-44e3-b3b3-dcbaaece0680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475041, "uuid": "9c967773-fb8f-4c52-b4ed-a0155574551d", "value": "12288:lDLK1tTEVpNYtvDz1bWE7fkWv6PNUfFKOBGEZ/G4ATtIosrkR:lDitYVpKhyMsWv6Pm4SbA/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475041, "uuid": "1c57d769-25cd-49bb-9229-a5faa8e30a30", "value": 504328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475041, "uuid": "90d635b0-0877-4bec-ac52-1a728e6f4746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475041, "uuid": "c17090ce-031b-4ed1-b7d0-7acac0dfe464", "value": "0eec3b50636ae6d37613e6a2c7617191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d022cf62-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503850, "uuid": "b687ae23-3f02-48bb-9b95-f74e4b63a9aa", "comment": "Malware payload (Socks5Systemz)", "value": "046b8a914149a2cec08289b44b7c67bd", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503850, "uuid": "78f7e8b5-ebc4-4f05-bf2a-883d6d4e8989", "comment": "Malware payload (Socks5Systemz)", "value": "32ed74db4bf1c9613e80b14bfec8e0f89eb101f831d70b78272c1f7bfd045bd4", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503850, "uuid": "4f103af3-9447-45ec-8133-8b81a1f22ca8", "comment": "Malware payload (Socks5Systemz)", "value": "faa69763b55254b80c9d0c2294fc6619f6c1ea61", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503850, "uuid": "014ab2d4-98cc-466d-b3d0-4f36261ac0b5", "comment": "Malware payload (Socks5Systemz)", "value": "a4a67f6500029823f2dc7a6bc0cd8ce14814b891ddc094503c45f80b3a732fc68224c341468445ec41a09d39603cdd0e", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503850, "uuid": "946bdf8d-c45c-4658-aeff-a0d26cc3c8b5", "value": "T1E9E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503850, "uuid": "2159b9b4-38a8-4bd6-b745-37147fce3092", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503850, "uuid": "2d575f15-f782-4453-a4e5-a199559094d9", "value": "12288:sjsgiZdvAeRwk+aUHZ50cChfBqkfcvpWwFNmxRKLiTOkERpqHWmk7iIjcBDQg5Ei:6sgwdvAJL550cChfBqk0vpfFNmxR+iT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503850, "uuid": "47dbb2ef-668d-4420-9ac3-c23d32de6181", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503850, "uuid": "1877ddfe-7fc5-46ce-9bc7-418f83eefc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503850, "uuid": "c9524b3b-4202-4a54-803b-e6ef926ef1be", "value": "32ed74db4bf1c9613e80b14bfec8e0f89eb101f831d70b78272c1f7bfd045bd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ef1e35-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506492, "uuid": "4ecb0fac-c968-4958-b194-c49e6cffa46a", "comment": "Malware payload (Mirai)", "value": "b95cd1d6589a5f4f5561cf485bda612c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506492, "uuid": "2456486a-33a4-4542-ae90-55a21fe382a5", "comment": "Malware payload (Mirai)", "value": "33f6c1d771c182341b68fe7899cb7368c2d46bb52c4f0b6a607f8b71ce03d078", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506492, "uuid": "c6047edc-8cda-4976-9aea-b6bb684acb1b", "comment": "Malware payload (Mirai)", "value": "d4a3b21345201403342ec4592e87e521b36e8bb3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506492, "uuid": "7ae7b032-de5b-4533-b528-5fe307d79caf", "comment": "Malware payload (Mirai)", "value": "4d8fae103329c3f81628905d2a86419ea3842a991f185a25cc6e284bbdd8dde73ab592dad7539937e4ab1689c76e85c3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506492, "uuid": "9f15a03f-ba3e-4df6-a75b-c9a5dd7b15ea", "value": "T1B6D33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506492, "uuid": "28d5604d-060e-45be-8631-783e9ec16a5c", "value": "3072:tGtwnNiaOnUTSFiPT9OSQ7AOaogjV2iZlBWCgxiASQPdL:tGtwnNiaOnUT4uLy7SQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506492, "uuid": "0aa1e476-ce0f-4dc8-8e5b-773100fae2e6", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506492, "uuid": "362e45c5-c131-474b-b660-ee16518e1a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506492, "uuid": "a60f855f-d44e-45e7-a87c-e15d25879b18", "value": "b95cd1d6589a5f4f5561cf485bda612c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0950f99b-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509100, "uuid": "99d9f2f8-9dba-4027-91b3-79e56466faf2", "comment": "Malware payload (Mirai)", "value": "2937a95dc60de9318479a72f43ae3fff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509100, "uuid": "ed27a6d7-3ae4-4382-9e9b-355e7585424a", "comment": "Malware payload (Mirai)", "value": "342b9a422d8d0856afc926e04c205deb3a9325bf6231d5a161709256a2764275", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509100, "uuid": "23044cb7-1a3f-48a7-892f-a28edcb36674", "comment": "Malware payload (Mirai)", "value": "ca5c9847d7cc58bcc07049fbfc2ca90608b13dbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509100, "uuid": "db4c3911-82a1-474f-a564-57591ccda0da", "comment": "Malware payload (Mirai)", "value": "fcf381c9a2301580f336fb1a3673fde0f933a8c580dc13f01ed2045d57f0ed32098f069a4ca5e970fc703fd3faac933f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509100, "uuid": "19f76560-c605-41b3-904e-4dff36db3a6d", "value": "T1C50428C7F800DEBEF81DF73A48530419B130B7A309828B376257797AED3A1991567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509100, "uuid": "a07936a9-e1ad-42c2-9c46-bf927047ef87", "value": "3072:bXqi4UV1wonsiKSarS2huqG8zOxJsWzOLgQLMiO+EHRIvN+9zVGjbiQLzBTuyqMR:bXqirKifKZhLgQLM3+zF+9aLzoyqaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509100, "uuid": "0ba42a80-c67a-4b5a-9ce6-46a571ba8823", "value": 181056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509100, "uuid": "09ca36c4-84cf-40c8-bfe5-414f69e1e9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509100, "uuid": "3da27713-b191-4b76-89e9-35c7072da19a", "value": "2937a95dc60de9318479a72f43ae3fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc70e0a5-f483-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712455820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455820, "uuid": "03697a24-79b0-4e0c-a03f-5eecd11e02d2", "comment": "Malware payload (Socks5Systemz)", "value": "1bd5148229b453cf62e483544795cf75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455820, "uuid": "b19f07ff-4895-4666-bfe5-74a91d1afe8a", "comment": "Malware payload (Socks5Systemz)", "value": "360ec2e6da27bea93778b93c93d9109f70d298544144e0dd19990db609c892ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455820, "uuid": "584b2549-b38e-46cb-ae0e-dc432c8beca9", "comment": "Malware payload (Socks5Systemz)", "value": "063a93e825faa3328b52d7ccc2e3c9d4fd9d048f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455820, "uuid": "137c313c-52f7-42eb-858b-2bfb7415d11f", "comment": "Malware payload (Socks5Systemz)", "value": "4d7994cb54196c967bbcb0dfec644f0d2fa50a4a0310932e801813211ce0a1ad1cf50e3b4468020bb0bc5f814565694f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455820, "uuid": "102087e4-9f7d-45fd-8dbd-1ea4df15a73a", "value": "T1AA1633373491967BC127CA70BC17B424AD7B36ADB438E394383D878D9E3E609E46174A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455820, "uuid": "645a5c66-54d7-4cb7-95c2-bd14bcff84d1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455820, "uuid": "98d217ae-a48a-4657-a4a2-081eaa84429a", "value": "98304:CCC+pgcceioHc3nI4v5UbEucVo1vwlU5zViuOTE1U99kQx6E:u+zcevQSEucVo1vwlOrO79eQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712455820, "uuid": "cc685923-6451-40c8-8cbb-bf71e20aa7dc", "value": 4328828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712455820, "uuid": "0a687b97-fe36-4ad3-8cc3-804692853908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455820, "uuid": "81905446-10e0-4b3b-a112-ed1eeaf8d239", "value": "1bd5148229b453cf62e483544795cf75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedfd47b-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712509431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509431, "uuid": "e053b9c9-3ddc-41d1-bb7a-40ed5ebf42c9", "comment": "Malware payload (Gafgyt)", "value": "d543e0c2213fedc8d133c5df785b0206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509431, "uuid": "b816d7ec-881b-479a-b9f1-34d9e11dafa6", "comment": "Malware payload (Gafgyt)", "value": "364854935db7fa69ba3c06170f6d01d9ea530b7bc35e8bdc68b899243d5ee215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509431, "uuid": "f5c68d08-7c66-4871-839d-f8c047eca44e", "comment": "Malware payload (Gafgyt)", "value": "4e2531c822c7d1dcef4c2e30e92f0cf65b406675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509431, "uuid": "507b43aa-ba9d-45b7-9e58-7d74be4c8f03", "comment": "Malware payload (Gafgyt)", "value": "ba2074d0c80bd8a1981d878f238bdada3f97888bfbc5dfae7b6099eb5345f4462479f75c571b7da1b7aebddd8f1574f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509431, "uuid": "2d36b1c3-2afc-4b87-ac62-a531a4a70a1f", "value": "T1C7F30845FD819F26C6D7227BFB4E428D772A0768D3EA320399255F20379B95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509431, "uuid": "9043141d-6d02-43f7-aac9-d3af79ec0907", "value": "3072:VpANSHzhyfIy7ur0/k4gD8VfXbGbnr1qw0:VdHzaur8k4gwVfXbsnrsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509431, "uuid": "f282a1bc-3aee-4ff4-8d2c-0318c795e10b", "value": 158432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509431, "uuid": "0ea2994d-143a-4dcb-9271-641e52657f82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509431, "uuid": "ca6fc832-9f23-4d80-9408-32472d122cb8", "value": "d543e0c2213fedc8d133c5df785b0206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0056c22f-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504360, "uuid": "03d33767-a553-4b30-897e-53ec58096a4c", "comment": "Malware payload (Neshta)", "value": "c75bd4d56d6243cbf1e95fd7c9b44f97", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504360, "uuid": "546c7c17-c7c9-4bd5-9385-9b275b91c797", "comment": "Malware payload (Neshta)", "value": "366b5e81c614b3eb5e9f792c9b2bc43523cb679d6c2cd5abddb1a7a2e7aff897", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504360, "uuid": "0960e907-9024-49d6-b682-68be4cbdaeb8", "comment": "Malware payload (Neshta)", "value": "e563c4bafdea3b44c47ece99cc64a017570a1dea", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504360, "uuid": "2a348a0d-30e2-4800-ba62-b5e5718d4277", "comment": "Malware payload (Neshta)", "value": "04dcd266cb409052c70467719141bd40fe3634c1815825aa7ef9a5ddf47c1f3c25dccc095b65285bb7347907587f3650", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504360, "uuid": "c2e48e25-5dff-4d89-9cf2-b01f13387fb3", "value": "T137838C96F6E1C872D0241EBCDC2A9228D53B7A317D291AB2BAF51E4DDC7D3C12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504360, "uuid": "c12735b1-32b8-4248-abd7-cee9afa767cc", "value": "1536:32xqjQ+P04wsm1CxqjQ+P04wsmJCcBAmVh4:3Xr8ljr85CcBAmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504360, "uuid": "7a940241-8f39-4082-bd7d-0db6efebb311", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504360, "uuid": "ff487ff3-df11-4974-afaa-c0e408c3902b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504360, "uuid": "3524a68d-10f4-490e-a97b-6b1de71cb931", "value": "366b5e81c614b3eb5e9f792c9b2bc43523cb679d6c2cd5abddb1a7a2e7aff897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f80d495-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506613, "uuid": "4affd167-93dd-4c2b-9449-3c98f1b8166d", "comment": "Malware payload (Mirai)", "value": "761f4e189e579fe2bdf350bea844b5e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506613, "uuid": "36099522-958c-4748-996f-2e09bca0eaaa", "comment": "Malware payload (Mirai)", "value": "368238d5972fd5a0726c7ad5c1d6ebd7f845782602987976d679cd8da8c5c1a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506613, "uuid": "4d94de93-cce0-47c6-8915-c8e6089bc168", "comment": "Malware payload (Mirai)", "value": "79a420b8137a47eb68cb12c5af4999bf495c8529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506613, "uuid": "c608d6e2-a209-458b-b25c-2861dcfdf437", "comment": "Malware payload (Mirai)", "value": "6815e0e54daca1e32ef8c3c2852d69898dd83baab3e54336ccb7bd65c465cf04926931ef2977ab069638100492d4cc46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506613, "uuid": "391a22ea-c4af-4bd9-b511-7b8fe18dc664", "value": "T1F2E33AC7F801DEBAF80AE7374853080AB130B7D155925B373257797BED3A1991863E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506613, "uuid": "a5e5f2e6-54f6-4e6d-aff7-569ce069ad89", "value": "3072:IgFp5M3PxaUjFDZV2OCfSTrpBHEVHjbirL+u3bkmmyta0KugO:fz4P2XfOpBvL+2b0ytwugO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506613, "uuid": "58bd3539-039f-485c-bbce-01e7fa881497", "value": 152736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506613, "uuid": "7d32e3bb-e4ae-4d3a-9084-172f3c3a848c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506613, "uuid": "cc1d3f68-37fd-4bf3-af48-ccc3bdddd5b0", "value": "761f4e189e579fe2bdf350bea844b5e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d69a4c8-f536-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532299, "uuid": "a65f2415-965a-45a7-be79-0fcab158b081", "comment": "Malware payload", "value": "a30432c52258f33523b8b0d557752a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532299, "uuid": "7a2107d7-c5b9-4688-8900-2789aaed29fe", "comment": "Malware payload", "value": "37b6c60912d3817dc3dc1ec6aa2397289e6d6ead2ab7b3449b4304c6e7298941", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532299, "uuid": "83490f81-4de3-43aa-a670-136a14c67540", "comment": "Malware payload", "value": "47a398cff80f696294e12a07dafb3abc7382ba67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532299, "uuid": "baab2469-1d8f-47c7-87c9-b15f91f92675", "comment": "Malware payload", "value": "7475f48f69eff614f8254721959199af15b045eb3275966ab40fed3ec57986540d73f7b47386ad1999d8c2cd1167d703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532299, "uuid": "e9b5ac1d-5a90-4de0-b504-3ca6def165c6", "value": "T12C572A07F6E604EDC4AAC870836BD667EB31785542217B7B6A94CB702F17F205B2E721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532299, "uuid": "3723ec7c-5f29-4394-9c85-3abae9f98ccd", "value": "196608:DgQQrXyhz3BHnZHSnCGVDQQgNW6m/y5Rd6kMuUWv6QwqA3CCaI:DYryxHWCG2Qgh6dWwCRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532299, "uuid": "8d65a7c9-f1a6-4f90-85ec-1e94e584f217", "value": 27471128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532299, "uuid": "fed578ea-6319-4b71-968e-bdcd045c070f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532299, "uuid": "648a0e58-adfd-4d8e-8e6b-839a343cd96f", "value": "libclang.so.17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13d8a54-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503851, "uuid": "435ecd73-a734-4a45-a446-ed6babd9b412", "comment": "Malware payload (Socks5Systemz)", "value": "b3d9020659f157ac3148c2c252d542ad", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503851, "uuid": "ac9acdb9-bda4-4c91-97da-85eac282d3a6", "comment": "Malware payload (Socks5Systemz)", "value": "3854fb713823e15945d294573b91b269c38d3d71f5754f393a7523169cce388b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503851, "uuid": "f954987d-1142-46ad-839c-22e4759e3e23", "comment": "Malware payload (Socks5Systemz)", "value": "b563743d07906393ce5334eaafc679d088ed143b", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503851, "uuid": "59dae953-8116-4179-bd9d-3b8da7b0de7d", "comment": "Malware payload (Socks5Systemz)", "value": "8b83c6d0db648ce36c6b2e785b8b81c173e37b4460bca91f3de6d392e1a34fd5bfc2e042f026cb28c59223c3295e9025", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503851, "uuid": "85c5a6dd-5150-4e09-8cb0-27792c50e839", "value": "T113E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503851, "uuid": "d58b4f25-f006-405c-8225-d282c741fdb6", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503851, "uuid": "4b3b3793-56b3-4576-ba09-be9a46f0200e", "value": "12288:O+XssgiZdvAeRwx+awHhe1u9zO0tNW1Nx04xU94OjjI1Y4hwfS9w1jbC657Rk2kx:KsgwdvAobBe1u9zO0tNW1Nx04xU94OjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503851, "uuid": "246165b3-6a5b-4ad1-904a-295539f38b65", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503851, "uuid": "74b21349-1b48-4726-a717-f73b0887a455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503851, "uuid": "96149374-9f4a-4ae9-978e-86769a997720", "value": "3854fb713823e15945d294573b91b269c38d3d71f5754f393a7523169cce388b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25b3be1-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503853, "uuid": "c8ebec64-0099-4707-ab15-20c3adafd317", "comment": "Malware payload (Socks5Systemz)", "value": "0625b33e6e7407a3fc2656207a1ec609", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503853, "uuid": "58f3f1e0-3c89-4ea0-8164-0e1f87711fda", "comment": "Malware payload (Socks5Systemz)", "value": "393b0c477ab664ca22b3025641f27550e97ddd77b458f6da68a333849d2df0e4", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503853, "uuid": "7cf81a18-b001-4a0d-a244-395eb10e7179", "comment": "Malware payload (Socks5Systemz)", "value": "f5dd54cecc083738a0b18797cad527e7b6c7444d", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503853, "uuid": "56db49c7-428f-41cb-b26a-5cbfb15c6d9b", "comment": "Malware payload (Socks5Systemz)", "value": "da4720da5b4e2cb8fc1048c07cc20334498731b07cc0f57d944ec02570640740d6d9a3b9bb466d98979322706b2e8ba8", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503853, "uuid": "810bbd84-664f-42d3-929c-296ec3a2abe5", "value": "T15AE49DB13A0AD1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CC6A34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503853, "uuid": "0545c70e-da5e-4def-a7e2-f4d859265476", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503853, "uuid": "3382dcc6-1aaf-4dcc-ac52-b449787dfa08", "value": "12288:O+XssgiZdvAeRw/+aMHLFWu9zO0tIWKNx04xC9EOjjI1Y4hwfS9w6jeC657Rk2kN:KsgwdvAWTrFWu9zO0tIWKNx04xC9EOjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503853, "uuid": "19ca2382-a01a-48a0-94d8-10a0f55374ba", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503853, "uuid": "93183dcc-6df8-47e8-a2ca-421a495bba7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503853, "uuid": "311917aa-2d32-41ee-a926-adbc2ceb20cf", "value": "393b0c477ab664ca22b3025641f27550e97ddd77b458f6da68a333849d2df0e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a4b36e-f4e6-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1712498007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498007, "uuid": "6fc92353-caae-4f33-8347-eefe477bbced", "comment": "Malware payload (SnakeKeylogger)", "value": "c52c8f03c7a947a1f84657f2c3283494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498007, "uuid": "916e121c-b4fc-42a5-863e-744d4fc55e06", "comment": "Malware payload (SnakeKeylogger)", "value": "39b5db919a6e2320e74753b6fafa6950e8b9a313340345a2eb0f9abf8cd43372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498007, "uuid": "854d4f41-5585-43b2-aa1e-cde7b777aa0f", "comment": "Malware payload (SnakeKeylogger)", "value": "6834be8e80716d9cea18d10bcca6aabfdb23572b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498007, "uuid": "3c45648b-0546-46e7-89dc-d9bfe0287ea7", "comment": "Malware payload (SnakeKeylogger)", "value": "e7c77533dfab96f28908d7d8e889292125291f317f0ec5ca0bca0fa615f85d02e61d5c1655c28b4d647885fb16ce687c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498007, "uuid": "1e024f49-6880-454a-a51c-3a9af70ab272", "value": "T141259C1237F8461AF2FE47B7647549108BF7F82BAA73D75D8C41A19E1D3670089A23A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498007, "uuid": "67dafb22-cdf9-46dc-b87c-600c1dace854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498007, "uuid": "d7eba415-4ab3-4d90-a424-37859b02b6c5", "value": "24576:W2q2Fi8ek23cTBRQMBbZxsGualRrwvYh:W2Bi8ek234RZ8balRrwvYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712498007, "uuid": "02176913-c692-462d-a2f2-de369fe71e02", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712498007, "uuid": "65e0500f-6730-4502-81f7-714b4425547d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498007, "uuid": "3aa05921-0cdb-48da-867c-43a93067f29f", "value": "Remittance_copy.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15915dfd-f4aa-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712472183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712472183, "uuid": "2dafbb76-21bf-4f67-8cd4-da591729974b", "comment": "Malware payload (RedLineStealer)", "value": "cd77e00b04bc4ad0ccb96a7819c9dda8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712472183, "uuid": "e4c310c4-c04e-4e89-a8e3-5f259d26c0ab", "comment": "Malware payload (RedLineStealer)", "value": "3a14bf440814f53b7260a37dcc2a422f6a3859cfada26a143496be81e41f0706", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712472183, "uuid": "6b7f321e-dcc6-4250-ba8b-f32dc2815450", "comment": "Malware payload (RedLineStealer)", "value": "f41f6ccb7a4117f8b646940caf501c2d8904e336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712472183, "uuid": "08771309-597d-4614-8482-a885382332b2", "comment": "Malware payload (RedLineStealer)", "value": "834adcbea2211c9b430fcc97fc7f85c3eb39fde065473bb141d97b9cec64a63a7ee83e8275cca8fd40b3cd0ee74b63fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712472183, "uuid": "e731d989-1577-4c92-a7ee-4f0889017af0", "value": "T1AA7423C256947C22DD8154FD7B56ECD6FA3DE34118C0D2C237DAA4A45E02BDA770A0FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712472183, "uuid": "4787052b-08a1-46d6-b3c9-b7f13f70117d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712472183, "uuid": "5b6449d5-e957-4c63-a55f-40d1a961e817", "value": "6144:Mb5lTbCTFHI7T6Lhad68UU7RIbgjBKktvwq+xPydosvg4uuYk:ANKIX4aTUYRv/v9Mydol7u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712472183, "uuid": "c8d88a71-23b4-4cdc-9929-245253724492", "value": 342664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712472183, "uuid": "cd9c40c2-d76b-4c02-9cda-5522a9415e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712472183, "uuid": "3ea78429-e816-4d1f-b88a-faee3bf9877f", "value": "cd77e00b04bc4ad0ccb96a7819c9dda8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6a67b3-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517693, "uuid": "089038bc-dc2a-445e-8dc2-1df53b69f24b", "comment": "Malware payload", "value": "411345dfeb27e3fe58a95cf203dc7c75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517693, "uuid": "24648422-5531-41ed-af54-7df27b56149e", "comment": "Malware payload", "value": "3b069e16cad4edec98c6b28dbb1be2eed81a80c4e57138ba63ef2d0485ebcb9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517693, "uuid": "a64c44aa-fe6f-4ec8-b1ac-2b11c5e90852", "comment": "Malware payload", "value": "581bfda02c7505dd39f5855801e935cbd95c976a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517693, "uuid": "e6523f93-7bc4-4b2b-9934-c39e42abd890", "comment": "Malware payload", "value": "7f2a68e3c14870b586d5483b06e4eee34bb8f6402dd686f5651032cca06ee36045298ca453b0533e3c74d1619b9b50f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517693, "uuid": "bcec3e85-9379-43ac-bb2e-7f72ddc8e9c2", "value": "T177833A43B72D0B43C49B6AF12DF727F08769F9A117A76180A10EBFC45772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517693, "uuid": "d5438a2b-b475-48a2-b733-46b7b7591cb0", "value": "1536:RQ2k4MQrUHvm8x6cEI3lanRh5wEH+4CEmQ9VqXjtWf2Xe:R9O3ejcEI3W+Ee4CEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517693, "uuid": "8d5a0be7-cdb4-4d86-9d74-7f69709d8328", "value": 84781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517693, "uuid": "d729fae7-17c7-491c-9cb1-45cd5b76ab99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517693, "uuid": "5f71fc26-9fae-44a4-b74f-1ef1589e0005", "value": "411345dfeb27e3fe58a95cf203dc7c75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47949adb-f483-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712455517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455517, "uuid": "e4d1333c-1839-467f-84d2-b3927c846e37", "comment": "Malware payload (Socks5Systemz)", "value": "c23b7bdebee239d3a2ae25093100f877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455517, "uuid": "91f88aeb-11d1-4678-a705-bbfc5afc6ecb", "comment": "Malware payload (Socks5Systemz)", "value": "3bd90509166273180784df5a70804800285512f2de430bf16a6af0057ab26ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455517, "uuid": "7f77ed62-85c4-4bd6-9774-6885e0ec524d", "comment": "Malware payload (Socks5Systemz)", "value": "933660a3c641783f8c1ccaad92ec1b42cb6f9441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455517, "uuid": "7f0cbe13-fe8d-48e2-9391-e8cf4c6027a8", "comment": "Malware payload (Socks5Systemz)", "value": "ad8e2872d0026750bd2ea20422a32b4f724f27bcbfb3a898cd10c2b9c6fdc09cafcb08a3f0e14f6487e3f8826113f5e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455517, "uuid": "cb84563f-f0a2-4d08-a5ef-c421a6635044", "value": "T12316335BAA47C0B9D27008374B115124EBEFBE64CC362A681D49CD4FDFBEA157E0A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455517, "uuid": "696c35dc-a3ec-4916-a5c1-045401d9b8a4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455517, "uuid": "c2da6f95-a93e-4303-be08-e1fedab47ef4", "value": "98304:Cp2GSlWIGV0k6KmYpjQ4ocnd9RsCIg96vqWvRg5o2iwBC5nxpIZx7XQx6E:NWIGVB6K4I79FWvRg5osE5nOQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712455517, "uuid": "b396bf17-f499-4a01-9799-4f3095ff382f", "value": 4326997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712455517, "uuid": "38d15345-4794-4598-a8e7-2ead3d72c403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455517, "uuid": "13bbbaa8-7682-43bc-8983-5cef8480a8b7", "value": "c23b7bdebee239d3a2ae25093100f877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb868a4-f4a7-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712471122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712471122, "uuid": "3852a251-1277-4855-9d6f-f6c38fd6b96c", "comment": "Malware payload (Socks5Systemz)", "value": "0b9c9d4ca80b491e294cc45dd8aa5bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712471122, "uuid": "65917e06-f3f1-483b-bbb8-b6cca8f54f9e", "comment": "Malware payload (Socks5Systemz)", "value": "3d6e7d86793a6812d02f9d32f59d44aa7a021568615ab25e8e3e5a6aa8b7545f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712471122, "uuid": "5cac99c3-3a31-483d-a936-9d4e68eccfa5", "comment": "Malware payload (Socks5Systemz)", "value": "115f15aa3b9c37de5ea9a09d97304a27b08a961b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712471122, "uuid": "204a71aa-1038-4ddb-9997-44b29d55c5bd", "comment": "Malware payload (Socks5Systemz)", "value": "fd7b2fbcebabaa9134160e44e6a44fced8b852bc7d8b5d219a4e646bfdd3c0f92294224c355c9688746386af94aba1cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712471122, "uuid": "e61a17cd-78cb-4140-b8a9-623cd2a74612", "value": "T1B41633D2F25F49F0C4E2E270AEB720E5920E7B4E3C30967BA49D69D9C76B1C1430D65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712471122, "uuid": "1b4268ae-e24f-4b65-bec0-9c388a9e6f72", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712471122, "uuid": "d5b7f512-1a9e-4dca-9c07-08a5c47a70fb", "value": "98304:C+Ja8xgxrit21xFh280AbGRwdhJt9YyUaF5pp8fSdtzJhAiDDQxc:7Jgnj2PqGqNrLUaFwSLz44DQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712471122, "uuid": "e5d883c8-f8d5-47b0-a7ff-69fef13c6a57", "value": 4250311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712471122, "uuid": "a626ae22-bc3d-4425-9170-0b93344bc1cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712471122, "uuid": "147592c0-d28a-4e99-8631-ed1fe901f89c", "value": "0b9c9d4ca80b491e294cc45dd8aa5bb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b5b247-f4b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712475344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475344, "uuid": "0226f47b-e3ce-4b7d-bc47-7d44c3c7fe00", "comment": "Malware payload (Formbook)", "value": "b915133065e8c357f8b37e28015088fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475344, "uuid": "b636b9b8-5383-4097-85a4-7c0a4299dd73", "comment": "Malware payload (Formbook)", "value": "3d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475344, "uuid": "ffff9c22-70cd-4896-9fe1-b9a4be3c5fdc", "comment": "Malware payload (Formbook)", "value": "61286d2adea00cab97ade25d5221d7cfc36a580b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475344, "uuid": "301817df-50ec-40ec-a7d4-aa1f591e2e9c", "comment": "Malware payload (Formbook)", "value": "e485c0a013097f03c44478e93e10bd6233bef3e9db21a6948e1e69dcffbeb96249c518e218ed49d2b52472b3ec980fff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475344, "uuid": "827c0c04-e729-4c28-9de6-4df3c95e17e0", "value": "T1F835BF027381C062FF9B92334F5AF6515BBC69260127E61F13A81DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475344, "uuid": "047ace2d-a255-44ed-854d-9496ccd545f4", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475344, "uuid": "a24b9e31-12ab-48f9-8989-fe44f642ce1e", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aF9sANKM6Vk:WTvC/MTQYxsWR7aFNj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475344, "uuid": "b6359618-2411-4afd-9039-c955e0e3172e", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475344, "uuid": "a54a874f-8d01-4d82-961e-49a8a4ebc3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475344, "uuid": "1f264248-0930-4bb3-ab89-daed1a82e078", "value": "b915133065e8c357f8b37e28015088fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53206c3f-f4a5-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1712470139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470139, "uuid": "bfd1f224-85d3-4dd4-9769-1bfb18bea3a1", "comment": "Malware payload (IRATA)", "value": "4349b4817e68602ba6133d3ea898bb18", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470139, "uuid": "8d2a0dea-bb98-445a-857d-07095f186b30", "comment": "Malware payload (IRATA)", "value": "3db07bce921cc7aa5653fd0825216d180baece34485c6813c4f4b4c22747b39e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470139, "uuid": "25aecbfd-69b5-41d8-8fc5-bb9f86237772", "comment": "Malware payload (IRATA)", "value": "12fa60b7c38825738e8445f53b11eff949f7f42b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470139, "uuid": "65ffd21a-1161-43e0-a0b8-fea3d55b5af6", "comment": "Malware payload (IRATA)", "value": "ba73331891d27d4637fe8d59a2422e85c7ea55b70cd9791764287dc81397161cf7c6167c0906897776b382c80ddf8164", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470139, "uuid": "57f36c8a-ac0f-4b4f-922d-d32f551554f9", "value": "T188C52213F226E96BC9F1C3732434123550778C29DB43EA8B694837FD64BBAD88B959C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470139, "uuid": "1f635937-1b70-4d0b-be2e-f86a623437bd", "value": "49152:oRxpj+icgBS/5DgBd/KEyubDXPUwP9dYy5HsGvFqeTcVtmRgQ3mP6YF:oRx9rcgmqvKgXcNyscqu0mRgPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712470139, "uuid": "12fa21bb-cdd3-4174-9def-1ce0e6950236", "value": 2695834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712470139, "uuid": "5f339fbc-c5de-41d0-a667-325566ea77bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470139, "uuid": "e6b7f1d5-4f1b-4a04-88d3-67caa9c19dd8", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8f7ce6-f506-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1712511927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511927, "uuid": "f309e2fb-f396-4bab-9cad-08314f69e1a7", "comment": "Malware payload (RustyStealer)", "value": "7162024dc024bb3311ee1cf81f37a791", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511927, "uuid": "3f2ca367-9536-4ad4-8664-d0101d6b6601", "comment": "Malware payload (RustyStealer)", "value": "3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511927, "uuid": "357edbbb-8f0a-4827-a3ed-f6c756de9b57", "comment": "Malware payload (RustyStealer)", "value": "be03705f33a8205f90330814f525e2e53dfb5871", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511927, "uuid": "d57aa7eb-5f0e-4fa9-8e2d-799de7287eb0", "comment": "Malware payload (RustyStealer)", "value": "b93a57e3e60db8a51d6d7d4b3f17c3ce752c356759360d21f99c99e9abba8c2a5d8a84549add857ead4d54fceef2b38e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511927, "uuid": "a2bd7527-5df5-4b54-b490-9cbeeb3cc3f9", "value": "T13CD52911BB4E9DADC15AC470C2478B626A7170CA0B35BAFF45D486383E69AF51F3C398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511927, "uuid": "b33004a1-92ec-4b01-a302-180bd069dddc", "value": "3e15aa248ffd863c4d280e6e314baf7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511927, "uuid": "b6d9506b-d04d-4333-a6f8-e7ddddd563d7", "value": "49152:farnjeISX7EXvaqAhxqU3Nu739K+zspq7uSMJN3:fMyRIcSMJN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712511927, "uuid": "d43fa575-e40c-4b52-a57e-b534d9a7f6f1", "value": 2821120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712511927, "uuid": "abbd1ae4-f5a0-408e-ba08-e20c73babf11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511927, "uuid": "84352cbf-9d1f-4d07-9742-45677a9191fb", "value": "7162024dc024bb3311ee1cf81f37a791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acef29b-f4bc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712479923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712479923, "uuid": "ee20b74c-d614-411a-af9e-3ee23b062b32", "comment": "Malware payload", "value": "2f4a9e584fb5a9c260707234f5db8de1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712479923, "uuid": "289f5329-25fb-4ed3-863e-3f2bbae5d2e3", "comment": "Malware payload", "value": "3e6fcb1ae80412249da774fa5a023709b06fa1c02d9a2bd0e9d43d3c85760610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712479923, "uuid": "b6bd329f-f304-4429-9888-88b712ad93ca", "comment": "Malware payload", "value": "9a94f154a40f73e65b352824416e0824ac742c33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712479923, "uuid": "2a5f4f03-74bc-4791-ba44-74383d32df1c", "comment": "Malware payload", "value": "3b536371beb8c6fb21051362061439bc2eb58bc396daa55ee2ca6140e34fbbd23336feb50f6c2fbd3a67c261b7466a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712479923, "uuid": "cf636735-0f22-49ef-a86d-76d6c453e46c", "value": "T179F314AC03EA59D1D7768C7A08C7DF752E270D90568543474BF538371AB3B8A3E881AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712479923, "uuid": "a228136b-6621-4030-828d-fa9a3e31fc75", "value": "8aebbdbce596084c58841e2196337348", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712479923, "uuid": "3ee7753a-fdc7-45a8-8bef-3fcce8acb07f", "value": "3072:odjq1AqHqaIRAHOk54f6bFk+yIkCEzBKKW3YVAve33vau30auv+m30O:oBoTkCaNvam0auv30O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712479923, "uuid": "ec47bf2b-1574-4bb8-9698-cb98095ec2b9", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712479923, "uuid": "d5f812fc-3e1e-4d2b-905c-13f6cc87ec91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712479923, "uuid": "cd259d0b-5744-42d2-842f-47f2e7a9eb88", "value": "MSID463.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0eb7e2-f533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531357, "uuid": "e69b5a53-c06c-417c-a96b-2c67f8c33846", "comment": "Malware payload", "value": "650207c6934fd13b7d47961ea1424256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531357, "uuid": "653e5478-d350-4e58-a298-1551157e3bed", "comment": "Malware payload", "value": "3fbe045ee7e18b73d97ec1cd07a16715522b0f046a797abeeab072965808b38b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531357, "uuid": "2e2454ba-19c0-401e-900a-cf8b371de636", "comment": "Malware payload", "value": "5697e81b50f1ad8086947760efc0805b88b8fca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531357, "uuid": "c539afec-e907-4f58-a536-520f36202b97", "comment": "Malware payload", "value": "af9e9d7647cd1dd8fc964ca12454c6b07537fb706a34900bd3e2e573a316e50e0203527e5e8a685b1962800ce21a1339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531357, "uuid": "b6998fac-8931-42b6-bf6e-3e552a66b701", "value": "T1D5185A01F651D41AC48985708E9BC6EE3B39BC84DE1267273AC4B77F3C73A64672A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531357, "uuid": "d187098a-582a-4ea0-8c8b-c42035dec59f", "value": "393216:O7pPSuSSwWtavMkWqabgb0N0W2rTDuwh9yVat:OtPSu8MkWpbA0qW0jh9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531357, "uuid": "7d7fbefa-0360-486d-887f-e37e4234d54b", "value": 85114864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531357, "uuid": "2edf93a7-5308-45c4-8aa4-ac9b8928be3e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531357, "uuid": "f0a8c7b9-cee1-423c-b60f-117b43047c3a", "value": "libwireshark.so.17.0.4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ad68a4-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515642, "uuid": "f6a92aa4-76c2-4c3d-8fae-af11cebdc7bf", "comment": "Malware payload (Mirai)", "value": "af0299055fb8c82eb7212f4d5515c44b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515642, "uuid": "fafd8355-ea73-4e6b-a5e0-fc6ded490177", "comment": "Malware payload (Mirai)", "value": "4051c947eb379617a7feb342fca4e78b921a0f593fabf86143bbfd9a35a5eaa3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515642, "uuid": "081bf757-efd2-45bc-b514-6d5687e61091", "comment": "Malware payload (Mirai)", "value": "eab3afef7dffd351cdbc6ad2df883c16e583a3f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515642, "uuid": "8013f8ad-2b10-451e-8b7f-598646e53b68", "comment": "Malware payload (Mirai)", "value": "94ce3d12caa50bb0401a4770e4921598e4b46183f35808522b1e7db0ed64d74ef10ea9387c1b99fe91cd531af5ef070b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515642, "uuid": "8fbfcffe-8a10-4750-9e42-4b7591ab7099", "value": "T1C3936CD5F643D4F5E89304B1213AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515642, "uuid": "ec7b4481-e0b9-4c03-9ec7-8e23fc53d6ad", "value": "1536:xpmWc2AcighsZ82DJxfcHCHD1mSsM8meUigBQ9TnkISGtAd30xZ:xpmX2riED2DrfSCHhmLVUBQ9kVT30x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515642, "uuid": "7fc8ac93-6ded-4d46-ab1b-1384845c0aeb", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515642, "uuid": "88059090-61f7-490d-90c3-c81fb2aa8bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515642, "uuid": "3fc92fbd-585a-45bd-a5b6-42bfac797fab", "value": "top1hbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2392e0-f52e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712528992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528992, "uuid": "2a9e54df-a3e4-4100-a08e-a5185c20b379", "comment": "Malware payload", "value": "67fbec9b6576f967be0c088b209232e7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528992, "uuid": "ea39a622-ad72-42ef-b01e-b9bff5477c8a", "comment": "Malware payload", "value": "40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528992, "uuid": "27ee0b26-8999-4d8a-b98b-5490dddd07f6", "comment": "Malware payload", "value": "bd3e79b8ec9bd9cc4aaaa276097e03f7fa26f813", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528992, "uuid": "a3e4965f-ed74-449d-86b3-0951f4aaa3bd", "comment": "Malware payload", "value": "7986116870f52dd422593e2594d1f8582f6cda97e6d86f2079eac5cff1f1e5087f7f8c1b5651c72f7f6d90520101bdcb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528992, "uuid": "15f39a21-31ec-41dd-877e-d63d1c072e34", "value": "T16223191776A88884D584CD3CEDCBEC300AF1BD639841D3AB32D7A71E5F32B82E959155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528992, "uuid": "db40552d-1229-45d6-8f99-84b32d2a38ca", "value": "768:J2zFjEXzmm86zx4KwEjq90PGTRYi6yqqAMxkElBdVS:MFeB4K9q90+TR7Bxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712528992, "uuid": "7e492cbc-00a3-4abc-bd3b-f495ac3d009f", "value": 47664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712528992, "uuid": "ab2222a7-b90b-4dd7-bfc4-2ddbf646137d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528992, "uuid": "1b84786e-ff0e-44d0-b196-d0314ca6a543", "value": "67fbec9b6576f967be0c088b209232e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4643014a-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515644, "uuid": "cdb064cd-0659-4eae-b12f-777b6ab4b023", "comment": "Malware payload (Mirai)", "value": "1c6103c0237936564ecdcdf3aa37c539", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515644, "uuid": "d1406918-12c3-4ea7-b8c2-926dc67065b8", "comment": "Malware payload (Mirai)", "value": "4087f3a46e4b39780dab22ef1a0c27de1135518a1a7b76880e32e812c506b65f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515644, "uuid": "14f598e3-c423-4205-96cc-e5dba9270773", "comment": "Malware payload (Mirai)", "value": "113144f6fdb48cea3a22b4ac9b64f468fccb9e88", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515644, "uuid": "4712c1a1-a031-45a9-98a7-951bc66513ff", "comment": "Malware payload (Mirai)", "value": "f9bbad03856390c9a567631d92ae838d3826e46b9c3f0e79aaeb508bae2e8185a51d353089045ca5adaac02602fac9f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515644, "uuid": "8a6c8c47-de52-4bfb-b6de-e323a3b26801", "value": "T10CD30845FC405B23C6C612B7FB5E428D3B2A17E8D3EE72039D256F60379A95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515644, "uuid": "0c8db700-1cd6-424d-9c7c-f319c90fb529", "value": "1536:XHCesIjTbgff1RcB3GPFfAOgGj4V7Cs1qT+PlaQP35KGTYP6FQlxABwywAF5IkOI:XHCJJcBEFfiK4wLaPlaQTo6wry3ibG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515644, "uuid": "97450d4a-819a-4bb2-879d-79e41ce07183", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515644, "uuid": "40cd3745-ded4-42b6-92cd-9b6cd5cf1539", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515644, "uuid": "8f64c6d2-2769-486d-ad51-0c9bbe2b0f83", "value": "top1hbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c8e60a-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504362, "uuid": "6c459b08-3ef6-487a-87d8-5b81eeb8540d", "comment": "Malware payload (Neshta)", "value": "756061b775c55fe7ef4c88b5e4d708b9", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504362, "uuid": "8da439e1-6890-449b-9dd9-8523132c4f36", "comment": "Malware payload (Neshta)", "value": "40ffe79f839cedfe3f41a25c86e5849c69a1667a12a6887e72080cf7240c4b2b", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504362, "uuid": "d50df68c-4209-4b6f-89fa-3326df93f51e", "comment": "Malware payload (Neshta)", "value": "f302eaeff52519a12492547697c97ea95bb6eb70", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504362, "uuid": "3d64785a-d2e7-4851-ae2c-7d66f5a0a822", "comment": "Malware payload (Neshta)", "value": "5012d8392808b586fecbd1cef6914b00031ee1115cf1d3650b983a3a9a0517ce8c2f132342a00c0340db3ff13502887a", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504362, "uuid": "eda01cb8-11cd-4036-9aff-b0bf143ce81a", "value": "T1DE836D56F6E1C872D1240EBC8C26D228D47B7E313D6926B2BAE51E4EDC7D3D12D0D84A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504362, "uuid": "d0bb7948-ef3b-4b3a-b794-35e6e0986841", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbNnyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPt:32xqjQ+P04wsm1yxqjQ+P04wsmJCcBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504362, "uuid": "bfeda83f-607a-4559-a97d-31a1c15fa87c", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504362, "uuid": "24b944d4-ef50-4025-9542-b7a9920a7a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504362, "uuid": "420599c4-fe05-4cf6-b558-95597bf13f99", "value": "40ffe79f839cedfe3f41a25c86e5849c69a1667a12a6887e72080cf7240c4b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff225d07-f513-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517672, "uuid": "bf4109f7-88f6-4ad1-9519-87cd2b194fe7", "comment": "Malware payload", "value": "5aff6b721a3f42f61d51eb00e06ace68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517672, "uuid": "b0753ce3-2f64-4d18-9108-849ef8973821", "comment": "Malware payload", "value": "420396237ec0dd40117b852f0bb4aea62a151b830e9f6ab6cb79812725006ba4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517672, "uuid": "b70f1c92-3cda-4fe3-8f69-bd5cec4e8a61", "comment": "Malware payload", "value": "2dd32fef93c686b2975e79951e9aaa5b9aadaeb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517672, "uuid": "55455bc3-1bef-47f7-a30b-6c1466e95328", "comment": "Malware payload", "value": "ef4afc7696414bfb3a99716f12265d0cf4f17fc542917a99b1b3685b03667e8861a8e5835d04704c9e8f7e243a7e67ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517672, "uuid": "b82343bc-a7e9-42d6-869a-72aa9898244f", "value": "T14AB3962A7E22FFFEE568863107F35F7087D521A226919385F26CE6181E7128C1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517672, "uuid": "bcd5b96c-d5ed-4c40-a361-5938bcc0be7e", "value": "1536:K7ju1T9pq+XvYu2rKe3egp/F9U4WeeoIo0Gw0KmEdXUmkiSFxfC7xbXe:dTgVhF9U4vv0Gw0cdXUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517672, "uuid": "a23f5f92-42f7-4ddb-92ba-6b50763afa12", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517672, "uuid": "806864cd-dbcb-4f7c-b89d-d209016d6827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517672, "uuid": "6fe38d1d-6e2b-4a71-9986-475c575a8cfa", "value": "5aff6b721a3f42f61d51eb00e06ace68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029b2522-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504364, "uuid": "5044b51b-4341-441b-8a52-ae2c78fd3cbe", "comment": "Malware payload (Neshta)", "value": "2caceb5f8d108d1a1204aecf8db261c6", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504364, "uuid": "b7af0501-6d21-4f21-a09f-cf21e2e86eac", "comment": "Malware payload (Neshta)", "value": "42ac5c1d5d917ddd20aa2e9830fb2f488780fa7f46a342f5079e045396b909bc", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504364, "uuid": "326b25eb-1e41-438a-a6a3-ff52c09eaed3", "comment": "Malware payload (Neshta)", "value": "f5df3a3fbbe8c3c8df6b077c5ee576eadbc61fb6", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504364, "uuid": "459a129d-593e-46a3-ac5c-f8a7bc0894fb", "comment": "Malware payload (Neshta)", "value": "cd4c898b7fa344d86128d7728b3b19168d8aeac11edd4a56232073e68b503fbef3ae66e4168496971e9ee3eff9f85f91", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504364, "uuid": "929dcb3f-9d16-4d9b-b468-866488e8a689", "value": "T1D4D38C23B5E0C8B1E1714C3448A0D971993FBD221B749EA733C41B6D4F36BD1DE29A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504364, "uuid": "218ca408-5c85-4526-b7c5-cb610a072857", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504364, "uuid": "772053cf-51c4-4d94-a303-6590420602fb", "value": "3072:sr85CYwWEhPD+4zB+Q3F6lhUBf8Bo/mu+YDfYz8KrR+:k9YALzB+gFyG7/fYfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504364, "uuid": "6adb39c5-c1bc-4856-acc9-861c54515daf", "value": 142392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504364, "uuid": "892e1731-a34e-4613-bd1b-a551be36192c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504364, "uuid": "0c8391d6-882d-45eb-a58d-949dcf008eba", "value": "42ac5c1d5d917ddd20aa2e9830fb2f488780fa7f46a342f5079e045396b909bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1b4361-f526-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712525670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525670, "uuid": "94d4cd94-b19c-4321-861d-b78001c96083", "comment": "Malware payload", "value": "44ec00c94ceb935df7244cb692fec9b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525670, "uuid": "76a60813-bd6c-4790-9698-340bea675714", "comment": "Malware payload", "value": "4379e1290aa5d36cc98722935afab5764ba64d61e9f0615b5395c2a22c75d80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525670, "uuid": "8e61a53e-140c-4d74-9020-ccc6eefbd8a2", "comment": "Malware payload", "value": "aad96da95feeadd4cbe7f504a055fa1896c7414c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525670, "uuid": "dcb3a7af-6e72-4644-b1f2-37e8bb7ed43b", "comment": "Malware payload", "value": "c00851cbe4e3e90c1dde0b7a5636f57b0dd95c2778736ddcd206cac4216839754da39f99d4c82311f6e0e83736c7cec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525670, "uuid": "50f0d425-4b47-44d6-ab9c-1e953bfcdfd2", "value": "T199242320EF793830E40911F7ED7D4D1230F6E6F85953A44ED8BE522F0E68BA59A52D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525670, "uuid": "6aa51160-dcf2-4891-bdf9-58925038fa2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525670, "uuid": "1a67af99-5ed8-4b29-87da-c5a73aa6ddc8", "value": "6144:pnkd9Rk0WB3H38DwMXHQg/Z9ScXJ+xovgnkBBG:uHiLcDwMXw8ZscXJ+xoonkBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712525670, "uuid": "91ef0935-a43e-44f7-8da3-2d986f54216b", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712525670, "uuid": "b6604343-7529-4ae5-ba6c-8ba90f6a46ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525670, "uuid": "4d87e250-322f-46af-8cfd-a59a2299cb93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03851c1a-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504365, "uuid": "5438c886-826e-490f-9bf9-4bb0f0b617c0", "comment": "Malware payload (Neshta)", "value": "a4680e7d0c19d5e4692b52bb53bca53c", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504365, "uuid": "c43745d4-3893-4243-a797-2ca4fc9659fb", "comment": "Malware payload (Neshta)", "value": "440afd2c69908168b251d9ce936599d72a44c1e1f41edfd2c468488feb80bd43", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504365, "uuid": "8a28f5db-4bce-4e8f-a4d6-b9f01b01f0e8", "comment": "Malware payload (Neshta)", "value": "6c7553ca7f8c07edaf9e8e454183b513fa900487", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504365, "uuid": "ce36e9f6-a019-4b89-ae1d-2db0ef5ce877", "comment": "Malware payload (Neshta)", "value": "82264e1786d2c11f0e7c4706c9ca2880ce39fe92b29c58f3b6c42d1a23d494203cd8b2f3d74a870bacf42a53575f24c5", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504365, "uuid": "81226874-1449-4be3-930a-e72628bcd4ad", "value": "T1F1947D017790DF31E2AF05369D6996B85A6F7C209F2487DB23943E1DBE302C1AA35B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504365, "uuid": "509509e0-3296-487b-b420-0499ca83171e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504365, "uuid": "8f53c555-76f5-488e-981e-48a3884f5d66", "value": "6144:o9QjzhZ2opkGe6vyuTHfx/J+kvuuHcLBuiyt1M/VvoQ3mvwBVO/GuSkkN:R+66uTHJ/J+kvvcLIb1M/Bo0lBM9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504365, "uuid": "9f35fb2b-2790-4b8c-ab5e-4a2a78bb2e0c", "value": 410072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504365, "uuid": "19180ae9-8ddf-4322-9296-4753e2038f24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504365, "uuid": "e7021db0-2a24-49cb-bc57-a0364cd413b7", "value": "440afd2c69908168b251d9ce936599d72a44c1e1f41edfd2c468488feb80bd43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62f46d0-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503860, "uuid": "8c8e5a42-fa08-4f3c-8fd7-a451c85cc37f", "comment": "Malware payload (Socks5Systemz)", "value": "688cef8bae5fa4e96e09eef047c9e9e7", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503860, "uuid": "e0407421-c34c-4d4a-a3c9-50813f352da5", "comment": "Malware payload (Socks5Systemz)", "value": "44c6873346cb79a8f787f8782429498d43bebec7a0437e7c6ee99951c42576b8", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503860, "uuid": "ba89d5a0-2a8a-431e-9ac1-bf01c7fb8def", "comment": "Malware payload (Socks5Systemz)", "value": "02a46abb04f6667657a97547b54a048dabd08fdc", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503860, "uuid": "904391ca-bb11-43fd-ac88-ecbfbec7b52a", "comment": "Malware payload (Socks5Systemz)", "value": "8ad9f563fd8175159b5d22c20848fc4345d349780fe9a8da9a073ae229984aee7635acab8866a4a254c03fdbe086ed56", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503860, "uuid": "e57fea85-b9a5-4b71-b50d-a036bf5608c3", "value": "T11CE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503860, "uuid": "a6247ccb-7694-4b51-b494-638000233fe8", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503860, "uuid": "fd82aa0b-e107-4c77-aa98-f63b63236135", "value": "12288:O+XssgiZdvAeRwB2+aWHt47u9zO0t/WTNx04xo9gOjjI1Y4hwfS9wfjhq657Rk24:KsgwdvAhbpN47u9zO0t/WTNx04xo9gO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503860, "uuid": "be567034-2b06-4d9f-ac41-9b76b5021ed3", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503860, "uuid": "addb3182-b9fd-4a51-93ea-1f198c0e302d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503860, "uuid": "337d0dc4-2565-4fac-9433-e86904e18345", "value": "44c6873346cb79a8f787f8782429498d43bebec7a0437e7c6ee99951c42576b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f446bf1-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506157, "uuid": "e82e14d4-6b1e-4d04-9eb7-97e8da4bdc8e", "comment": "Malware payload (Mirai)", "value": "d7d733ce79ef7bc7de4f35f69093a084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506157, "uuid": "6540adc4-d452-4752-908a-ebc2e6903824", "comment": "Malware payload (Mirai)", "value": "45258bd4732bceb7ba3d16bedd677c970d6a04bbf2b1c0ce77a5f09e32939af3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506157, "uuid": "dc5d22cb-458d-4500-a6a9-b69560fba4ff", "comment": "Malware payload (Mirai)", "value": "7129ed2bc76a1785135003fbd6dcfdc5b47509ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506157, "uuid": "c50a6957-ed9a-4877-9e10-38893c70895c", "comment": "Malware payload (Mirai)", "value": "edbd0ed648f2ce69f05edda951244f7b4382da6d6607576c5a13c704d12449ad531466ce3b30c1117864f2ad26a8c273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506157, "uuid": "ccb43463-0294-46b1-ac55-c0ff8d4d37ab", "value": "T18D331985BCD19A17CAD40377FA0E43CD372A6388E2DE3213CD256F55778A92F0A6B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506157, "uuid": "81ff5fbc-daa4-4a1d-a324-668e2580b801", "value": "768:NyQbHnVGOtGmzXmjkx3E1XylGXWVj6kxG6dqE55hS3D+TpGkpV55Z6H:3Gmz24WMUXQj6I5cDfkD1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506157, "uuid": "edb0844e-4639-4e1e-a584-8e0bbfb9fa48", "value": 52104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506157, "uuid": "704f2f64-5460-4076-b200-1abadfd246ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506157, "uuid": "02e4bc0b-4ad4-4cc0-8c92-393612b3e38e", "value": "d7d733ce79ef7bc7de4f35f69093a084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0b95d5-f52b-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712527811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712527811, "uuid": "785098ef-d398-4350-bb24-bcee4c154860", "comment": "Malware payload (AsyncRAT)", "value": "1b018d9d77edf9c08d39bc6080cf50d2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712527811, "uuid": "5f6b729f-b0de-4de9-8c39-e68708eb9c4f", "comment": "Malware payload (AsyncRAT)", "value": "45503927f90fe4aeae2c91c6f13d3a647338f44565cc2ca26ba0c1d49968c9bf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712527811, "uuid": "9aa3e437-e678-4a37-9240-f7f8b155a9a4", "comment": "Malware payload (AsyncRAT)", "value": "b24d472f1cb43e0c114de888e9726a6cb8fafca3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712527811, "uuid": "5d965a1f-19e2-4fac-a12b-55fac8416b5f", "comment": "Malware payload (AsyncRAT)", "value": "d8b5b71f9a0e882c145b7b300b2d1589aa38c33697f1af2f7884931e82f2e1b1d9ebe5a537f961583dccfcaa2039d288", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712527811, "uuid": "e53011e3-0601-411f-82fd-ebcde2d37bff", "value": "T1F2062316E57AB0EDEDD9A8FF8A079FCA3C3F5CE71A750D28A7263D06C49191144CE460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712527811, "uuid": "cb35a0e5-9fa1-492e-a1aa-d0d032142997", "value": "163e11748bde1b8a8c7d5040c9da5ca0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712527811, "uuid": "39facec9-1a92-4757-a592-9bf864a12f0f", "value": "98304:rwcCJEcjXKOFlOd/iZujgERMOarjSaoYI6gYo1je:rVaawOd/vMsMOaPI6To1je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712527811, "uuid": "698a4a9a-1e85-49f9-ae2b-c134c5120082", "value": 3942913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712527811, "uuid": "ce1bf295-5a45-423b-add5-86933665608d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712527811, "uuid": "45c5735b-3582-4713-a712-5bc5e5268beb", "value": "1b018d9d77edf9c08d39bc6080cf50d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d759b5fe-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503862, "uuid": "e5403d1b-fdd1-423f-b656-e203206faac2", "comment": "Malware payload (Socks5Systemz)", "value": "c9ac3edc719f5d37a226d6433ef36366", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503862, "uuid": "be644ceb-e2fd-410f-9d8e-ab775b3deceb", "comment": "Malware payload (Socks5Systemz)", "value": "456ce65049640382070dcb86ef05468c88620f1d0f8631426c69bfcc1237591b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503862, "uuid": "fbb0f835-3c0e-41d9-b920-7654d1ccfb98", "comment": "Malware payload (Socks5Systemz)", "value": "26492849bb456dcfbab4d8cf7a8606ca499056e3", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503862, "uuid": "6a90478b-9c72-4ca8-aab4-f0fb473c90ef", "comment": "Malware payload (Socks5Systemz)", "value": "f174ab407ea5916c899709396d7860851f79c9418421d118c9b91abf5b01ec2aee4dea8e0de829002268833ace32d744", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503862, "uuid": "d7a4a076-69d8-451b-a60f-2ca161513816", "value": "T16DE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503862, "uuid": "5ac5d63e-01c8-419b-9744-26ad1ed64036", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503862, "uuid": "bcd48de0-349f-4fdd-8e38-976028c1be78", "value": "12288:O+XssgiZdvAeRwT+adHrpSu9zO0t8W+Nx04xC9EOjjI1Y4hwfS9w+j6S657Rk2kd:KsgwdvAq+LpSu9zO0t8W+Nx04xC9EOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503862, "uuid": "757fa84e-8a52-48fe-b169-0bf91e49b7b8", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503862, "uuid": "4010b09a-0aa2-4fea-a46f-726a429bdbfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503862, "uuid": "c13dc63f-10e3-4313-a2aa-b1823859d417", "value": "456ce65049640382070dcb86ef05468c88620f1d0f8631426c69bfcc1237591b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d878e754-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503864, "uuid": "1b7047ef-05b8-47fc-a875-1cf500284f33", "comment": "Malware payload (Socks5Systemz)", "value": "d02a0b09b543cc14772f8790f28c0e45", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503864, "uuid": "6ceb6b8a-f094-41b1-a494-3b83f18a288d", "comment": "Malware payload (Socks5Systemz)", "value": "466debc3888f4944eb65f32daadf49ecd6b6fd47152ca2fdde777533697f1a18", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503864, "uuid": "fbd79e25-1137-4e23-82ce-acf3801fafc3", "comment": "Malware payload (Socks5Systemz)", "value": "9b6314da21fd423ed988485d3117cf5cfe66598b", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503864, "uuid": "02daa304-2125-4859-833d-0399a7aa1b52", "comment": "Malware payload (Socks5Systemz)", "value": "b692238099ec3062c7c1c8f2017ab45b615ba96879771f299821e700d283da49bdb6907974e2288553c82356972ef5f8", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503864, "uuid": "08dc94c7-0feb-47e7-b95a-a2ebbefc111e", "value": "T139E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503864, "uuid": "6a46f8fb-d09e-4950-9e89-2d157f391ad2", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503864, "uuid": "dc2918fc-9215-4dd7-9975-b31a547e9553", "value": "12288:O+XssgiZdvAeRwp+awHrxKu9zO0tUW2Nx04xi9kOjjI1Y4hwfS9w2jyC657Rk2kt:KsgwdvAgvLxKu9zO0tUW2Nx04xi9kOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503864, "uuid": "98cdedaa-2164-4d17-8523-0809a0da5efe", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503864, "uuid": "3eb802e9-d08c-4d1f-addd-3376886cd7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503864, "uuid": "8dc96d18-04db-4fd0-8867-b8f3a87aafd5", "value": "466debc3888f4944eb65f32daadf49ecd6b6fd47152ca2fdde777533697f1a18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044c5dd4-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504367, "uuid": "d2b69564-2482-47de-9e51-9eeeb3782c02", "comment": "Malware payload (Neshta)", "value": "09f56cd75936015da01a99519e66f83e", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504367, "uuid": "4aa4f681-d1a8-4be1-b0a4-74a70a328d3e", "comment": "Malware payload (Neshta)", "value": "46f368c3bfe6d3f9c3f3d9881546635bc9d9654d0fd0146eabe2c9f5ef18a0df", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504367, "uuid": "6af527f7-4699-4a4b-bdb3-2e32b92456e3", "comment": "Malware payload (Neshta)", "value": "b762d942fecb48d434080dcbe5cb8e8a2b9200fe", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504367, "uuid": "a280320e-4df5-49e5-b969-b31b23b8e055", "comment": "Malware payload (Neshta)", "value": "ceeb1cc73f6576708beba9c0ee689d2a12bfbce33255aa560a0c5eaa9fc866a0fc73b0d5d181579462333aead90b6b64", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504367, "uuid": "35cee826-b910-45c9-84e7-e1fcee6649de", "value": "T189E38D4673E054F9D0265678CCB68614D3B3BC364678974F37A43B5A9E733822D2EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504367, "uuid": "6afa5828-ec1c-43ce-9ab0-8c98b0b081de", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504367, "uuid": "2251d39a-3572-446f-96e5-c90633ec5d0d", "value": "3072:sr85CkkbAYn2GgYlBYN2fHYTo+nlt8wDSRUTT:k9xbAMpgY3gTP8DRUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504367, "uuid": "4b5f9e1c-49a2-403a-9849-3a54805d2fc6", "value": 149888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504367, "uuid": "8813e1e8-726f-46d0-a87c-368364e665a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504367, "uuid": "b8e157af-b45a-47b1-9c33-5f49dd911a2c", "value": "46f368c3bfe6d3f9c3f3d9881546635bc9d9654d0fd0146eabe2c9f5ef18a0df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cabf132-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506528, "uuid": "22e6e29e-65db-40c3-a72d-64099ba635b1", "comment": "Malware payload (Mirai)", "value": "bb40e81e104a7dbb4784ac5d6f94c962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506528, "uuid": "fdb711d2-507b-4e25-8aea-e1fbb2f87d88", "comment": "Malware payload (Mirai)", "value": "47cf2a22acfd1b788c5d46df4ad351880307e822462e29c085dfa92ec924cfb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506528, "uuid": "8bffba07-a994-4236-a4d6-0b44af63693c", "comment": "Malware payload (Mirai)", "value": "9dfcde1320c91b2ae455d8f1085e3304a99c1c5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506528, "uuid": "c0b6a883-b786-4ee3-935c-283f0f6ebbad", "comment": "Malware payload (Mirai)", "value": "4426ed0a396a33743b195825142bf8528b1bf3257599dc40a1c78dcda7198f1a6479102f40b9a3d5b8b7c7eef87a06cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506528, "uuid": "9b380cc2-823e-4b13-9896-b0fffd2f0396", "value": "T130435BC8F543C8BAED160931257BEF335E76F0B91264FA43D7A99532E892641F502E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506528, "uuid": "6012d1fb-9580-43f4-bec5-f4ccb2c1b6db", "value": "1536:JHNoReTkPTWfxtHsjFUO3rSmT8mWDBu73MSzN:JHNoReTkPTRjF9rBT8PDk3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506528, "uuid": "33d6d2ac-ceb1-4e84-ac49-c891baeb3d61", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506528, "uuid": "15921960-455f-419d-af0d-8ffb8c2f468f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506528, "uuid": "6921488d-76fe-4558-bfae-f72ee0df6be3", "value": "bb40e81e104a7dbb4784ac5d6f94c962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a87e2a1-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506551, "uuid": "74ab32c8-7036-4cf5-8d1e-a1d4062df17a", "comment": "Malware payload (Mirai)", "value": "73c749fd27d24738b2ff0a555e134d43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506551, "uuid": "6a375f0e-6ca5-40b9-b0e6-900266ebe28d", "comment": "Malware payload (Mirai)", "value": "48fdd0ca1adf9df1d7c235d0b57dcf75c69e5237311d9fa0a3e7df2fd213662c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506551, "uuid": "e4009501-71af-4d6a-9a67-64906417fe31", "comment": "Malware payload (Mirai)", "value": "17ad65a85aed7def39d45789f489ef4d599ce6db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506551, "uuid": "c6de0138-c0ef-4093-ad47-300010eb2fe8", "comment": "Malware payload (Mirai)", "value": "3225efd7f60474fe08c8943479524693764576c9ab9970edd75ea40a77840e6d22f85463cdbb42dfc0572f608e886ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506551, "uuid": "d8e66df6-02d2-4c18-8765-35ec002650aa", "value": "T113E329DBF800DEFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506551, "uuid": "5bd0c042-9b7b-4b56-85de-3749353f77dc", "value": "3072:jRsZDXhrvKbbWOftDA4EslibVrjbiJLnN+eAyaihka:tsenfhAUliwLnNMyaoka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506551, "uuid": "09531979-7cbe-4c85-801a-c77818efbabd", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506551, "uuid": "9bb10bcf-4081-4d84-9652-87f8184141dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506551, "uuid": "e15f1814-3b9e-4f74-b983-e750ce7c1a63", "value": "73c749fd27d24738b2ff0a555e134d43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a7bfec-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517677, "uuid": "7296c79e-bcf8-41b3-8c3b-6129f2ec3da0", "comment": "Malware payload", "value": "0f8ecb5720c77cb18460a087ffb44bc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517677, "uuid": "293d5622-3af8-4d81-a4bd-532f8294e796", "comment": "Malware payload", "value": "4b75d67a7c476c7f80ce2af3b240935c5edb50345e1c2c62294698a9c236b9c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517677, "uuid": "d4577cff-f6ce-4b7d-a445-218e9bb83f34", "comment": "Malware payload", "value": "67d793578ff07ae7c0a9e618e950f40e8b9b8a9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517677, "uuid": "6bb654c1-f83b-4fb5-8899-b64454d9f6f7", "comment": "Malware payload", "value": "4a772516b2289e34e11b8943091d4040eaaa36d980f8712182da5b91e8035d0db932cc24b5e0015ae7af12caba7f8617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517677, "uuid": "1531b462-c117-4f22-84f0-c3b414e8e2fa", "value": "T1DFF3F701D5508B6BC6C35BBEF745A1CE73726E986F873306C719BAB027D06AA5E3D201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517677, "uuid": "42184abf-cb02-4d1e-bbe7-78afb45b4642", "value": "3072:r6xzlAqsJt/oxSMpJCH+kpP6P510FwufP4rzzJaq3C4o61BhSTwkqx9MQmyotq8b:r6sN4rfJakDhqwkqHMQmyotqauUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517677, "uuid": "cd39a658-9b0f-4279-9837-fe2cb2299ee3", "value": 164079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517677, "uuid": "92eacd29-0c45-4e95-b51f-7460c9918a38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517677, "uuid": "02416e4a-6f2e-41bf-aedb-9f02e8be27d0", "value": "0f8ecb5720c77cb18460a087ffb44bc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfab4273-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712533081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533081, "uuid": "ff8cb806-6a6f-4f19-9798-cf295e21820f", "comment": "Malware payload", "value": "e9dd4c1223a0f36eef116218416a2950", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533081, "uuid": "52bb5827-3986-4c56-b16d-297a55c98259", "comment": "Malware payload", "value": "4dd54d231d77ca8ac7f81ee43f319a496713f673bfceff9e115d7c072fabed75", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533081, "uuid": "07484aa1-8a79-4d21-976b-6d8939609e51", "comment": "Malware payload", "value": "4f828de487bb24906d4018c48c93e22775566bb8", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533081, "uuid": "968c204c-44bd-4555-933c-d664c59cc776", "comment": "Malware payload", "value": "834db55cf73183176e72291c6cc6a40ad929ff26ae25a08430bc65c6c5e426cb51cccba9616bf1c896f0fbfbbd1abbf2", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533081, "uuid": "67c100c7-8382-43ef-9be9-0519788fb989", "value": "T1417269D37628582E7DC2C0997D110E52BE3D8AFAF7579187CAD58ACC05D071FA1F288A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533081, "uuid": "fcfa5d45-b8d2-4c9f-bf82-4c3be8fd6004", "value": "384:P8a5sAFiRAlj6e5QJbS6br9Do1WJcnQOT9kuDmon6pLiN6DuL87fXGzIbDqvzTcs:P8a5sAFiRAlj6e5QJbZbr9Do1WJcnQOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712533081, "uuid": "2ab9b4e4-2f88-4c53-b7ff-d24ae9bf42b9", "value": 17347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712533081, "uuid": "816d0f9b-6db7-46cd-8a05-8fa26c74bf99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533081, "uuid": "201f1eb9-3045-4e27-95b7-5911676b02bb", "value": "syscalls_32.h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e987f76e-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509476, "uuid": "0d202d3c-9eb3-4315-8393-067b774671ed", "comment": "Malware payload (Mirai)", "value": "45a4350c89fd5e5d29fd9bb1903eb48e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509476, "uuid": "8ae79baa-9f2f-4274-af83-318512a263ae", "comment": "Malware payload (Mirai)", "value": "4e374b1afd9b6b785250d730f3e82e6d09b9d6f365c7f3ab9a9238ffa569931d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509476, "uuid": "f51fb70a-f15e-4722-b90a-fe7c599947ff", "comment": "Malware payload (Mirai)", "value": "19041f8180a10161d45bd6cd58be68a87ea2381c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509476, "uuid": "0ff249fc-6741-43bf-bf14-c9f3d9c2b612", "comment": "Malware payload (Mirai)", "value": "2438b538c4972bea800357ae1af991a39c642fa7af23fecc479afa3c644c4f2f8644aeddf7950f086c7b10d3cc077394", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509476, "uuid": "a4d1dfaa-0411-43ae-b24b-ae1f026b50e1", "value": "T163E35D56FA408B13C4D5177ABAAF424533229794D3DB730699285FB43F87B9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509476, "uuid": "1f1a0d94-9364-433b-ab7f-e65f25efc90d", "value": "3072:yR8ptwInPp4uDhdP1rAcxxU6p04kXzKTeM/9XboXF9mNwaCST3:I8ptwIPz9dP1rAcnURjXz6eM/9Xb2F9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509476, "uuid": "41e1a3ce-e7c6-49e9-bab7-4fbd09980a87", "value": 144861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509476, "uuid": "aa165c7d-196e-4c69-bf78-6fff846ac2d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509476, "uuid": "9e35ba33-628a-4767-af2f-9c02e1a3d520", "value": "45a4350c89fd5e5d29fd9bb1903eb48e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085518ae-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506950, "uuid": "58425303-f06b-46cd-aae2-4ba0293b3424", "comment": "Malware payload (Mirai)", "value": "74ecac06431c5b59b59e96386f40a44a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506950, "uuid": "0477bf84-747c-4253-99e0-e1b6312346d8", "comment": "Malware payload (Mirai)", "value": "50199faf972d55be47e5c17d2c8a9342837d55313e3c7b25caa9f527a2761306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506950, "uuid": "2b16ad0b-dbd8-4c8d-b4ab-8fc38d08a546", "comment": "Malware payload (Mirai)", "value": "f8a1b9d3f0e99655c6cb1c3f2ebb090c7a6d2d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506950, "uuid": "66431660-47ae-4908-acca-12f8e55ad461", "comment": "Malware payload (Mirai)", "value": "4da8b4592f448e1a04308fdf7908da5d930dba2d1e2ff5a6a1e2599976151fd4e3c81a994a279dd936d1a42d758c904e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506950, "uuid": "4463a9cf-b442-461b-9060-0cdcf769a904", "value": "T12D63A409BF610FB7EC9BCC370AA91B4524CD692A61B47F36B934D428B61F24F19D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506950, "uuid": "5782be68-8e17-49aa-80b0-e98f0a70d6ed", "value": "768:Czh+ms5jih53EGR5uZBd07eP56hene6VeaYp1PrLZeeIvXi5718kM98Ci2ZvB:Czfs5jiX3cesWi7VoH/ZeHo8ki8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506950, "uuid": "dc58e7f4-c1ba-450c-b1c2-d18f74ae9e23", "value": 68336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506950, "uuid": "fb39f02f-20a5-4de8-aa28-6eaf2727d55d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506950, "uuid": "85dd8440-de83-4e3b-9d30-1f218790a9ea", "value": "74ecac06431c5b59b59e96386f40a44a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafecd87-f483-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712455818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455818, "uuid": "a59ea78c-43d8-4730-9e4d-7a743d065996", "comment": "Malware payload (Socks5Systemz)", "value": "910f19f23f8c3b74b4641e53ad681723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455818, "uuid": "83cb2d38-418b-47df-ab82-aab58db1c5a7", "comment": "Malware payload (Socks5Systemz)", "value": "525a57636cf99f0e174bb3793a881211c60a7e590e83a398685366fb109af6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455818, "uuid": "44fa1606-13d7-4220-9467-7be992aa1a46", "comment": "Malware payload (Socks5Systemz)", "value": "0723abe872358cb6df349d9f86c2af29f79eab09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455818, "uuid": "73eefe8d-ace5-474b-ba26-fd342eb1d689", "comment": "Malware payload (Socks5Systemz)", "value": "1a4e6cf22653f17f79ac20737d348d24a0bfd91220e08f5483176b1985f421ac236b48b10a8d0e1db0eb5968f2867068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455818, "uuid": "2a6d9a51-a639-4002-9a5a-d496bfe9b186", "value": "T10116334501DA8437D1735B70BD26CA685E7A7FE6ACBAB4C8788CE77F4A1A0099C44F70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455818, "uuid": "63fb14ef-dd99-469a-a13d-ee88c042a0c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455818, "uuid": "94b3214f-3add-4a6c-a89e-7436727e096d", "value": "98304:CvmJIOhgt6lAjkIw/Yb2DhBRlwV21oCMvwVqRP79Qx6E:dJIOhzlAjkIw/Y2zRlCUoAsnQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712455818, "uuid": "12663f0a-b8cc-4258-a995-748fc773d3d5", "value": 4327659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712455818, "uuid": "5cd4d6ad-8e76-42fe-9018-e6897e8ea652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455818, "uuid": "d994c6b5-f565-47b8-b915-d684780ec143", "value": "910f19f23f8c3b74b4641e53ad681723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3773f2-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503868, "uuid": "21c76a43-4f9c-4f9d-b95d-4c58cba6899f", "comment": "Malware payload (Socks5Systemz)", "value": "30aa88dab11befb0ccd0063ab15afde9", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503868, "uuid": "70e4968f-d377-4316-8086-ae0a8f8e51c9", "comment": "Malware payload (Socks5Systemz)", "value": "527437d0c48b133be14148dddaaa77f94738daea071c3cc7de1ba5bba9c3c36a", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503868, "uuid": "52f44f1e-0302-4718-8a97-ea9b758ad397", "comment": "Malware payload (Socks5Systemz)", "value": "d7b24a02b7a275691ace5f682604c1abed9756ab", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503868, "uuid": "a494b3c6-5bcd-4041-8de0-20eef2878e39", "comment": "Malware payload (Socks5Systemz)", "value": "8b6c0778853e82a1940ec1a711d5a4e16e31eaf9af69a04cad09dca72d3dd25d6d77c833096210d597ead74a84254459", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503868, "uuid": "4bf3058a-2ce5-42b9-8cd6-5290cd4d39a7", "value": "T16DE49EB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503868, "uuid": "5111d6c5-4b86-4014-a232-0b8e977a3767", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503868, "uuid": "e1eff250-2b6b-4b1b-9d10-1df2710e4736", "value": "12288:O+XssgiZdvAeRwz+anHRGNu9zO0tFWtNx04x09IOjjI1Y4hwfS9wNjzS657Rk2kR:KsgwdvAK0xGNu9zO0tFWtNx04x09IOje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503868, "uuid": "bc6dc31e-cb9d-47cd-a43b-8eb8dda677f9", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503868, "uuid": "ae473a8e-d76a-48f6-a762-20a5854dd3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503868, "uuid": "0e705606-bcfb-4183-a893-405f522c6bc9", "value": "527437d0c48b133be14148dddaaa77f94738daea071c3cc7de1ba5bba9c3c36a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d15cfb1-f538-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712533238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533238, "uuid": "9fcbed94-dab1-47f9-8d9b-ddb64ff69fd0", "comment": "Malware payload", "value": "d79bd5457b44c52545b24e2a2e57b254", "object_relation": "md5", "Tag": [ { "name": "Big_Numbers0", "colour": "#E7FA18", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "RooterStrings", "colour": "#705D12", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "shylock", "colour": "#FA1F30", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false }, { "name": "vmdetect", "colour": "#15E660", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533238, "uuid": "1d4541a0-328f-4c20-bd2a-c9a8a02d2087", "comment": "Malware payload", "value": "528276cbe35b9a352f2e88b271e6b98639e733fb0fa5ed1d8208ff129a78905c", "object_relation": "sha256", "Tag": [ { "name": "Big_Numbers0", "colour": "#E7FA18", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "RooterStrings", "colour": "#705D12", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "shylock", "colour": "#FA1F30", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false }, { "name": "vmdetect", "colour": "#15E660", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533238, "uuid": "c83d0d26-7761-4895-9108-b9cb2d5b71c8", "comment": "Malware payload", "value": "60777ba9d354cf8c921b07c22c2ed72445efd547", "object_relation": "sha1", "Tag": [ { "name": "Big_Numbers0", "colour": "#E7FA18", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "RooterStrings", "colour": "#705D12", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "shylock", "colour": "#FA1F30", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false }, { "name": "vmdetect", "colour": "#15E660", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533238, "uuid": "0b9fe9a7-2a97-48e9-95a5-5ffdc01ec3b2", "comment": "Malware payload", "value": "d61a9c44f030814b6352321d97e3db49988840e36136600cea113768896d720c9db0af6a6227ddab49662079e04667f1", "object_relation": "sha3-384", "Tag": [ { "name": "Big_Numbers0", "colour": "#E7FA18", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "RooterStrings", "colour": "#705D12", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "shylock", "colour": "#FA1F30", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false }, { "name": "vmdetect", "colour": "#15E660", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533238, "uuid": "52d73d3a-f5d7-4d56-a1fd-f4c01f5a134c", "value": "T197E738C36091C9ABC1AA8130DE9EDA363630B45393916BDB3288DB75DF71AD4133BD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533238, "uuid": "1e4105bd-3bd7-40f8-9533-858c95650880", "value": "786432:tPSHdnmjqy7/56FKP4+jUQ3OpAa95+9SSKL6AAkDCRKNB4mI4n4+KLEsFay780p0:tgdmntcAeCRKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712533238, "uuid": "5d37a3b1-4641-4510-b2dc-657e3881c5b2", "value": 65378504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712533238, "uuid": "a781d7fd-0cf2-4be3-8dd0-9b2c8df276cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533238, "uuid": "b0ff997c-d668-4c40-8929-ca7d39a28f56", "value": "vmlinux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd29dc0-f4cf-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1712488250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712488250, "uuid": "082f2332-4f90-4af6-9ee5-4c525a471516", "comment": "Malware payload (Vidar)", "value": "f4de3cf6835582c816968431566ca4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712488250, "uuid": "e6997d4b-deaa-4d33-b546-4ab690f75576", "comment": "Malware payload (Vidar)", "value": "52b7235a431fe2a5230fdbf71d81f17e83903fa7aaa8b2433bc4d649c35029d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712488250, "uuid": "d3331bdb-e185-420b-a9d5-f1ff7c2a3bb8", "comment": "Malware payload (Vidar)", "value": "ef0af247d1cc1ddfb3b54357a0c3481e10d54130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712488250, "uuid": "83f7fe96-b7e2-4298-bf14-04032627e45e", "comment": "Malware payload (Vidar)", "value": "00619d4eb40efdb830d4fd9501fc2bacc93657528609f5fcd720bb20182cc452e58cfc22216d798958a4b2b03a6e9403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712488250, "uuid": "09626afa-fe23-476a-a6c1-0ba2f2a790d0", "value": "T1FC241250F3FF6724DE6F91F0A82106115AE4CB8969938E5B97CE58A60233BCA07E0756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712488250, "uuid": "9b131386-5831-4ade-b46d-e29057079cba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712488250, "uuid": "dea4b8b0-f308-4b0e-af9d-aa8c8892d5df", "value": "3072:ojETl3ODx1Wr/jq2LEiyDYGv0gHy2ymX6IOr6AVAMBkL6fWVugPrX4IB1JrppUxe:oI3YijxGv9y2b6/RvWFI2Jrpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712488250, "uuid": "779432c3-3a10-4b11-872a-d0059b7a03f3", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712488250, "uuid": "d28cc6ba-87bd-49e0-99ce-deb329c101b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712488250, "uuid": "3f131eb5-17c3-4ee8-becc-ed9de9daab77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bbe4ab-f534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531753, "uuid": "18ba1296-505f-43f5-a4f1-850c8892a4dc", "comment": "Malware payload", "value": "d47093a3c77889d2056de0f90e37daed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531753, "uuid": "5a98c108-cfac-4711-89b7-5cd9047e8ea6", "comment": "Malware payload", "value": "53c254af01dffbb2e043c077a57e87904e48c7ad26bc21826a254fbc2e3f97eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531753, "uuid": "730178ec-b367-4eec-a75b-e971249a50ee", "comment": "Malware payload", "value": "c751a40b39bcdf31480cf4727d11f3a78dafc5c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531753, "uuid": "14751bc1-d424-4b77-9389-1208dc8231ef", "comment": "Malware payload", "value": "818459da7e3d710ce2d85bb9963c2f44ed94b97247e1212ef3a7ec8f7a0627596139e2fd6a57d7b9d3b4dde6e787de3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531753, "uuid": "a7e52953-af25-4d5e-95a2-fec8f0614571", "value": "T15815F8166EA2089EC83989378DFB4B317771B4EF01315763269485353E939BC0F6ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531753, "uuid": "28439538-7c29-4a9f-bd66-0ab319f5f25b", "value": "24576:cA/PzdJWeNHlD8DeCuKPMEUblsxFJulFiSleP:tPzdJWeNF4DeCuKPfIsxFJu1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531753, "uuid": "fe505bf2-6261-49f2-8e59-bb13c5856aaa", "value": 895216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531753, "uuid": "cb55375d-4556-40f3-acac-85a90a61a00d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531753, "uuid": "9d6de098-1c93-4592-8459-875b7c1eaa5b", "value": "vsyasm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7c7f9b-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712518096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518096, "uuid": "def85a68-2e91-4e44-9e37-2ab4195527fe", "comment": "Malware payload", "value": "d1cc253a2a3dc33795e83ee23d1db215", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518096, "uuid": "df8961b0-d07f-43ce-8612-a8b8b8fc2aa4", "comment": "Malware payload", "value": "555855b0cb2aa0de31b9890f290087f7dea3af0d366ebb51027172652224c973", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518096, "uuid": "16698a43-d728-4bb6-8c07-d2271aa535bb", "comment": "Malware payload", "value": "5e4618a684a323413d0ae3b899fedf0b7e5328aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518096, "uuid": "9b05a638-dff8-4252-9acf-a65a91dba496", "comment": "Malware payload", "value": "993031fa2c8d8689d7d7609678e2f7ac19817c8d695ce01788875d6d5842d4e24adf7b1a8dd2bb1ee18d445bc3661af3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518096, "uuid": "2d7f7754-fa5c-4f18-8874-9258cde70f9b", "value": "T165930992B900DFB6F40ED77604D34B20B670FBA64E931672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518096, "uuid": "0af06a01-8350-4646-acc3-42995351a014", "value": "1536:tGCx6zvR8tFWkGQYVQmj3VJ4ln9Ly1X2oy5sg8PTfz3qbiBTmQ9VqXjewf2Le:t9Cv8FuQuTwVoX2oy5s1Pjza0mQ9VqXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518096, "uuid": "367345d4-fd74-40a0-812b-f4ee4453d07f", "value": 91076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518096, "uuid": "57474d98-e3e0-4182-b0bc-bb51bea75b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518096, "uuid": "aef4da0b-f87a-4c7c-a020-97c20be459ff", "value": "d1cc253a2a3dc33795e83ee23d1db215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abafc6ba-f486-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712456973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456973, "uuid": "38a8550b-50fc-47d2-b847-d8df66245357", "comment": "Malware payload", "value": "4bcd05144e737686ce8a087a5e2d8548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456973, "uuid": "5c80b5fa-9962-4ed4-b95b-e97206e4e717", "comment": "Malware payload", "value": "57062b52bbb70c2935673699c566d52fe910462d6fdd2bc75c68e59946318acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456973, "uuid": "c29d7877-562a-4cb0-918b-3d146185fd27", "comment": "Malware payload", "value": "c32df9667aea0770caba4fd0048e0b98d40c3b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456973, "uuid": "9b6bdffb-c126-4fab-95b5-4e8e25d9284a", "comment": "Malware payload", "value": "1d92fa219753914691350c4066bdc695aa71fe5fda2b30a3daa94d2888d663e709a91c4c242b84a198a3a73ebe4e8755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456973, "uuid": "c52fa3f1-29d4-4898-9319-7b990eb184e9", "value": "T19226337A33A1ADC1C805683857CCFF1D5861E1192BAE171B2C057F6BA91BB9A603770F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456973, "uuid": "d491b5fe-96bd-40ed-b590-e1bdff4a7ce5", "value": "0e710d1dedbbf7bc573b5df52d5ee277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456973, "uuid": "f2a5cb68-4691-4ff6-8dfb-e7423d8fd6b2", "value": "98304:jkxLleXTYYgCC+//BHKzIbX69hJUtPe9fuSonhgL8Ei4bo:AfZY3/ZdbX4hJUtPe9fuSohO8ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712456973, "uuid": "6ccdc3e0-b8ec-4537-9e9e-6c04812f9cd3", "value": 4680394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712456973, "uuid": "736a8e4d-1b30-4c94-9708-5a2b01709430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456973, "uuid": "499b6aee-9600-4496-8380-9b5d1d713ad3", "value": "SecuriteInfo.com.Adware.Presenoker.11842.10862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3907f238-f4a4-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712469666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469666, "uuid": "f91ff50b-4c80-40fd-b6aa-bdf7f643a938", "comment": "Malware payload (LummaStealer)", "value": "d4dcd93f07c7005659959843645a849d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469666, "uuid": "acbb96ee-a826-4b78-b5ea-322ac965595c", "comment": "Malware payload (LummaStealer)", "value": "579f34e36bcb6e90957f54fb98a154ec08ba19209056d876fd336162916d1dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469666, "uuid": "8d7757ef-7999-46ea-876a-7df6424befec", "comment": "Malware payload (LummaStealer)", "value": "5d2d5083391960a91b31fa3ff54181daa7952dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712469666, "uuid": "752e262f-fde9-49ba-b0fb-d6bf0cb4b8f5", "comment": "Malware payload (LummaStealer)", "value": "d41c1ba9d73e0e78cf5deb83ab40f617003d5d7e5fd31ff256c64cacf86a7b657e89f5849f4d830e29abaf49bf6cdb74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469666, "uuid": "033e31d6-0fc6-4026-8bb1-5e644edabdd8", "value": "T1746423D8E3DDCAA9C63B8E37DD47ED8882F06D90293825EDB62487F514143F19E5A132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469666, "uuid": "e732e117-e529-4d30-9ee7-fbd2128e68f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469666, "uuid": "05771686-3d0d-4b01-8472-109431cacc88", "value": "6144:9h2Flv5uGTXlgRSS1WKwYMcziuttV+t/DuO6gP+z:KvLrlgN8KwiRn+tr8gWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712469666, "uuid": "1ed004b3-e400-4d42-8818-6f1f60e820c6", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712469666, "uuid": "add99a0a-23fe-46cb-930f-a5de4dedb43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712469666, "uuid": "cb5fa037-a708-4fc6-8f93-48b96606a0f1", "value": "injector-trimmed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ab6437-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506567, "uuid": "f33b79e2-ea9f-4342-88de-4f29d956bed5", "comment": "Malware payload (Mirai)", "value": "db6a299875da9e1168e897c82545c26f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506567, "uuid": "f0b28a23-6244-4471-b614-7e5dc648975b", "comment": "Malware payload (Mirai)", "value": "57c48a0ced01c187bfd324e39fab0662a18852dbb9d96491c9aabbf50ea95690", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506567, "uuid": "8c72bb0a-7ebc-4619-a73c-dc54a3f2a6ca", "comment": "Malware payload (Mirai)", "value": "76f427e3b894ed26227a0f5b0b69f81c0e52d0b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506567, "uuid": "df4968b0-b887-410a-bcdd-21d374bc90d3", "comment": "Malware payload (Mirai)", "value": "562c5b77398e620c9308dd9890a71463e3e5f2742a92b845d6a24e1d7fcffceaed9b79e671a74187fd69afee6a008fb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506567, "uuid": "7d61293b-bd9b-416d-9014-6e7391eb6331", "value": "T116936CC5F683D4F5E89304B1213AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506567, "uuid": "4c7aae90-ed9a-46b1-a187-51d1e16b5f75", "value": "1536:xpmWc2AcighsZ82fJxfcHdHD1mSsM8meUigBQ9TnkISGtAdG0xZ:xpmX2riED2frfSdHhmLVUBQ9kVTG0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506567, "uuid": "8f8b624e-9645-4e02-bcdb-19badb7c7983", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506567, "uuid": "367e12ac-dc80-4e82-8dfb-38725d1d5d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506567, "uuid": "140d958e-6997-4f3a-b2d7-46990fd13566", "value": "db6a299875da9e1168e897c82545c26f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4a328a-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503870, "uuid": "399bc5a1-3100-4224-9664-8eef81b897d1", "comment": "Malware payload (Socks5Systemz)", "value": "6f643ca575b0c84f396218d35ee357eb", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503870, "uuid": "83d8db6a-a686-4b08-8b3e-453e4077a91b", "comment": "Malware payload (Socks5Systemz)", "value": "582eb6a9c01f3b520fe513b26d181476a59237f38b6457d269e5116316b5ba0a", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503870, "uuid": "15603bcc-0044-4267-9e95-94696cc55504", "comment": "Malware payload (Socks5Systemz)", "value": "f9a1bab98bdb6da1060513824d6c9ccdaa147364", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503870, "uuid": "ce76abb3-5ae0-4755-b178-2dbe4383c648", "comment": "Malware payload (Socks5Systemz)", "value": "b8b027f22b7ffae5b1a937b5abf4ba285974476a34aa0603f8b622100545de110ca96282e110a1487cfc70993d24d2ac", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503870, "uuid": "56b2851f-9566-4292-807e-b96fc2c45331", "value": "T142E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503870, "uuid": "9ace8e33-9892-4bff-ac97-39f0c4f4be79", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503870, "uuid": "450fa0b8-78ed-4867-93fd-54c6fa03b634", "value": "12288:HjsgiZdvAeRwx+acHR50cCJxBq09cvpWwhLmpRKLiTOkIRpQHkmkxiIjcBDQg5Ee:DsgwdvAo7x50cCJxBq0mvpfhLmpR+iTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503870, "uuid": "8618d3c7-e551-4e3c-a1e9-b98264306727", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503870, "uuid": "37705fa2-38fa-4061-ac9c-d94e75b7b32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503870, "uuid": "2402061a-8371-4231-91c1-fc3e35497cba", "value": "582eb6a9c01f3b520fe513b26d181476a59237f38b6457d269e5116316b5ba0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d57a85-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504369, "uuid": "50b61fe2-7487-4631-8175-7c297f624c42", "comment": "Malware payload (Neshta)", "value": "c00bf5ec75b31e923ee5aec01256beec", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504369, "uuid": "cc808e69-776f-4dcc-859c-ae624412d8e9", "comment": "Malware payload (Neshta)", "value": "58791943f34a44ddec9b7fa6d33e9d12e7173300d334a757e960bef72e55d5a7", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504369, "uuid": "8c0cabd3-f0cc-4dc9-ac84-6ae89fae5079", "comment": "Malware payload (Neshta)", "value": "94673623db9f758c03aef53066ec0d365b7f874a", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504369, "uuid": "530221ca-4a24-4dac-9d4d-d0212f5eb69c", "comment": "Malware payload (Neshta)", "value": "61cbc99b4004643905aa95885912ff122bf2764243213b0952b1a255758971f6e33320f308a37f0e6a6d6e622906b5e6", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504369, "uuid": "5adf1331-2f0b-4ebd-98a3-ed8141fa2280", "value": "T114A46C02B780DF31E26F0535996996B45A6F7C309F248BDB63943E2DBE306C1A935B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504369, "uuid": "52844a30-2744-4c5b-9914-0935780e4760", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504369, "uuid": "beef6991-e645-4f4b-9da7-23517f06649c", "value": "6144:k9hvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMM0vpBVOmqahw8jAG/jAGT:LbgvuFuQdj+zRTJkX8yMLBLjhw6AsAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504369, "uuid": "a4a0a355-dea9-43b0-bec7-a3a393d40571", "value": 451080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504369, "uuid": "52c90f4c-4843-410b-9ba1-c6602b265c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504369, "uuid": "10bb783f-5e6a-40ab-9e8c-b7089e1b1e01", "value": "58791943f34a44ddec9b7fa6d33e9d12e7173300d334a757e960bef72e55d5a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973073a5-f482-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712455221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455221, "uuid": "8819190b-cddb-4fde-8832-7fe5aa6f58e7", "comment": "Malware payload (njrat)", "value": "2275e7e409940a30ade6d3362d3133dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455221, "uuid": "d240d93e-20b8-4a59-b7c0-89590754a9ae", "comment": "Malware payload (njrat)", "value": "58c89c14d8bc30283cb8be7afac30f0ea2c89c9a80dde4f1b898af763fe3e6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455221, "uuid": "eb2df14e-81a0-4d6f-8037-279990bce774", "comment": "Malware payload (njrat)", "value": "861ae26b25ff0c0eca9010dec239b76d36e13e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712455221, "uuid": "2b543203-de07-44be-9dc8-6b1f1c01de20", "comment": "Malware payload (njrat)", "value": "3da341e02c707453b09b447c59d5228360af93a1912249a7f2ec8fe3b23a63d39d469744f20158700f1225c126414775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455221, "uuid": "4d61b516-4af6-410c-b7e5-a014caadc116", "value": "T1F7B30D387D952133C67AC1F689E50A8BEB69223F3191E8ED4CA752C418B2F156EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455221, "uuid": "f61fa8a9-6586-463e-af98-0a1965635256", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455221, "uuid": "a2011a3f-a26c-42eb-8e80-2f8c2d177f9f", "value": "1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuM2:P5eznsjsguGDFqGZ2r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712455221, "uuid": "0450c112-9e8f-44fe-bca9-95a62aee870f", "value": 115936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712455221, "uuid": "6b431822-a463-45e0-9f87-3ead39bbfaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712455221, "uuid": "e11a9872-b850-4146-b7c0-0a86bd81404b", "value": "2275E7E409940A30ADE6D3362D3133DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af7e4ed-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504378, "uuid": "f9e82358-1641-4ca4-af47-3f32c0fa0ef0", "comment": "Malware payload (Neshta)", "value": "0bba9ea4154714cec6d67a8788535723", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504378, "uuid": "4ac73088-62fc-4a7d-905d-378c9e4ede99", "comment": "Malware payload (Neshta)", "value": "5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504378, "uuid": "64b3bf83-005b-41ed-ab12-7d4e87725334", "comment": "Malware payload (Neshta)", "value": "4ae792b89db732e5c664bccaec9ef10797a8488d", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504378, "uuid": "dcc046af-6a5e-4d97-99d8-6cf42a9fd606", "comment": "Malware payload (Neshta)", "value": "3631c8cf440a6ca33cb007b62ccc5a946ef14096a34ba0519fad2f361ad1600285901488035bed1046f160cabd5579db", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504378, "uuid": "cbf01ae7-0310-4354-a28b-29a9ff23ff49", "value": "T1A2960B03E63261DEC5FAC139952B7323B8B03CDD8A35E767455093A22B74B64AE3DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504378, "uuid": "ff990c3f-0de1-47cb-a039-9525b37b29c8", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504378, "uuid": "b6862c8d-9eee-443c-8eed-593197816e31", "value": "98304:D6cZV1QNa2cGlKTdAp1VdV/b+tAeGJwTt1BWmJwL+lTBHMjr33:ZZbQ5zdtb6p1BWYHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504378, "uuid": "7b39a44e-11ba-42ee-82b1-b175e12d5f0c", "value": 9018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504378, "uuid": "40791a58-c79b-478a-8fb5-2775cd47338d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504378, "uuid": "f5e09c21-84ea-47f1-b248-3a2377149f84", "value": "5a3bf0b8d1a106547a414123b92c2bbf0560d1f38599956335c2bc8c2c9f4e0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d047aa4-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504381, "uuid": "74ced015-401a-493c-a142-af9b17ab40b4", "comment": "Malware payload (Neshta)", "value": "c0df41f52fb2d202626abefc625b63d0", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504381, "uuid": "48d303a9-f3ac-4c87-89ad-6774e85d3165", "comment": "Malware payload (Neshta)", "value": "5b0cf13c9862ca2a5d6b346013a03fa4cd6ec6980aa6833def3dbfce529d5bc7", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504381, "uuid": "8d269d0c-19a5-4736-8a9b-75ec468ecc39", "comment": "Malware payload (Neshta)", "value": "a5c0e1c3fe4272d38d78840c2742b64331a6d3fc", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504381, "uuid": "a4bc51a0-8ee6-48e4-b7e5-2d4a8c253a87", "comment": "Malware payload (Neshta)", "value": "11b7ca94af4a04e040a448be9f7ca7c3d7fce343d2b03123cdb14a1f08283a147ac987dee861c582f0930ede95620b2b", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504381, "uuid": "3b19c660-6939-46cf-9cb4-5c6297b814be", "value": "T172834B56F9B1C871D0240EBCCD2A87B8943A7E32BD2916A36BF52D4DECBD3C1290D549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504381, "uuid": "a2905a80-fa8a-4c29-9408-ca6f32bef990", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbN6yxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPU:32xqjQ+P04wsm1txqjQ+P04wsmJCcBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504381, "uuid": "b57f9a0e-ed3b-429e-a684-4d77c9e3710e", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504381, "uuid": "52efc383-9b7f-43c0-9d53-653c6fa25fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504381, "uuid": "d8a7cf8e-85fa-45a4-9e6a-dc9f36e37334", "value": "5b0cf13c9862ca2a5d6b346013a03fa4cd6ec6980aa6833def3dbfce529d5bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc9c86c-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504383, "uuid": "7b4cb96c-d3c3-4b4d-9ac0-3ba006475506", "comment": "Malware payload (Neshta)", "value": "0c4bec1f5f023ab44d766ab70721e6ea", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504383, "uuid": "7153b804-5725-4968-a818-c861f6f54bd9", "comment": "Malware payload (Neshta)", "value": "5b3a10b6481f5d0ce91ae8ebc08106fb061aa9529c25b2bbc6e864c3eaf46b18", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504383, "uuid": "e709c18c-e161-46cf-aa3a-478d2ffba30d", "comment": "Malware payload (Neshta)", "value": "0436b321fa3a31a5f737cd1b31e3195e219185f4", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504383, "uuid": "3fd4f411-5dd5-4847-889d-a694b247dc12", "comment": "Malware payload (Neshta)", "value": "c787294cbbd995226948ed7119e37826a070b77afc3d7a91aca2f9063597b45671e4907c5b167f9e6241ee5a3e610339", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504383, "uuid": "073904db-3466-4b2f-ba56-d1af9d35aea0", "value": "T112E38D4673D054F9D0265678CCB68614D3B3BC364678934F37A43B5A9E733822D2E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504383, "uuid": "d5630220-6a3f-4058-b609-55a17a3ba63e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504383, "uuid": "b84083ec-8816-48c7-9f44-8eeae9a568e1", "value": "3072:sr85CkkbAYn2GgYlBYN2fHYTo+ABt8wDSRUTT:k9xbAMpgY3gT48DRUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504383, "uuid": "2a92c893-c127-4499-871b-df33bd521ace", "value": 149883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504383, "uuid": "6fb5c636-6b4e-45f7-ad67-a5c40611fa9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504383, "uuid": "6e3e10a3-5498-441e-a8cd-291f2238844c", "value": "5b3a10b6481f5d0ce91ae8ebc08106fb061aa9529c25b2bbc6e864c3eaf46b18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8b2a12-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504384, "uuid": "91ebc155-b280-4aea-9419-e2a72c874173", "comment": "Malware payload (Neshta)", "value": "c0ca92ae4bcbbacec40c8e4065f070b3", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504384, "uuid": "91fe1d5f-31f5-4a5c-99bf-c3223ab8cf34", "comment": "Malware payload (Neshta)", "value": "5c7b43e57f11a62cc03f857e6e7117afbb848418afc241482755d8f8dfa98712", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504384, "uuid": "2ab2142b-d48a-41ad-9dc1-b0ec9424999d", "comment": "Malware payload (Neshta)", "value": "1cb76181e874bab037e69910d130df2aa60200f3", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504384, "uuid": "ea7f17f0-cb95-4b4f-855d-086da7f28fc9", "comment": "Malware payload (Neshta)", "value": "af60624d01c2914a264d1979ca2a8afee4a16710473b5babb504a79d61c576d69593002839620749c7d597786f1e2db2", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504384, "uuid": "6983e4ba-6faf-4806-9b70-82a05d490880", "value": "T13A836B56FAE1C871D1341EBC8C26D268D43F7A317D2A2AA2BAE51E4DDC7D3D12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504384, "uuid": "6c26106e-9858-461a-823d-d123580496fd", "value": "1536:32xqjQ+P04wsm1CxqjQ+P04wsmJCcB5U+Qz:3Xr8ljr85CcB5U+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504384, "uuid": "5d8dff4f-1191-4b0f-ba6a-31bc330b4f59", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504384, "uuid": "68fc63bc-5e98-47cc-ad0d-8870eb44cca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504384, "uuid": "04dff84a-146c-4521-824f-26102b769e2a", "value": "5c7b43e57f11a62cc03f857e6e7117afbb848418afc241482755d8f8dfa98712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7d7ad9-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515655, "uuid": "b0fd8599-2921-499c-8a44-7cb3399441de", "comment": "Malware payload (Mirai)", "value": "031da3061f58af0e826bce63905764fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515655, "uuid": "4865676d-04a1-42c1-a6d2-8f9848921945", "comment": "Malware payload (Mirai)", "value": "5cf626d22d01278aced56fcc1b27c14bf56c5ea7f8abf7c14b0350b2c2299f8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515655, "uuid": "a3e9bcc2-a584-4bb7-bb95-67744ea8b72a", "comment": "Malware payload (Mirai)", "value": "3f2f2fd702cd64e57b7d428727df4c6e8b417092", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515655, "uuid": "e1dc591d-33cf-4661-8b90-3c49a595cbad", "comment": "Malware payload (Mirai)", "value": "d489d175ed8eb99e5dac6622165718dd6055fe8e262aa5cd72f03ab8e30d0a93c430356578d1751af65f04703936ebdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515655, "uuid": "1426ec1c-b375-40ec-9c6e-6e1d9e093c9e", "value": "T172042A46FA404B13C0D627B9FADF42453323AB9497EB73069528ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515655, "uuid": "94eb4805-61b4-48b5-82de-184b58a48e06", "value": "3072:ftjUeNbBLbcBCkoajwdyqkkovT/6EBpcO/1Jso0M/R7VO:ljXBLbEloajwdybkQRByO/jx0M/R7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515655, "uuid": "b0e2701e-d798-433e-b71e-b51224f72829", "value": 179821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515655, "uuid": "0370ef03-7c9a-431e-99c8-e648cbbe6db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515655, "uuid": "49e190f7-9195-4fcd-b068-31f99056389c", "value": "top1hbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3553fc2d-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506167, "uuid": "099a7dcd-2055-45f3-9a3b-9133881de4c7", "comment": "Malware payload (Mirai)", "value": "a000445b456f9d57c90534916bc255dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506167, "uuid": "1c609b27-7b4e-47a4-8733-107c5b0b3734", "comment": "Malware payload (Mirai)", "value": "5d07180705b191d5adccddaac9d4605db0cbb51affe9bda29dd252adcdbb676d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506167, "uuid": "45d46ab6-18aa-4a67-89a4-c66be9b7105e", "comment": "Malware payload (Mirai)", "value": "f2529358136df2e2dcd4c05306e7110c3216a3ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506167, "uuid": "f656b781-35b1-413e-a27c-3bd3fd05baab", "comment": "Malware payload (Mirai)", "value": "ad0762fce306392df44485a77665b4e82dd91cd7712f31847d1bfbcc7f075cbec43a8c75a50dc452e2e57e70debccca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506167, "uuid": "7f51239b-611f-4a4f-8aae-45dfda6ab72a", "value": "T16C73F749FD819B12D4D522BAFE0E018D3357676CE3EE7212DE205B2467CAA5F0E3B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506167, "uuid": "9e4aed56-9c9a-4fb6-a738-7c9db6d23403", "value": "1536:lWniNJArbVXzc67tZxxmGpe+MQGdlvAiWYDHTNdHE:VUbVj9xnxmGpe+wvLTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506167, "uuid": "2495cfe5-5eb7-4487-b8a2-a72224f358a7", "value": 75620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506167, "uuid": "9d15c72d-d422-4a56-a8d0-7e109d7de532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506167, "uuid": "a03d86b9-2097-4293-8625-1054f52c09ef", "value": "a000445b456f9d57c90534916bc255dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f930eb94-f513-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712517662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517662, "uuid": "42032f47-e5dd-4cda-8cb2-9e3090bb83fa", "comment": "Malware payload (Gafgyt)", "value": "36b3f7221753757e6bc9f063825942b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517662, "uuid": "87139716-2429-4534-a91c-3bc10c141450", "comment": "Malware payload (Gafgyt)", "value": "5d259da8764e1df97d656fefcc956dde7be8ff3eaeab7dac1d311f6d50c74b48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517662, "uuid": "722fda83-d90a-49b8-89bb-6ffdba105961", "comment": "Malware payload (Gafgyt)", "value": "99ba1363aece166fd41789677066cf954fa1be03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517662, "uuid": "e128318d-752f-4573-ab76-b0dccb1bf0e4", "comment": "Malware payload (Gafgyt)", "value": "5919e25f9bd540766ffae7cb556857d15f6e3c61c902cbd943764d98041dfbe191428c7ad6c78426c5da84bebeb77e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517662, "uuid": "aa5f43ae-d1fb-4e43-825a-add8f94c64a4", "value": "T1F6931A41F9448B27C2D227BBE78F439D37366A5497D733026A257EB42BC279C2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517662, "uuid": "c90bfb92-1ece-454e-b7b0-c760f48ce521", "value": "1536:r4kI9VQPA+CJObE78OwWnxDS0EN0rO7cvo4PzRxQM2I2sWJ/5tk6mCVrQAFW9OXs:kQ2JOb/WONWo4Ps+WdI6mCVrQAFiOXkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517662, "uuid": "75c108a5-52fa-4b81-9dbf-10fc61f079d8", "value": 97523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517662, "uuid": "1f68ecf8-c849-4dd5-a213-aee6a1ce2713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517662, "uuid": "b3046d19-df3e-4076-985b-b94a3f33a54f", "value": "36b3f7221753757e6bc9f063825942b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211231b8-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1712504415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504415, "uuid": "21bee3a5-4307-4243-b9dd-1fcbd9b43b07", "comment": "Malware payload (MarsStealer)", "value": "1dba954b14bc941c13917462e368c560", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504415, "uuid": "b7ad043b-daa8-4b4b-a519-e07ee31a747a", "comment": "Malware payload (MarsStealer)", "value": "5e1aba37fd2ab19677b7a59505924bf18d8809037cbbf50b7b22c4a74b421396", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504415, "uuid": "e99aa181-7cb8-428b-91c1-556ba1ee627b", "comment": "Malware payload (MarsStealer)", "value": "ab9eaf52b10a9d270ba0776087456f55ca10c447", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504415, "uuid": "a76fdc6b-17b5-42f8-886e-9428941ea4be", "comment": "Malware payload (MarsStealer)", "value": "ef73a0286f98f01655034e15628cea5f06b16ff3bcec6daf2066e0c53c02ff020db21e8294a76002232e2e6d243c2e02", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504415, "uuid": "df2fd079-152f-4ab9-b602-f4bb5871121c", "value": "T10AE638243BEA53EEF173AE794BEC74968A6EBE733AC6741D105123460A33A41DDC1439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504415, "uuid": "183d7aee-048c-4cd9-a207-d0fcdac1a0ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504415, "uuid": "e66fe772-04f9-4107-a70e-700f7b629b9f", "value": "12288:Mi2f75WQGH5Tua5O7g8+V9rI0djHf1lwNfUNq71j8/37vXu:V8YZO2j3I0dP7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504415, "uuid": "2c6c6221-4c7f-4ee2-ad7e-65b3bad9c34f", "value": 15174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504415, "uuid": "800df7f6-ac65-4959-81d0-738bb0ae7f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504415, "uuid": "cea30959-8c83-45c4-9b19-ec94fcb84617", "value": "deeplsetup64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e800dc3-f533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531039, "uuid": "7ce8195d-32de-4c39-ab6f-2f16a7d97c5b", "comment": "Malware payload", "value": "7e0b4d8e9f18c23a849ba607db39d7f5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531039, "uuid": "9b639e0f-7a51-436b-a88c-28c6bf5a8136", "comment": "Malware payload", "value": "62e2f19f17bd5f87d69982c306f182bf349eb208a7f0fe74d5d427313f4a0e82", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531039, "uuid": "197a08e5-370f-4ba4-babe-508ced3cd336", "comment": "Malware payload", "value": "8cb6c3302ecb189dae29174b9e0c4e78ce7dee65", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531039, "uuid": "9872eb17-8248-41d1-885e-e226519b7e5e", "comment": "Malware payload", "value": "3a76881220c1e1757c6656ef386bbc1e72f16a20870f6c264603b851aba23484763682478ecf03fcd0a06b4595d4cf43", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531039, "uuid": "5c5ce831-157e-4a72-9908-d47c5a9045df", "value": "T1DCD76B93FF6E161CC6749EB4CE535778EB60F4A06A626713867816313CC219CAF12BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531039, "uuid": "f283f603-2d64-4394-b80d-ff8442a0df04", "value": "393216:K0Uf/eM7C8/kRC94N7YdG8nc9JGcROmzt6jy2NN76Se5nDW5:K0U3eM7C8/koOUlngErpWnDW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531039, "uuid": "2737c52a-31d2-4b6d-96c4-4c7abfe9ec6b", "value": 60129848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531039, "uuid": "f6745870-c05f-46df-8832-8fb9c6df8f96", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531039, "uuid": "b70c9196-768d-4e0c-ada3-533e76a37b9f", "value": "libgo.so.22.0.0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6497a7-f523-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712524275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712524275, "uuid": "8eafcb51-4e1e-47be-8ab1-2f3fd03a5446", "comment": "Malware payload", "value": "fa395a0801b64635edd7fc659a8263e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712524275, "uuid": "ad74e962-f748-4fb5-b6b9-9c077f90be96", "comment": "Malware payload", "value": "6369d77861a09979280e4858468b2c3a93bf2b3567e82ff41e423c736361ebe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712524275, "uuid": "bba49399-8072-47e5-9e98-4e2997e06a0a", "comment": "Malware payload", "value": "31ff4d0d3ee23a53177c0b60cf27cdc04c672870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712524275, "uuid": "bfcd6a81-c09a-42d7-ad78-176fe0717038", "comment": "Malware payload", "value": "097669bad856be3c7deb8c6929cce3d3aedb4f7282b4653ec0a90250fc05a9da80db6f747d4d5a93131c7804fbe52467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712524275, "uuid": "64c99177-9fa0-4891-902f-aab129132afa", "value": "T138032C497E258CFBEA52533E90E7C7762B3DF1814A235BB3B730B7344B136922499246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712524275, "uuid": "cf5d051d-784f-40d1-9961-dafecf3dde1a", "value": "59c1fb589f3d79d25bff8bd6a96355f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712524275, "uuid": "b9688302-8181-4f4b-9fcc-8f831e673eb4", "value": "384:iOp+E8KOkqrzCI4GS1dIZNDss4FhB8qB2gxI2VbPeuaBU3losjuzZ6UwYRGZqy7X:z+E8PykKz8YdPP3lLuzZPKqjCxn3psm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712524275, "uuid": "a2343300-99bd-4631-b8fd-f27c3e88a81c", "value": 40850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712524275, "uuid": "3873153f-6ec8-4352-b2cc-000939906111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712524275, "uuid": "72ee6ea6-af55-465b-8ef8-81e166eefdeb", "value": "fa395a0801b64635edd7fc659a8263e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbda3f1-f532-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712530770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530770, "uuid": "0aed6fec-842c-4587-9306-bf1b73a5bdab", "comment": "Malware payload", "value": "18a0c4e5b4aeda6d50447b7cef9442a2", "object_relation": "md5", "Tag": [ { "name": "XYPayload", "colour": "#E09018", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530770, "uuid": "0922488e-0623-42c1-a169-7b17fcf8c034", "comment": "Malware payload", "value": "6398e3832dd4282ec96dd9298d3f659337f8049e811baf2a1d97c4b28ca3b482", "object_relation": "sha256", "Tag": [ { "name": "XYPayload", "colour": "#E09018", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530770, "uuid": "3ca711a5-147c-448f-a66c-d6bd19536d06", "comment": "Malware payload", "value": "0164fa8df450d9b00cc65354b91bbf623326ec8d", "object_relation": "sha1", "Tag": [ { "name": "XYPayload", "colour": "#E09018", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712530770, "uuid": "e5adb82f-c813-4485-b0e8-12fbf35a65b1", "comment": "Malware payload", "value": "d16329214c443a9cf85a5d814020a25b9a2ef3043ba763a6d9be0ded6650b2cf2b5577ca7734ece0f09c6427f50cabf0", "object_relation": "sha3-384", "Tag": [ { "name": "XYPayload", "colour": "#E09018", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712530770, "uuid": "e1fc071c-9d4c-4a7b-96e2-ec7311a04d86", "value": "T185163353D0225F622689B13352A958CC799CAF7FB3AC0C10DE8967ACCCB761F5639711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712530770, "uuid": "8f43ebee-0431-4cb0-a555-3c6605227149", "value": "98304:REZeaS4n6fKuCDeK9kpJH9fsAjJ6LeuIVe:REga16iK7H9fHjJ6NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712530770, "uuid": "15f4290f-4906-4dd0-a61e-79944fe40ace", "value": 4226277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712530770, "uuid": "6f4b77e8-fe7a-417b-acf7-e9dbc45831b4", "value": "application/zstd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712530770, "uuid": "eac2f741-7eab-42c5-a1a5-4b63c543662a", "value": "XXYpayload_amdgpu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5be29c-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503872, "uuid": "07cb6832-ea60-4b88-9268-029f54e40259", "comment": "Malware payload (Socks5Systemz)", "value": "7f731ca2d4ab270b59c36d14a6ec7c96", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503872, "uuid": "ebf7de5c-0cbb-4816-ae5b-787af6ee1177", "comment": "Malware payload (Socks5Systemz)", "value": "63cc84df7b4955000e37e8b2068a892506a8e3c3859ea802327e6233babf52c9", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503872, "uuid": "1792c127-d517-4b27-b76d-da99465a5090", "comment": "Malware payload (Socks5Systemz)", "value": "7cb4c0c596dddb374e4475f0b4180dac564c92ff", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503872, "uuid": "05e9372e-1391-4f43-a035-c55f45ef9853", "comment": "Malware payload (Socks5Systemz)", "value": "97deace30f8d3e04de54e5858d5f46552a3aa6838d795fae64cabb6b664d1dc485920445533cfc61c8c40bf0df0b2bd8", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503872, "uuid": "50cc88b7-99d5-4b22-a988-a2d0bf70bb51", "value": "T127E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503872, "uuid": "3f621307-5c3d-4280-9c8a-835372daa013", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503872, "uuid": "edd7fa51-3409-4ba6-bef0-abcb11c81dc9", "value": "12288:HjsgiZdvAeRwB2+aqHZ50cCBnBq0ncvpWw11mhRKLiTOkERpSHumkDiIjcBDQg5J:DsgwdvAhbZ550cCBnBq0cvpf11mhR+i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503872, "uuid": "dceb118a-e223-46d4-8599-f7ddf5335fe2", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503872, "uuid": "8e8f22e3-1d8d-4852-9c43-b3060d5a78d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503872, "uuid": "e8e95d44-55b5-489b-964b-ea096d2b7c0d", "value": "63cc84df7b4955000e37e8b2068a892506a8e3c3859ea802327e6233babf52c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19fcf36-f506-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712511932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511932, "uuid": "5c7b5bba-862f-4815-bdb8-23e9903ec94b", "comment": "Malware payload (Mirai)", "value": "804fd7ad1e2f877eede67f40e31a4bba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511932, "uuid": "3049ba75-d955-4288-b0cf-31a45d225b1e", "comment": "Malware payload (Mirai)", "value": "644af42f11122f38964208e0b124c75d01ee25b2b24ff40e33fb6cee47b41774", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511932, "uuid": "a3f2b431-6ac7-47f8-a785-6681e5c0a28f", "comment": "Malware payload (Mirai)", "value": "db927cdecacc7ceed307acff72ad7b18aa5a0378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511932, "uuid": "c126ff25-58b4-4be8-bb9f-1784f2eb6a0a", "comment": "Malware payload (Mirai)", "value": "1646f9ef0b5b6de51813e4aec85cd63f16127b548097bdbc1689542849c75677a7a3e13853b411bbd1fdff8b29005ef5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511932, "uuid": "e70fc091-b00d-4861-849b-98a6fe772cae", "value": "T113435CD6E583D8F6EC0B04706035E72BAE72E0AE2219E647D768D531FC8FA41A513D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511932, "uuid": "1a31c9c4-c116-4be5-8055-d5c13af1171d", "value": "1536:kUeU8CS3qhe53IY/ElhAvEhbpvuKjBc1Epu/j6wCSqzecO:kbU833qhU3X/ElhQEhbpmQMOcj6wWzep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712511932, "uuid": "1028b4b7-033d-460f-8c4b-354e8f262e4e", "value": 59632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712511932, "uuid": "5d2e3e27-ba36-4b03-9fbd-e3035d0b1f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511932, "uuid": "76271d79-45d6-4a98-8958-1e9d3ca27a5e", "value": "804fd7ad1e2f877eede67f40e31a4bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addaef8a-f486-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712456977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456977, "uuid": "e46c77b2-bc09-4903-ae43-7038c6b0fce2", "comment": "Malware payload", "value": "d9957104f2eb28ac56734acadac8573e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456977, "uuid": "24422b4d-7630-4a06-81f3-937660b0452a", "comment": "Malware payload", "value": "64f9010e71bb617c05f51fbe79d0924c0ed9370268aeeea57faeefcb707c0039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456977, "uuid": "ab008898-a3f9-43c8-9e36-f7940d5cc4da", "comment": "Malware payload", "value": "b423d621ecd77272a1d8a77007a8e6dceb5c8066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712456977, "uuid": "6b95086d-f85c-4f40-96d0-78330d1beefe", "comment": "Malware payload", "value": "673d7ae58957035ddfa574eeaff597be5d05b2b8a535fdc8da7b33a4741e0b4c0f7e9b84f144d2839d3a40513b83a552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456977, "uuid": "7f54119a-a127-4875-96f3-0bd8237faccf", "value": "T1F8762324E6928E7DDE175AFDA04E45EBAA6F9DE313C5003327F095D1CAA42D0841FE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456977, "uuid": "d65e64bd-9728-475b-ac85-2a83ca2760f1", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456977, "uuid": "6a02b672-05e9-42b9-b04e-7010238f31f9", "value": "98304:DwIm3vc0p5at/7rTM9n8fl/tIi5A/K83k3fYChTkxAPljwl5ShlnAb3u7luu:DxWvtC9TM90tFYk3XPljwlIhmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712456977, "uuid": "31f80329-5ff9-45b2-be71-ee6c1906aef8", "value": 7260624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712456977, "uuid": "2b07948e-a6d5-44ac-b785-0deba250427b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712456977, "uuid": "93ec6470-f5ee-4095-b5d4-55d3e168fbfd", "value": "SecuriteInfo.com.Trojan.Siggen21.29401.7970.18980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54b54eb-f504-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1712511133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511133, "uuid": "b8c3a31d-9792-4a05-aa97-c9454505e5bf", "comment": "Malware payload (GCleaner)", "value": "0018653ec1855bad23f81fa13f2e2bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511133, "uuid": "b55aa3bb-d3cb-4333-b91c-203ec51cbc5a", "comment": "Malware payload (GCleaner)", "value": "65e6e068eb8714b0538e71485a1cf8f2c362e5669328c5222278d13b820e0914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511133, "uuid": "f41083c0-524a-4403-8d34-375893467f54", "comment": "Malware payload (GCleaner)", "value": "1054e1cf92fbe9fbd2e35b7a30dfefa598ffb14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511133, "uuid": "631de59e-0a39-48a2-9ec6-8e7ff212ba82", "comment": "Malware payload (GCleaner)", "value": "4a22e17a8217993231830e82d6b16944a12851734deb9baf16f230793e0eab8e5565503ab97d0525134cb5bd6eece346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511133, "uuid": "b4e52469-2c04-4814-a59a-c3a8f475edc2", "value": "T15F84CF15E2E1E433C86256344D7587E81A7FBCE16A34B25F2B542A2B6DB13D0BE21373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511133, "uuid": "d025cf29-1de7-40e1-bbc0-1e2118a774f7", "value": "37a554737fc76f8b4939157992b97bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511133, "uuid": "073b40e0-ed2f-401f-ace0-19518572a73a", "value": "3072:CozpUIqGz976y4vcWm4ubfJGOjuCAGbPMNULpLRECHynYvS48wdFG2ZeM6cdueyc:CopUIqK97AkW0B5zTkYp7S48B2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712511133, "uuid": "c95a26c8-2b80-476a-bb0d-59c2ef50c03b", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712511133, "uuid": "7e43fd05-56d9-4267-9123-1c79fcd2ff37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511133, "uuid": "ac215ada-d208-4aa1-861b-809264c4d95f", "value": "SecuriteInfo.com.Win32.PWSX-gen.20755.16168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7e6e7b-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503874, "uuid": "31c0fe57-34b4-4e0f-b994-4a5b17b4496f", "comment": "Malware payload (Socks5Systemz)", "value": "098df90c0ea73a179c206da5f20a151c", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503874, "uuid": "cf3cba81-0a48-45a9-b09d-5b8b1d7d27d3", "comment": "Malware payload (Socks5Systemz)", "value": "664fb81c8b26f50e34b3ce60cac5d79d1f7d75ea19346e4dc68e7898dc20332a", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503874, "uuid": "b9e3a63b-7d85-4794-af24-962986a58eb6", "comment": "Malware payload (Socks5Systemz)", "value": "2513c99f4f72772df98a86ebeb11b8e08769054c", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503874, "uuid": "e625531d-225f-4fdb-b50a-5866b0e0dd8d", "comment": "Malware payload (Socks5Systemz)", "value": "696d85a934afb31c195306c5e395c7bab33c43a53a2f126efe07ce4c713712a86bbe2ad0fd0dd5c95cea194da24cd65e", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503874, "uuid": "f36f8059-4f41-4b97-80a8-f324e0bffe59", "value": "T1C1E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503874, "uuid": "b1108625-72cd-4fcc-8665-cb3d2dd5511c", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503874, "uuid": "7c0efaa1-a474-435a-94f0-cf0240e4d3fa", "value": "12288:v+XssgiZdvAeRwp+aVHXDMu9zO0t+WANx04x29oOjjI1Y4hwfS9wojsS657Rk2kp:LsgwdvAga3DMu9zO0t+WANx04x29oOje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503874, "uuid": "ed46ef6f-a6a4-411c-b0c9-4b77e5c0d2ce", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503874, "uuid": "ec86ea88-68ef-4c79-af02-498499641708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503874, "uuid": "c653f8cb-f45b-44e8-81c4-5bd4e742e1a5", "value": "664fb81c8b26f50e34b3ce60cac5d79d1f7d75ea19346e4dc68e7898dc20332a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebeed2c3-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509480, "uuid": "b9589ac4-8e09-4367-abbd-cd54a61f83e1", "comment": "Malware payload (Mirai)", "value": "57d22fc49d3fc372b7762e61bf5d4496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509480, "uuid": "5d08c238-30f2-479a-84a7-c8421feb15d2", "comment": "Malware payload (Mirai)", "value": "67eee1baddaddc6c2d52ad8f9e790ec4219eacb1f00e72585d80a72820fca9b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509480, "uuid": "1f9d3010-85e9-4530-8fd6-f15792af17e8", "comment": "Malware payload (Mirai)", "value": "9d773b141a8582f53dfc54000b3aec3eb1db7840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509480, "uuid": "9c93dde4-8d01-4cea-99a3-3de36f4157b2", "comment": "Malware payload (Mirai)", "value": "551a307276c4d19b98cb8f661bde170ed79317c2b78522a7a607f8c9f4202e430e91ae7d88912c7f472e42e7009c731b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509480, "uuid": "b7bffa2e-a1e1-4db2-8b17-77f1de455373", "value": "T11E24B61E6E228F7EF76C873047B78A31A76923D627E0D644E1ACC1145F2025E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509480, "uuid": "815d1eda-ed95-4919-9d53-ec60451a5c4f", "value": "3072:fTeV3uCWVo3z3LPLKzUnASRvx9F+7OipcVkgTPMx5s:fTeVeCj3z3L1V99MOiEkgDCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509480, "uuid": "f90dff06-89a2-4550-a6ef-a0f4dfb97678", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509480, "uuid": "0226b069-021a-4771-a9dd-5c4e96e595e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509480, "uuid": "a2ec30ac-cf86-436f-8f59-6f75de603818", "value": "57d22fc49d3fc372b7762e61bf5d4496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7690af7-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712518089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518089, "uuid": "8efa524c-4a49-47f9-8066-f7acfb7da17b", "comment": "Malware payload (Gafgyt)", "value": "41750ceb89c64ba3075826712cda4297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518089, "uuid": "29ecce6f-7a02-47c3-be0d-a422d67dfc5e", "comment": "Malware payload (Gafgyt)", "value": "6824cc9368dd365bd9b055b93e87f0b94de2708ab74035bc7a5f040846269881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518089, "uuid": "bfa7f629-e3c4-491c-8ec9-dfc78394f9fc", "comment": "Malware payload (Gafgyt)", "value": "49a977df5acbe1c4f251c089c7961d5fa04dd08f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518089, "uuid": "c7c86e26-0e4a-425d-b51b-591c0b36dc45", "comment": "Malware payload (Gafgyt)", "value": "3a554d5dfcd42209c5feb34034cb58a6c9841aed83caeadacad439a834b39b323b630a03118ebe7a43238720daae6252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518089, "uuid": "58ebb39c-3c49-470b-8e6f-d276e9654256", "value": "T13A634B03A781CAB3D09316B606DB9B210132F97B1A1B9F55F32D7CF49B111C8B267B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518089, "uuid": "e6cea493-53e4-4752-b0b4-8b322c19678c", "value": "1536:qGkvRT+UuUcSq0dbvFRexxA6Cxu0MgmSSfmBRGmLI2VOCjXUfJRk:bkYUuUcv0db9ReXnC0cSfmBRGmU2VOCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518089, "uuid": "da4a362d-b885-4648-af5c-1f5368381d56", "value": 73121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518089, "uuid": "4e6888a0-2ea6-4da7-9a5c-443562ee08da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518089, "uuid": "0c2e7bbf-1980-4bb4-9c3e-0b1847605c60", "value": "41750ceb89c64ba3075826712cda4297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0638c25e-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506517, "uuid": "2b4705c0-e180-4bdf-b419-dd5576d2e07b", "comment": "Malware payload (Mirai)", "value": "cbd1dca88d20db014150e5a2e8b9e8b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506517, "uuid": "963ba9d8-07bc-46c7-9ddf-d0d10aced374", "comment": "Malware payload (Mirai)", "value": "6830ea8b8b1f6c500dea74d6a3c496a32dff5384ae3dace38f44110110d7e39d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506517, "uuid": "c7c3c406-3107-4a3c-b86e-452a7c5d7af0", "comment": "Malware payload (Mirai)", "value": "1c2f7664df8cbfa211beedc477b12f6db84cb81b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506517, "uuid": "ade8b5f6-293d-4ceb-99ad-1102bf790021", "comment": "Malware payload (Mirai)", "value": "b90ea18b4fab12594b4c3f64609b565cea682882d64853f083cc11b61d5074e9f9a5ec1f88e477d9d2053b68fe16e5fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506517, "uuid": "6b913471-de0f-442f-9a18-802584173e5e", "value": "T182D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506517, "uuid": "cb07e3d4-533f-4ac4-a315-ef0ed4c180fe", "value": "3072:gHZ+X7Ao3xFOV48wlP1z0RraPuk8d+Ow9L3sibL:gHZcAUAV48MP1zuQ9Lsin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506517, "uuid": "b371edb5-0a0c-4bc0-98a9-692d409ec0bd", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506517, "uuid": "2c9c0ef8-0a14-425a-8790-b86ed8102bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506517, "uuid": "2751af6d-d2f0-45ad-9259-e5f7a1aa32a9", "value": "cbd1dca88d20db014150e5a2e8b9e8b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286a7aad-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506145, "uuid": "ddd5b289-866a-44e9-b74a-7a8b6185252a", "comment": "Malware payload (Mirai)", "value": "d011bdb20a59a6ffb990229144224d02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506145, "uuid": "b4475e0e-207b-4a7a-b906-3488ec3a1e8b", "comment": "Malware payload (Mirai)", "value": "6833345e500cddeecb6b7e365a51f8e0176a002a20d3aa55a34c1172875a0ed0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506145, "uuid": "80f401ed-f516-4135-9a59-e3dcbaf21e85", "comment": "Malware payload (Mirai)", "value": "6d209a9d7cde4b49ac7537e4b8be9fe60873a426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506145, "uuid": "a307df1f-309a-46b6-81ef-372325e43417", "comment": "Malware payload (Mirai)", "value": "d3e4561bf8371c163f273cfad683ac793a34f812e81afdd68f61ddc1ebc9c619b39019d4772cc67be7fec633121c3b2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506145, "uuid": "e702415d-3d37-4ff6-9f4f-121e72c2c72a", "value": "T190B34A77C8296FA8C259D5B4B0B09F792B63A58182471FBE54A2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506145, "uuid": "3722988a-783b-42db-8feb-8352586d0c24", "value": "1536:2aVTHW/qIAmPqoeHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zy:2qWLSoelDWMSBOlvC2sWqXxQrby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506145, "uuid": "24d4aba9-b91a-431d-a9d4-87b4cfcbdccc", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506145, "uuid": "b89b0cfd-ed1e-436b-a98d-f3fa8da44a87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506145, "uuid": "8123ab93-c02c-4974-98d6-0f573ccf7034", "value": "d011bdb20a59a6ffb990229144224d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7fef77-f47f-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712454020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454020, "uuid": "f91eff03-b040-4788-b34c-c6faa157678b", "comment": "Malware payload (DCRat)", "value": "4c6db42fb635d9aef809b0617918cedb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454020, "uuid": "c8fad0c9-d08d-4177-bf36-76824d9811fa", "comment": "Malware payload (DCRat)", "value": "684efa3246161dc6a58ebab74e56a1db300aaa63ce5e34fc41b0b50b90bc87d3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454020, "uuid": "7c705198-7aee-4068-9f5f-aa192047e484", "comment": "Malware payload (DCRat)", "value": "9a426491d43c8350c29ac9767d99b87319febabb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454020, "uuid": "b15bf65f-47fe-4483-867f-772b5f444b38", "comment": "Malware payload (DCRat)", "value": "38673b4be6feb9dfd7417f5028b6f311d06fbf50a1c190946b7cc69168c690a250bf0dcabb975bc31b7273350ebe2a28", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454020, "uuid": "9eda7269-8980-413d-a8bd-16f04197d50a", "value": "T154A6330C7FE0C3ABDB8DD3F9A49119DA62F1E6C6F4268B99751D35B38B011A4D90360B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454020, "uuid": "213cacc2-299d-4867-aa3a-9e223468707c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454020, "uuid": "5ba5da9e-1533-4e5d-98ad-ad572ea1f33e", "value": "196608:LlFMPfqmsrrk8TUjPVwKrwzV3c3pOVX7TLAHACUG5jV2f:B2erI8g9wZ32pygHAC/J2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712454020, "uuid": "b4ef7cd9-b716-4bc6-9431-4bcab33de905", "value": 10155520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712454020, "uuid": "69ef41bd-e97c-417b-933b-c4c536d6c32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454020, "uuid": "2bf5827b-9e8f-4951-bbd1-af8865fc3560", "value": "4C6DB42FB635D9AEF809B0617918CEDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c6e16d-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712518079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518079, "uuid": "32360e6d-a4c6-4ad4-babc-f4a24f7e4904", "comment": "Malware payload (Gafgyt)", "value": "8e277d2791cc09b39112a45fd7e9aceb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518079, "uuid": "7cf9d378-ecaf-4f87-a955-e4f522635ab8", "comment": "Malware payload (Gafgyt)", "value": "6876f866f7711fa596b2a84be3915226c6f159df094d6d4aac7ea8933bf90662", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518079, "uuid": "19858d9f-0c4a-43fb-bfa9-cc41d3e16c94", "comment": "Malware payload (Gafgyt)", "value": "8bf07adef9ca47d01583098dbfab48244b0dc60e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518079, "uuid": "8f06425a-e65d-407a-8be1-4be48718d5f3", "comment": "Malware payload (Gafgyt)", "value": "c4dd78ee38846fc912908c5e750647d3d0195616870607529c4823e66d37092d4713f89cf7358b606b70752fae73f3e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518079, "uuid": "d797f145-0ae5-48f0-a525-47aa71d6d9bd", "value": "T14D931941FD418B27C2D237BAE78F435D77366A54A7DB33016A356EB42BC27982E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518079, "uuid": "a4069972-349b-4d6b-81db-ad6dbc66acaa", "value": "1536:rBkl9VQPA+xvAakfgcyRq1iX/PTxHOh1aP/ismEfjmmREqQ4b/X7XSee:mQFvAZf1+TMaP6lmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518079, "uuid": "d788c8c2-ea3c-49da-9017-dd4ef49e3aca", "value": 92441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518079, "uuid": "3b4f3fce-73ca-467e-8401-b14e86a3f6e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518079, "uuid": "8d5bdfde-297f-4d44-b5ba-d0a0ef2f5dfb", "value": "8e277d2791cc09b39112a45fd7e9aceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112dfe7d-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712504388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504388, "uuid": "f23d5aa3-4cc0-4078-bec5-f7a36c3c3a1f", "comment": "Malware payload", "value": "ac338be07d0ce2c4f2e5cb86563979cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504388, "uuid": "6d9660cd-4e6c-4db0-acdd-c307e52a7951", "comment": "Malware payload", "value": "69708836d31783b0c61f17dc141f80ecbf9c1742a47af3e8e8a3ea833e60c563", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504388, "uuid": "1cb8d498-3209-490e-a63f-e13b3191a2b9", "comment": "Malware payload", "value": "d3029eac4307a8afd2de9eb0ae63dc5e269e09f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504388, "uuid": "472f6834-e840-43ab-8eca-80eac913db62", "comment": "Malware payload", "value": "c7cc67fb415ecf6ac5dfe8ca3e0125b9c743b7530a66f5c4152d37acf49d25df462a5c94c3942dc5340dcd89852a5b31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504388, "uuid": "ded6b273-8e4e-4ff6-82f6-75605e2c98a8", "value": "T19875BE13BBC284B2E5A702749576937F8A3ABA204738C5D797D0192D8C312D16B3F7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504388, "uuid": "80bf7051-8ebf-462f-abf8-405d4152eeb4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504388, "uuid": "b3567b80-9c04-49c4-ac7a-23fe5870ffd0", "value": "49152:HGEwF3dwKSLz/DdPhGzqKXUhURPNkPoZ0:HGzFiKSLz/DdP+qo1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504388, "uuid": "e1e8dc18-44b8-4b22-a0b9-f08c1945d0c9", "value": 1697328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504388, "uuid": "93355ec9-12dd-4ceb-a282-521d522fec06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504388, "uuid": "921fa07a-e5f2-4e65-9ca5-53ed3d367168", "value": "69708836d31783b0c61f17dc141f80ecbf9c1742a47af3e8e8a3ea833e60c563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e77608-f4e9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712499506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712499506, "uuid": "5789d2cd-219d-4576-8ea3-990beafde1f8", "comment": "Malware payload", "value": "df72195660e0fc4b4a2d636cf456894b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "WebBrowserPassView", "colour": "#F77F41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712499506, "uuid": "7c2be068-372d-477f-908e-2e165507ade4", "comment": "Malware payload", "value": "69c324c07b383daddec292ef6d618273481f0e499400c21a28676d97e5e73a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "WebBrowserPassView", "colour": "#F77F41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712499506, "uuid": "d1b96e00-0110-4cc0-aa65-c6e5cb821683", "comment": "Malware payload", "value": "48ddbd485e2629bb2045a318afb04a50e12b55ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "WebBrowserPassView", "colour": "#F77F41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712499506, "uuid": "b1393255-aa56-486e-8aac-fca1ff5c952d", "comment": "Malware payload", "value": "23684f446180391a8a3ee3001055a4d600d7e7939ee3418e66361f36135a7c067b29a5baaef5b52d35924957c43f33e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "WebBrowserPassView", "colour": "#F77F41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712499506, "uuid": "8e95cf5f-5f71-4df6-a44e-ecdec33ec711", "value": "T16FA4AE13F3D28036E8A70570066B5B36DEFAAB201235995797D40C89AEB16D2F73E347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712499506, "uuid": "588383c0-2154-42a0-b854-4593f3d76277", "value": "6144:zE+Z7EAXrvPRIxK0zBL/TIDC2dL3RltnfoBglM7zMUdsvk3zwAtc6:LZ7FXrPy4ix+LBltsgK7zXIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712499506, "uuid": "8d9ff3c5-a285-4a42-84e2-b39aff7bbe15", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712499506, "uuid": "f52cd147-4980-455b-aa01-93caf4c7cc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712499506, "uuid": "c1abe20b-e48b-4a08-965a-06732d439896", "value": "69c324c07b383daddec292ef6d618273481f0e499400c21a28676d97e5e73a72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b8a76b-f515-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712518110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518110, "uuid": "c7e1c0ba-4322-482a-8f9d-7ce3fde4ca1b", "comment": "Malware payload", "value": "1c65981ad058f1f5b3c73156b019e106", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518110, "uuid": "cfa7a2b3-996e-435b-9c51-96d37ff0e1d2", "comment": "Malware payload", "value": "6a581241ff8eaf5cc417bf849cae2fe3471ded662a41445aa950d27897e40edd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518110, "uuid": "618fe40b-eaa2-459e-a224-c94cfc733d0a", "comment": "Malware payload", "value": "1d38ab7227e26c3a8c69e464b7f90fc1013d31ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518110, "uuid": "1059d58f-c117-4bcf-af39-385f47c20470", "comment": "Malware payload", "value": "3ff238cea5ba2108c6e0136abf0081689810a046549b96d23ed78425e4836ad9bdd639d14950bc63dd8c6d47d1eca560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518110, "uuid": "3bce74de-a118-4171-b774-d175bb48007c", "value": "T16C933A277B230E23C0CA147216E30731E7B5D65938FA5397B9D06EAC2F16AC439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518110, "uuid": "dc34b204-f245-4290-8970-929323c7763f", "value": "1536:vZDDO6bfRNM51tDttB6PUwcmQ9FqXjewfeXse:JO2fRN8Pl6PUwcmQ9FqXywfkse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518110, "uuid": "9bfebf65-04d0-4026-87f7-e3fce17bd294", "value": 95696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518110, "uuid": "4d49a232-490a-45d8-ba8f-b344598c20dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518110, "uuid": "2a75067b-16e4-4faa-87dc-39e15fbe262b", "value": "1c65981ad058f1f5b3c73156b019e106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129cc10c-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504391, "uuid": "7c3fd5e6-8ce0-40ac-8a12-eae9892189f3", "comment": "Malware payload (Neshta)", "value": "53ea8864d595017bd0b68a57bc5f4bb3", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504391, "uuid": "29e831dd-852e-4486-9f73-01cb2506ec5b", "comment": "Malware payload (Neshta)", "value": "6a764f8ee688f09dcd96a992b358a8b352ad03a3730c1169465aea39808d7b9a", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504391, "uuid": "040d1d7f-f333-42bf-a432-2a2e976d789b", "comment": "Malware payload (Neshta)", "value": "d9d0cc33307c4ec7fb616b04f065eb3a9d9bdcd3", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504391, "uuid": "042aa4e4-cc36-4159-af52-3b9b64601e8a", "comment": "Malware payload (Neshta)", "value": "c5d28565cb6b793364fad0e7385a3df0699c57180132671c867f994d26fc7800052651aa6954a7543f94f12c10b05073", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504391, "uuid": "6bd0f6c1-deeb-4432-b453-79a768800236", "value": "T19A836C56F6E18871D0241EBC9C27D268D83B7A317D2A2AB2BAF51D4DDC7D3D12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504391, "uuid": "4c62c628-becb-4194-9ca7-1098752a5a5f", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbNEyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPJ:32xqjQ+P04wsm1DxqjQ+P04wsmJCcBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504391, "uuid": "fcd3c2c4-4036-48bc-a0a1-f37c9a1575f9", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504391, "uuid": "53b3fe88-4f06-486c-aab0-34bff7e08ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504391, "uuid": "0affdebd-65d0-487e-b9f4-6b6c84afea4d", "value": "6a764f8ee688f09dcd96a992b358a8b352ad03a3730c1169465aea39808d7b9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06cbecc-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503877, "uuid": "cca9d352-ec41-4d14-811d-432b0cce4256", "comment": "Malware payload (Socks5Systemz)", "value": "ae7c72c1baf33a7fa93c0a4060227564", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503877, "uuid": "011066c8-9923-4811-ab22-0353f90bcc92", "comment": "Malware payload (Socks5Systemz)", "value": "6ab2155aa153a6a6563d021bafcf35adb1e95268e6e9febc6f66b0b85d99f74b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503877, "uuid": "8d52cded-4213-4754-b205-9a024f6e58b4", "comment": "Malware payload (Socks5Systemz)", "value": "df474549c4c0ffe023bdf7427d3172c0cd3ffe9e", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503877, "uuid": "b9156011-79c3-4fbb-b59d-e2745ef8894b", "comment": "Malware payload (Socks5Systemz)", "value": "2e904cab80fecc3f39ff40e20ac37f846566e4293270b5851ec3d7773b89b0eb01166bc0144c8b034c44c731d53279f2", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503877, "uuid": "e03812f8-0aec-4bd4-86da-29492646c810", "value": "T1A3E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503877, "uuid": "01c38d3f-7fd7-42e2-ae6e-63aaef65126c", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503877, "uuid": "a2bd6b92-2c76-42db-8aaf-10379763290a", "value": "12288:O+XssgiZdvAeRwT+afHPnYu9zO0tyWUNx04xO9QOjjI1Y4hwfS9w8j4S657Rk2kx:KsgwdvAqUvnYu9zO0tyWUNx04xO9QOjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503877, "uuid": "167d10ae-42f6-4c4d-bbcb-a8264604fcd5", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503877, "uuid": "e8ee659c-e3cb-4105-b53e-928bca97917c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503877, "uuid": "31a4f122-0cde-4a3d-ab29-454323a71582", "value": "6ab2155aa153a6a6563d021bafcf35adb1e95268e6e9febc6f66b0b85d99f74b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135ac268-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504392, "uuid": "686b30ab-31f7-432b-b02d-a90b485f5558", "comment": "Malware payload (Neshta)", "value": "75258d8d5542f1c5028de1decb4b8193", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504392, "uuid": "e7a87707-40bf-48bb-9a02-5b99813f1f01", "comment": "Malware payload (Neshta)", "value": "6ad4bdc743e1fce00eabc2d296659148e0517d39d8dab935929dacbdb8d04f18", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504392, "uuid": "ff1af415-45fa-4f2e-bd44-eafc3bf3b247", "comment": "Malware payload (Neshta)", "value": "2092db8f647053d822b7d9db345f33aec2e345c3", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504392, "uuid": "ecc3fee0-ba7d-463b-9984-ec54799d4b71", "comment": "Malware payload (Neshta)", "value": "7f7a8b1358184d432ea9e9b479245827cf641ae200509d68dee448b3623129919c11fd194b4a14958ba9c064c39e46e3", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504392, "uuid": "3601e949-d64f-4962-9efb-65a0bc234381", "value": "T116837C56F6E1C872D0341EBC9C269268D43B7A317D2A2AB2BAF51E4DDC7D3D12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504392, "uuid": "34b47995-30db-4d87-a867-876a57c4c477", "value": "1536:32xqjQ+P04wsm10mxqjQ+P04wsmJCcBOni:3Xr8lOr85CcBOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504392, "uuid": "4ba86fa7-be21-4075-8f7d-57382ba66a2a", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504392, "uuid": "6e8def83-688c-415c-ac2f-c06c87ef2d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504392, "uuid": "97b06671-acad-4e81-9179-19e28cebaddc", "value": "6ad4bdc743e1fce00eabc2d296659148e0517d39d8dab935929dacbdb8d04f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17cc4bd-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503879, "uuid": "46b96a9c-a2ef-47f4-811a-efbc6ae4b4ff", "comment": "Malware payload (Socks5Systemz)", "value": "8744d153a0cd9199c8cbca0f79d7e0d2", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503879, "uuid": "5a94c6ab-db27-4807-87be-add035763178", "comment": "Malware payload (Socks5Systemz)", "value": "6b0591dd96038977f464a2f361f56b1ddee5739540888cd8f677af51c0905066", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503879, "uuid": "e0d022b0-7cce-4ba1-9ab9-a4aaf3db57e4", "comment": "Malware payload (Socks5Systemz)", "value": "a550eb809f058f59cf1e4f01603e8d161021e58d", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503879, "uuid": "db8c0d11-c1ec-4729-b7b2-4e6e7bc478a4", "comment": "Malware payload (Socks5Systemz)", "value": "c7ccd32e2286f5052a3f8aa8cfed030d3ae783668bb71c279a6f04163adc2ec57c5ea4187eb818bfe13b67c04d946365", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503879, "uuid": "753dc99a-f453-43ae-87a4-43e94992c615", "value": "T157E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503879, "uuid": "bc7d8784-f75b-400d-8453-c95866990055", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503879, "uuid": "03683170-cef1-4e19-b2cb-cd4862cb268d", "value": "12288:v+XssgiZdvAeRwEc+akHNWxu9zO0t1WBNx04xw9kOjjI1Y4hwfS9wtjPq657Rk24:LsgwdvAkhjtWxu9zO0t1WBNx04xw9kO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503879, "uuid": "683b700a-d0e6-4b3a-b823-9e33d6f53d48", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503879, "uuid": "318223c8-7a80-40bd-9e82-ca0f8cda01d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503879, "uuid": "1be108fd-80bf-42a4-9590-6ce078db2adf", "value": "6b0591dd96038977f464a2f361f56b1ddee5739540888cd8f677af51c0905066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc1abaa-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515660, "uuid": "0e018d1a-c263-47fd-80ed-84cac1848cd1", "comment": "Malware payload (Mirai)", "value": "243ab85a8fdfdda0a0a43ec97917975c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515660, "uuid": "528bc138-a2dc-4b9a-b35c-d6abd98b9285", "comment": "Malware payload (Mirai)", "value": "6bec51e4a6b29d7b4f1391c3e2e001ade8e7e2694e5102883505c68c7af740ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515660, "uuid": "22acfa75-df1f-4b2d-b5bb-d661df63cc9a", "comment": "Malware payload (Mirai)", "value": "f1ae7ca9c51d789134d8a7d4f16f85eca34f6cf9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515660, "uuid": "65b7e301-da5a-46fd-b7e5-5a804da63a3c", "comment": "Malware payload (Mirai)", "value": "d5b004d0fba10f7af1e76bce15106767d1995c36943b4a3251422e2859fa5dd00549f52b3ae43b8c176181522f052c5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515660, "uuid": "c3fe4be7-38f5-4970-8045-ad7c686fbe74", "value": "T146E30B56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515660, "uuid": "3ae6553d-2c25-478a-a2b1-4553f314cd28", "value": "3072:5U0sClUhrphbXBMMLg6aqepGw/bG4CO3HGRpp:5UMejbXuMLHaxEAH3HGRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515660, "uuid": "7cbb81b8-cea8-4555-97ea-a87e9958c22d", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515660, "uuid": "1063b264-ddc8-4f23-a8ae-34c72c3aaf2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515660, "uuid": "c616b156-d62d-4083-9fb9-598f2c05dc0e", "value": "top1hbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbbbf3a-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506959, "uuid": "4eb67572-a2c5-4d5e-808a-d38b57c783f2", "comment": "Malware payload (Mirai)", "value": "38dbe03ba85779aaad0b60710fb720fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506959, "uuid": "990822b2-8481-4540-a8eb-9aee39e900bd", "comment": "Malware payload (Mirai)", "value": "6c497ef2654077d5bcfadb4370dba5cfde4e5ce066276a24e9aa4551e54b963d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506959, "uuid": "041ab486-ba34-4043-a8e8-8b5196c5a756", "comment": "Malware payload (Mirai)", "value": "9c3e532be3c4d6ca6d467a924bfa3db89e92fdf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506959, "uuid": "cf443f3f-c0d5-4728-b86e-d7922e9edde8", "comment": "Malware payload (Mirai)", "value": "375bf3f35caad5515133e9ad78241998f5e19a5e2dd0659a52ed7e05b31701aae1c2f36312b4cde8563ba4958cc04cab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506959, "uuid": "f3147ed3-4d13-4484-8de6-1463434e4a85", "value": "T12253084AFDC18B16C5C416BAFE1E118E3317676CE3DE7213DE246B247B8656B0A3B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506959, "uuid": "c0173d61-2b7b-4566-8485-4d3f81f02658", "value": "1536:6An79RExhAVSfbbCWCEx8PB43rM6ik12D8qO:i7AkzmTm12D8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506959, "uuid": "5fb249df-71fe-4350-b844-2b102ab8c110", "value": 62804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506959, "uuid": "c7924eb7-f868-49c9-8a65-f9c722b8026e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506959, "uuid": "c1a51452-f52e-4c59-9431-db06f48f5a45", "value": "38dbe03ba85779aaad0b60710fb720fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796ab32a-f487-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712457318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457318, "uuid": "93a3a93d-c8cf-4c79-bfc5-71a4fb54dc02", "comment": "Malware payload (Socks5Systemz)", "value": "57d5ba956b96f3a03b38971ad07ae813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457318, "uuid": "cba29110-eda6-4582-926f-b7aa19383c70", "comment": "Malware payload (Socks5Systemz)", "value": "6d57b846d065ebc93870f6a751b23f6ea1587c209187a542e0e0bb93beb3c77e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457318, "uuid": "2da4e5f0-5548-47af-8932-de8c20821336", "comment": "Malware payload (Socks5Systemz)", "value": "83e6d23b47db0cc122c78219fe8991f80b5730fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457318, "uuid": "15b9e03a-a0d2-4f43-a8a0-c47efa328c2a", "comment": "Malware payload (Socks5Systemz)", "value": "9d78c8f31b1d325ed83e98eff3e685b9815664f02c0afc355079135d220eb239700dacf5fae7e81cd44da36c8f684e4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457318, "uuid": "0db74e9b-df43-42fa-9529-0a9901bda16b", "value": "T1B916339643A688F0F040C5B55090F01EF54A3E2A6B3D1719BE6C6BBF1F26291B75932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457318, "uuid": "482024af-c0f9-4dff-9423-bbec48dbb5d9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457318, "uuid": "4c4b35db-44fc-4318-8888-bc4022b1139d", "value": "98304:CbLvgA6cnyCDZIW36hefsFBy6scCTwHTvb3E8pMLDQx6E:oYAVyGZI7heUFckb3E8p8QP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712457318, "uuid": "07499a60-d298-4336-906a-8ad876a0934c", "value": 4320316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712457318, "uuid": "e7486ba6-6807-4dd0-8b7a-8f62a5890763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457318, "uuid": "69acf86d-57d0-42d8-8f44-061d68f28ac8", "value": "57d5ba956b96f3a03b38971ad07ae813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff74e3e-f4ff-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509084, "uuid": "ee567561-10e8-4c79-bb06-a48e28c301de", "comment": "Malware payload (Mirai)", "value": "4619f886d84868e3297acbb45b670a1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509084, "uuid": "d4e4af0e-a5f9-40e7-870c-efd4654672a4", "comment": "Malware payload (Mirai)", "value": "6d7484b09e91e8afb9029584038f298f22aa6cf8ca58208a3bea190e7cf5fcae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509084, "uuid": "b0515be3-2e6b-41f9-a686-b0c21b270354", "comment": "Malware payload (Mirai)", "value": "bfa3d6da01ebed7aff758febfc2480d6e73a9572", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509084, "uuid": "f9f14724-e750-44b9-9604-f5b64b6216bd", "comment": "Malware payload (Mirai)", "value": "4483f8f756cf4ccfbf6a7b201be2328e534650fa654b024a733b6f1569916b16a93717722246089282a5814880a96089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509084, "uuid": "e35b7cc8-16ad-4268-9354-2c89c1f7c1f3", "value": "T12AE38C72CC29AF58E624D4B1B030DF795B939990818B2FBE15A7C6794083D8CF6097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509084, "uuid": "5d8d22d4-d880-4bfb-9a51-e4bf62e62936", "value": "1536:4M/oiO+OE3NhzzGs0mjnIC8KhzujPbOgwffG53FWENQYrTIAlNDBpH7:4lgNhes0snIihoOgwfOpFWEeYrEInb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509084, "uuid": "ad426244-b114-4408-bed3-0e8218118897", "value": 146212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509084, "uuid": "c40e27e6-7443-4fb2-8b87-916220dc51b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509084, "uuid": "c8760c7f-a8d3-4678-80b2-679ad2712cb2", "value": "4619f886d84868e3297acbb45b670a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143e7b18-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504393, "uuid": "813e6ea1-56bb-4d18-b9ae-08bb95afdbe4", "comment": "Malware payload (Neshta)", "value": "bcd45f92e8235cee03b13d88a7e51b69", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504393, "uuid": "04e90b1c-4475-4ebe-a6cf-367bed6efb3c", "comment": "Malware payload (Neshta)", "value": "6dd63b7d965d6515100e1dba61eb9d1d1e8c2e37adcda6326df64ddbf449ab8a", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504393, "uuid": "e3f42fe3-d01a-4634-85a9-8557099ffbce", "comment": "Malware payload (Neshta)", "value": "72b8dfd38d5107e4702154e109c858b3db8fcdb4", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504393, "uuid": "fa17eb80-f2d6-44b9-960b-32d90b386887", "comment": "Malware payload (Neshta)", "value": "7a939de19bda6c2d185cfb4c68cdbcdc9f07b82d193f8341463159a67492ce3b28cf8d7a4f73a4954497d00dfd9ac1a7", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504393, "uuid": "3a313d33-6ce3-4a1c-b809-36d1688f2b71", "value": "T106946A01B690DF31D16F093A9D25D6B8466FBD209F248BDB23943E2EBE302C19935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504393, "uuid": "c14655b0-8649-46c6-a6b6-af54869dc351", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504393, "uuid": "4c2afbcf-65df-4f4a-a82b-40bda2bc5834", "value": "6144:k9hvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMGvpBVOGqah09:LbgvuFuQdj+zRTJkX8yMxBbjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504393, "uuid": "0f460ab6-66a9-491e-8be3-3f695b3da212", "value": 409608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504393, "uuid": "aca7a750-d4c0-4c8d-ba22-b32d3b142f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504393, "uuid": "0b0318a2-5fb0-44db-ba4d-61ec5c856cb9", "value": "6dd63b7d965d6515100e1dba61eb9d1d1e8c2e37adcda6326df64ddbf449ab8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5a1c56-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506581, "uuid": "f8f02912-abe0-4161-941c-c3a0125f14e4", "comment": "Malware payload (Mirai)", "value": "0f61cb92d2270817067a4d6931fd3ebc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506581, "uuid": "db393f5a-993e-4a83-b294-346320bc25f9", "comment": "Malware payload (Mirai)", "value": "6dfb8ed25bcf442a690bf5cba2995195808e75bd37cef7d0e34ec17ca9af165b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506581, "uuid": "20a843f0-c975-473d-9235-4e0b7c65e72c", "comment": "Malware payload (Mirai)", "value": "8ffb780d64aeafbaf4d92e921a9ed4165f626298", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506581, "uuid": "cca75f60-f8dc-4378-a06c-2b0cfc28a8d1", "comment": "Malware payload (Mirai)", "value": "d2fe980137f055d649518c8319a555234c7106c55762d958bcddacf15cfab511cf2d838e889031a74765ad74062b989d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506581, "uuid": "eb2c0b71-e1ca-49e4-8d95-8413d641c8e6", "value": "T1D0234C42335C0E47C5675A74253F17E087FFE9A121F4B688290F5B9A8B34E7B018AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506581, "uuid": "70cfcbba-ec99-4e0a-889e-522c5306bfa6", "value": "768:dER2X4tR/PVElRlRYifib0jrqLS9bCA43Nr8HF2dRYErX3jHXUi2ZvBC:OTAljcObrhsdRYErnLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506581, "uuid": "6c002026-3ded-4934-a6fa-52f2b5742c9d", "value": 48272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506581, "uuid": "9c72addf-6883-4290-ba47-ca745449df23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506581, "uuid": "338bf466-5da6-4127-9637-e178b16c5311", "value": "0f61cb92d2270817067a4d6931fd3ebc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f5b7fd-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504395, "uuid": "8905ddd7-ce94-4be5-b714-360d36115d12", "comment": "Malware payload (Neshta)", "value": "ba352699f9005125f44ecd47a240216d", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504395, "uuid": "f750babd-42b5-45b2-bf26-b33278eeba9c", "comment": "Malware payload (Neshta)", "value": "6fcf640d54d863c091f4f3f0005114be507721f40c8e2b64044063e2615a7aba", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504395, "uuid": "8ccb39fb-76a7-486d-bc0e-a583e85f5a18", "comment": "Malware payload (Neshta)", "value": "dd3c8072ea99c4f0915321201bc512f68bb89bab", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504395, "uuid": "548657e4-6b20-4e03-ad93-7f247799fbb5", "comment": "Malware payload (Neshta)", "value": "a830dd6034b9a6a6acd5f2dcf3ab38ddb73602e55cd3ccb58e08b03da615b753a98e4a77203de7e0d4221b0b09d11231", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504395, "uuid": "a040ee99-b183-458b-bc60-db54a4749034", "value": "T183135C96FAE1C872D1242EFC9C1AD328D53A77303D2A16B2BAB50D4DDC6D7C1291C58A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504395, "uuid": "f1e89f7a-3609-423b-8bc9-d7367f48aca7", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504395, "uuid": "76405023-ed8e-41f0-8723-b6759a3aa871", "value": "768:KyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJL4:9xqjQ+P04wsmJCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504395, "uuid": "0f95c654-a24f-43f0-a8bf-023845bebcde", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504395, "uuid": "89e2287b-a46a-4321-905a-4336e24a4703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504395, "uuid": "55394ccd-16c3-418c-bcb6-5aa28a42752d", "value": "6fcf640d54d863c091f4f3f0005114be507721f40c8e2b64044063e2615a7aba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec619bb3-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712518070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518070, "uuid": "99fc7382-d632-447f-b2f8-0b7969cf45ed", "comment": "Malware payload", "value": "029ccd7cb15ec993e274ee9c38c7385f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518070, "uuid": "a9a4aa85-63c0-4926-84fc-7efb8dfd419e", "comment": "Malware payload", "value": "70be3abdfc6fea4dc133e2ac347e54a129356bb826a8b467de5e32d847c75232", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518070, "uuid": "ca023394-d043-4552-913f-c7e0de164460", "comment": "Malware payload", "value": "825f7ad5ec25b9a91a9752f7c8d3aa7f98e9d019", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518070, "uuid": "c721a37c-bff2-4a8f-8994-e2110c1fa4de", "comment": "Malware payload", "value": "19885a10f4f6a3307731e5cd6cd401dac3cdfd09dfc222b520b96ebec940258822899711512eb71830fb4b404587636c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518070, "uuid": "e9fb154a-6925-4c25-bd0f-ec0badaed787", "value": "T18BD3A6AF7F280397C48785B0396773F00FEA9DA11391A1C2A25ABE406F725747D277A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518070, "uuid": "6f3e00e3-edde-4d5f-a95b-4e22b40d375f", "value": "3072:A4szl1E/kWILdOvC9qRrED9Kg+bYwSi60c0IZrRgeQs:A4szle/kHOvC9q9EDTHi60c0IZrRgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518070, "uuid": "12524b24-336f-4205-a486-9c5e1a64b3cf", "value": 141079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518070, "uuid": "dfebe34b-3283-48f0-bc41-768c0083f7ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518070, "uuid": "dc1dc481-d826-4b04-b4a1-2a8a4c4ba7df", "value": "029ccd7cb15ec993e274ee9c38c7385f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34a2abb-f533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531396, "uuid": "caf669e4-7cb8-4a6a-8848-240f2c3b1856", "comment": "Malware payload", "value": "c5d5f6e956cbb832418328b6f9d9e21e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531396, "uuid": "6ed2605e-31a0-4ad4-969c-ae9fcce6f1fe", "comment": "Malware payload", "value": "710fde2e9b40c277b178ffb385b0705979db9cdde501ce5aff9e0291b5746f25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531396, "uuid": "427af9f0-cbeb-4d2d-b21a-30cf05a3205d", "comment": "Malware payload", "value": "3b10fd62485506febbc8b804e5b377c1891c90d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531396, "uuid": "761255cb-5440-4b6a-9a0a-dfdde1bc95ef", "comment": "Malware payload", "value": "c7106f5136eead6859b5aa331cacdc4e9ed9f599cf8a29598302bc32a059bfea56617a74671b5041ea0e4fdc02f3d2e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531396, "uuid": "67f9d83b-3242-4e29-bf7f-5e7658c0aaf3", "value": "T116C4382A73F1606CC09EC830D697D5732D3174E81775257FBA88AD302EA2AB4667F721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531396, "uuid": "08a9fb6c-6273-46f1-aade-b9621b69a8eb", "value": "12288:vNaZmm9Dw9ILhlP2Q+gUt04d4pd202nYx8i3K6KV+kb4x/C53:v6DnFluQz4Op8+9w+A4NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531396, "uuid": "2756c6d4-7b3d-41f4-8ba2-73d43d738297", "value": 571624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531396, "uuid": "adb7d9c5-5822-4202-9d25-b1e74d75b2d8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531396, "uuid": "46dfa7e0-90b0-48ff-8c80-cc81331c083c", "value": "systemd-resolved", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b10f08-f506-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712511935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511935, "uuid": "d1242fc9-1f66-438d-a0cd-76231862116c", "comment": "Malware payload (Stealc)", "value": "4492c0fed06f47b4e844633e7b56293c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511935, "uuid": "13c10532-6fb6-49ae-b0c4-44008ca5b081", "comment": "Malware payload (Stealc)", "value": "711255b88ff35cdd174c920672c0ebc2da771f5ba47b7afc1e10666e6bd351ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511935, "uuid": "064577a3-eaf9-4056-a496-6732a79c39e9", "comment": "Malware payload (Stealc)", "value": "c072235414b249c89d2fe05691c2c0af36e54bda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712511935, "uuid": "d1525687-67e3-44e5-855c-cc97bf268f2b", "comment": "Malware payload (Stealc)", "value": "1ea7e9df97cde0088497d67b990fd2f3fe5cb074e3464afb0533478024641ecdda44b2fd073eb02bfd74f60ef7aa2ab4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511935, "uuid": "a8da3eb2-d9fd-43a2-a32b-0fbcabc7f6ee", "value": "T1C2A4D000EEA6D033EE2657304625D6AD1A3A7C91DB70718E3794F91F1AB37E0B52132E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511935, "uuid": "ca1249f7-6815-465f-b188-1e0e4a736643", "value": "32db0a910f88bc9b49b86745793d5182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511935, "uuid": "6b8b51ef-00e4-44fa-8d70-4fdd44e084ef", "value": "12288:2iB9S1zi63i/LYjQogh7cz3EP4Fn4IWneiS6U:2irSI63iTYkogh4DlKrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712511935, "uuid": "3b63ae12-e247-4965-a583-d2029dc21384", "value": 465409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712511935, "uuid": "069ddda7-435e-4211-9dd2-3dcf27aabb43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712511935, "uuid": "5b37da4b-6abc-4b76-8468-a59636d25bb5", "value": "4492c0fed06f47b4e844633e7b56293c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56aa667-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532984, "uuid": "6a183609-ac04-4020-9c22-98845c17be54", "comment": "Malware payload", "value": "e09714271cdb0a892aad8bbf9fd5d2d5", "object_relation": "md5", "Tag": [ { "name": "borland", "colour": "#0491E6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532984, "uuid": "22f48bfe-8892-4528-b502-ba46d9b1bef8", "comment": "Malware payload", "value": "72cd4e6402419fee1620a04fcdc66c3bee48ec1caf688f19e943154ed1714089", "object_relation": "sha256", "Tag": [ { "name": "borland", "colour": "#0491E6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532984, "uuid": "4a5c9ed4-7a80-4400-9584-f4091e7a2fc6", "comment": "Malware payload", "value": "c6c7ea2a367dc1a92e3c5b9525918784e3f7ed28", "object_relation": "sha1", "Tag": [ { "name": "borland", "colour": "#0491E6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532984, "uuid": "17756fe4-867b-43ed-9e9c-d7ee3d7632de", "comment": "Malware payload", "value": "9bb1621f9c13f3de86ab965d5e3f70d792802bc3eef4456d0b1d8ed70fcd1d8772d56bf064a311715c31510238278801", "object_relation": "sha3-384", "Tag": [ { "name": "borland", "colour": "#0491E6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532984, "uuid": "35e2204c-c7df-46f6-bd36-1ddca3ea7e09", "value": "T109654B47A9F314ACC2F6C435966AB9326D317494493879BB36AC85783F22F30271DBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532984, "uuid": "1daf4730-bb39-4340-9f6c-a0fceaf421ae", "value": "24576:iSP2Rt/FuI9ZmbvzgCaBJCD2+CK6VQpuAXsbzSYC:TP2//FujH4oCKsIXsbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532984, "uuid": "1e1f2226-0ef2-4c98-b981-e1c80f04a958", "value": 1531280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532984, "uuid": "13b4389b-20eb-409d-af6e-491279347350", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532984, "uuid": "bdf6e432-6d3e-4cf8-957a-4aa07193fe9f", "value": "ld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6b61eb-f52e-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712528996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528996, "uuid": "4b5e43e1-bbc2-4898-90fe-d310b09238af", "comment": "Malware payload (Stealc)", "value": "55c11e10adbfc2c18a1d7211e31edc4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528996, "uuid": "0c6f50da-34b1-4077-9183-984bc0085ea8", "comment": "Malware payload (Stealc)", "value": "7346830995d79cf8e952b5d03120959cbf80f4227a3eed9f100a4dca88697754", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528996, "uuid": "8294dd49-9123-486d-9f1a-4e2d1569281d", "comment": "Malware payload (Stealc)", "value": "80f1e6d691f3ec96a3f506b276dc12c9ec9bb7a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528996, "uuid": "46670cdc-c24b-4c51-96dc-fa28e7e61293", "comment": "Malware payload (Stealc)", "value": "e08b90e1fcaf9a3587af61d59ff601b729e72568989e6403b4a0bdcde84cf1c735df21285fcdd74348c71ed7ea23ccdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528996, "uuid": "2488acc5-da8c-4be9-8f1b-b15345bf9466", "value": "T1DAA4E010FAA3D027ED6A23304E65D7AC5A3A7D912F70B19F36907A2F19732D07916372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528996, "uuid": "7fd65fb1-3299-4da3-8c95-fbb4e7dd5d86", "value": "32db0a910f88bc9b49b86745793d5182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528996, "uuid": "353579bc-4e63-4c55-af4e-3db52d003929", "value": "6144:+pin8J11lQFGDhTjpjpg50uNZRvqj4PYz9c5SfZmdZX+I0f2F5hpZUI66/Qk:Ii8J11lQFG1Hp+PHqj4Qmi2xXY8hP94k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712528996, "uuid": "940f6567-d7a9-4ae0-903f-f5169fc50926", "value": 464897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712528996, "uuid": "13cf6c46-de44-4944-b952-5992decb7975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528996, "uuid": "c83e6bcc-ba90-4537-8724-f417e220ff80", "value": "55c11e10adbfc2c18a1d7211e31edc4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0daf6a-f535-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532247, "uuid": "6f187637-e834-4cfc-8d6d-f2feeaf6315c", "comment": "Malware payload", "value": "d17cd45b5a285e56a21b94f9312e32c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532247, "uuid": "627a67d6-88d2-404d-8f74-86fe399474b9", "comment": "Malware payload", "value": "7366e2e29596fa8e0b6e116dbee0dfd72ec08a821055d2281657c70e228435f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532247, "uuid": "e3d60412-00ff-46b6-9560-2848fbf96581", "comment": "Malware payload", "value": "0b4bd59fb5cc50ead5c15bf75bdb29dd19e2a391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532247, "uuid": "0ddf4f0d-f2d1-47b2-b96a-1ad322223d5e", "comment": "Malware payload", "value": "e98e06d2c7c2ce6b7191ee479bd33ecf66795a5d612599692a02705db386ebbb653210e0823ebde5f099ac318f9cfd2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532247, "uuid": "c538c74c-6784-4de4-8453-d5334fdcebc0", "value": "T168568E0671E308ACC575D830563BB573AA7A74950128297B27949D303F6BE702FDBBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532247, "uuid": "f27a0495-6a0d-4b1e-9274-0e40ba5a8a20", "value": "98304:IXoyLDIvpfoiVHpVYdSQKrXnH+bhso/RQoqr7kU2yMr9:U2vh0s6RNr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532247, "uuid": "cbcc20c5-c01e-46d1-81e0-f1ae44345888", "value": 5930664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532247, "uuid": "e9758cf2-dbb1-48cf-8c89-1a5c25ffbcf0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532247, "uuid": "accfbe3d-b027-44f3-8c82-2fb3ad64413b", "value": "libfontforge.so.4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fa987e-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712475026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475026, "uuid": "51ead964-e4bc-4216-819d-43277944f6de", "comment": "Malware payload (Formbook)", "value": "f267a71692c3683e3d6d0461e003f54f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475026, "uuid": "e4f8e103-7771-4fc5-9aec-7c4a48291582", "comment": "Malware payload (Formbook)", "value": "74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475026, "uuid": "cb106510-2363-4749-978e-c87286628e39", "comment": "Malware payload (Formbook)", "value": "189450a513d1f2412470eb965468f1324633d252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475026, "uuid": "f6a6add4-80c1-4eaa-a308-028dfecd7bca", "comment": "Malware payload (Formbook)", "value": "df9af507f88bc7a64ffe5381459f59749de5429a55412ba2dcb4134a4e61c17b9cc8c07a83e78c37b453e60a1e4dda11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475026, "uuid": "5fcdb337-3941-468c-a2c3-3168bf0ef21e", "value": "T1B8B5230E5BBE8136C7E8C3347940A547BBB2C76E98419B662C94CE358D273C2B54E4DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475026, "uuid": "8c49519d-45b8-4f75-bbd8-942a84286e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475026, "uuid": "3d49f3fa-c543-4e9a-82e8-107564aa85e8", "value": "49152:qjOIzFMNQnXmsIi7MS4bdotKHDG/GGcYsKYX78Y5Ye3:qjvzFMNQnWspj4bdot45GdsKYXl5Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475026, "uuid": "85739528-beea-4957-8408-b44a6b4da8fe", "value": 2463288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475026, "uuid": "3ca2b1ab-59bf-4309-8dde-61206a52f880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475026, "uuid": "13ae8648-92bb-4cc5-81f3-2841200d3a7f", "value": "f267a71692c3683e3d6d0461e003f54f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e606401b-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503886, "uuid": "4d2e76a7-3e8f-4c0f-8275-c4aaf1fcf47a", "comment": "Malware payload (Socks5Systemz)", "value": "d62808774e2fe2adce121c62e9b729d1", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503886, "uuid": "f4cca188-0317-47bd-9128-1d2b16deb1ac", "comment": "Malware payload (Socks5Systemz)", "value": "75846140ea1b5ea75f4fdac1b5399b403f467161bb3911606d8b30a4f5de884f", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503886, "uuid": "fbea13d1-9c8c-43de-8ddb-d98a7777886b", "comment": "Malware payload (Socks5Systemz)", "value": "5d144df4795ac7c6a5ec46cfdb7ddb699542a283", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503886, "uuid": "1f5e7f28-af47-46bc-a369-0c798e68dc23", "comment": "Malware payload (Socks5Systemz)", "value": "128a7d4836aec62cf9ff901b1428e950acbab256fb0a90a73554dc554cabecdb81d94b8a3b59bdc8822dd0f53f3d22c2", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503886, "uuid": "8bd8e81e-d37d-4e87-bf32-33e523e72763", "value": "T152E49EB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503886, "uuid": "6cb0120e-6ca9-44a7-bc25-3858e8bb19d2", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503886, "uuid": "30657e91-6db9-4920-bef0-11e9ede003cf", "value": "12288:O+XssgiZdvAeRw9+aNHtO5u9zO0tdWpNx04xA9kOjjI1Y4hwfS9w1jX6657Rk2k5:KsgwdvAE6NO5u9zO0tdWpNx04xA9kOj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503886, "uuid": "48c390ca-39ce-453f-8e1f-3df0c21887db", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503886, "uuid": "594b9ad9-01a0-48db-b0fd-7bcef83013b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503886, "uuid": "92747728-7572-44cc-93f2-0cb3c1783b12", "value": "75846140ea1b5ea75f4fdac1b5399b403f467161bb3911606d8b30a4f5de884f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c8321e-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503889, "uuid": "310dea94-1fb6-46ed-aab7-967b668753bf", "comment": "Malware payload (Socks5Systemz)", "value": "ac75f7852fa5ddba5a99156cd4622117", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503889, "uuid": "725cf354-0db4-43a8-ae13-d47923bc3d84", "comment": "Malware payload (Socks5Systemz)", "value": "764b9db5fac2f5403d0e3740422cd7b039daf33d08388403f1fc441d8b6e1bf2", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503889, "uuid": "bb744420-c910-4d24-b7a8-d467119e69cd", "comment": "Malware payload (Socks5Systemz)", "value": "8c87969fa62699c7b6e630db65365c2042645402", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503889, "uuid": "01c6947d-a973-4455-b360-1d97540707f9", "comment": "Malware payload (Socks5Systemz)", "value": "b30c084f067200cff5658d1d878e392f194f079f05b4f48bd3c8f098c111e7ee623be4646483aed4c02477818e1480c5", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503889, "uuid": "13d24f57-8940-4791-9d26-fce9be7abb54", "value": "T1D8E49DB13A0AD1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CC6A34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503889, "uuid": "a39b56dd-3af1-451a-8452-c8235cdf3656", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503889, "uuid": "80af1fa2-39c0-499e-9484-05f5100d71fd", "value": "12288:O+XssgiZdvAeRwZ+a2HB0Lu9zO0tjWbNx04xU9UOjjI1Y4hwfS9w7jJi657Rk2kV:KsgwdvAwlh0Lu9zO0tjWbNx04xU9UOjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503889, "uuid": "9101f0ac-0330-478c-a902-5e291e7b12f5", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503889, "uuid": "30154fcc-9d1a-48ae-9044-03f29a5aae9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503889, "uuid": "e08ff984-0eaf-4697-b343-be2ed5d33e89", "value": "764b9db5fac2f5403d0e3740422cd7b039daf33d08388403f1fc441d8b6e1bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0537a6bf-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712506945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506945, "uuid": "6e71dc00-30e7-48ff-9f21-c6828253c98f", "comment": "Malware payload", "value": "65161200d3d4187fd7f07d91e505448f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506945, "uuid": "a9e35eb5-d80d-4a27-903b-5f185073e3f2", "comment": "Malware payload", "value": "767642107e5264301d3aa9d791c1705139350c449fed1a815149f1b65fce19ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506945, "uuid": "48f62e2e-5981-4f6e-a5a8-6558b0f4f533", "comment": "Malware payload", "value": "06f0f000a366c80ec689dac92349cd08b6178100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506945, "uuid": "f3dff308-9a1a-41a4-a716-273d6eab3c59", "comment": "Malware payload", "value": "a54f76e67208539b3cdc9372e4d5636b6aa95d55f3b4feab4428ea6160547dc0c576af4ed4a72c6e88c38e08bbc5fa01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506945, "uuid": "1d616ab9-bd56-4246-887d-ab858a51af23", "value": "T12763970E6E258FBDF7AD8B3447B74E21A75823D727E1C681E15CE9001E6034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506945, "uuid": "92bf0c3d-1f04-4769-81ba-1be3f9b16df4", "value": "1536:qYIIzuJPTi6zirWHqgfx/I9PmSR54ceJMX:q6uJParWKUg9d4Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506945, "uuid": "f0af105c-f5ad-469a-9a0a-9fbcd2aaa265", "value": 71872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506945, "uuid": "7b36df7b-08f9-41c1-b1ff-6799ec171a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506945, "uuid": "47eef4ca-74eb-4f83-bbd2-f216024dd01e", "value": "65161200d3d4187fd7f07d91e505448f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dba529-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503891, "uuid": "8bd5e54b-3a3b-4ac9-a615-93633aeee7a8", "comment": "Malware payload (Socks5Systemz)", "value": "250985390212e63951d51ff2eee92895", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503891, "uuid": "499df09a-7c28-44d9-9f5d-d8d483bc55fd", "comment": "Malware payload (Socks5Systemz)", "value": "770b7a8d281489fc502c0c28333d5cd2a99f5086777cf2a00b8e890091e0eef1", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503891, "uuid": "020ca785-072a-42d9-b7a1-533dacdf1559", "comment": "Malware payload (Socks5Systemz)", "value": "24f566f46d85ea11d94b3f873fc4fe2225cb635a", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503891, "uuid": "3c22979f-8ef2-47e9-8c75-f759360b4eff", "comment": "Malware payload (Socks5Systemz)", "value": "d288ec2593696d5000aaec250add47a1c45264b4644057b64d4485dfb7a51707ece225c8e55b55a5e2eccd235208f89a", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503891, "uuid": "90c5ce88-8a9f-4602-a2b2-0c92c6ed369c", "value": "T188E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503891, "uuid": "20c1f435-1009-4f75-b559-bca915310df3", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503891, "uuid": "9613267e-db87-4cd8-974a-b422436ea1ea", "value": "12288:O+XssgiZdvAeRwp+aXHR43u9zO0tPW/Nx04xc90OjjI1Y4hwfS9wPjFy657Rk2kt:KsgwdvAgEx43u9zO0tPW/Nx04xc90Oj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503891, "uuid": "47b6e087-830f-4481-b3b9-216e27f339e6", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503891, "uuid": "8a19d746-0c84-4fea-aafe-8956f360830c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503891, "uuid": "683da3f2-a251-4f9a-9dc2-1c8ea6647aa6", "value": "770b7a8d281489fc502c0c28333d5cd2a99f5086777cf2a00b8e890091e0eef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08792e02-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712517688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517688, "uuid": "df4321f5-4720-4de0-8040-1cfd5d87010e", "comment": "Malware payload (Mirai)", "value": "3dd0d57af9d17b33746ea1d69608d6de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517688, "uuid": "0d96d7aa-1982-43d2-899c-4116bd786143", "comment": "Malware payload (Mirai)", "value": "77e54c8e7f0b4a5e33af89c0ac88a99ab8ae3c9d5d5483dcffe0bbae9bf91650", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517688, "uuid": "76e34f4f-1203-4528-b80b-07d2ed66100f", "comment": "Malware payload (Mirai)", "value": "bb62123ff8bab56efca400c1b459720fbe7afe90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517688, "uuid": "780a6afc-3327-44ea-9d14-d733de742c96", "comment": "Malware payload (Mirai)", "value": "2c648b0e0c36edaa835dece2f121bd7f75353328c9b017b08497a6301368dbf94abf1cef0d938a80923f6a141f16a9eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517688, "uuid": "bec88daf-c1d8-443b-9265-67f947cb325f", "value": "T1DAE329DBF800DDFAF80AE33748530806B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517688, "uuid": "612d4c50-7410-4c08-be69-dfdc3821f0fb", "value": "3072:jRsZD8hrvKbbWOftDA4EslibVrjbiJLnN+eAyaihla:tsBnfhAUliwLnNMyaola", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517688, "uuid": "5e312ba1-7b81-4b1e-b5b4-57320137be3b", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517688, "uuid": "c1b7adf6-b52d-4fe9-b0ba-6bcc074eb962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517688, "uuid": "259ad9ff-a148-4a4a-a9ed-14a4c7c7f1dc", "value": "3dd0d57af9d17b33746ea1d69608d6de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67773277-f49d-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712466737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712466737, "uuid": "19c42695-a16e-46e1-b6ed-22fbea9796a6", "comment": "Malware payload (RiseProStealer)", "value": "6ad7b2671bb301af7253a3721412c299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712466737, "uuid": "355ec863-bb09-4051-940b-53f82ec4add0", "comment": "Malware payload (RiseProStealer)", "value": "77efc862d1be4cab256689fd19a1ad0e7491d29e712e02c679620534f5e78592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712466737, "uuid": "9338914b-f2a6-42f5-9d7f-955856039100", "comment": "Malware payload (RiseProStealer)", "value": "1ace382fdbe6611c02ae8258d8f8736b923186b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712466737, "uuid": "a731fdc9-a42d-48f8-993b-30a0a30127c8", "comment": "Malware payload (RiseProStealer)", "value": "c9b3561a46d27fc607cc67ccfad5cf5237be3b5a8e75de6f178562b36e9abf397c74a4dce8371ed1ef6fd00d9dd44933", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712466737, "uuid": "fecb8faf-95da-47d0-92aa-56a6ec61d313", "value": "T1F766330B95DE6CD8E48161740F69F67D39F66A3282A4CE2DE0CC65C2BCF21F5B036526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712466737, "uuid": "84895d73-880b-46c5-be0b-b26333ef2ccc", "value": "c959ab5e76f65820c55fd6008599fdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712466737, "uuid": "9dc15889-5d3b-4c87-be34-47852f325037", "value": "98304:KRpXEqaxvaBSHWnTYK0HQdqqw13Csutt+nWhNq/YFKBUCSxVNw:W5xaR7HWTYK0HEqN1djcNqkYUCSHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712466737, "uuid": "3bd45794-3f9d-4be5-9314-193da54d4de2", "value": 6598656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712466737, "uuid": "7823226e-3de0-4ae0-955b-8d66b83eff39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712466737, "uuid": "bfd07415-7882-4376-bc24-7c8816d31f64", "value": "6ad7b2671bb301af7253a3721412c299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dbb731-f535-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531849, "uuid": "e3c1dfec-6b4d-40ed-8ebc-b25a54a8d5df", "comment": "Malware payload", "value": "89a217e65394f22b53fa71f0edc88213", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531849, "uuid": "764afcf2-9e23-4f62-90ac-d946dec0ce54", "comment": "Malware payload", "value": "786fc315e198d09ce851446e35f08e4b84dd48ed6609855aacb6aaee1ba434b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531849, "uuid": "0bed6806-91ab-4f35-b37c-42f8f7c1369f", "comment": "Malware payload", "value": "40cf8137398f9772a7c05b73c6f2388efadbe03d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531849, "uuid": "752457b8-5180-4123-a3e6-cf6b0200161f", "comment": "Malware payload", "value": "46816b012961daec35608ccecb96a87d34193638bbf1e81526c3955cb22bf3fe56c8032cf4a6aad6c6047468698e3197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "warp", "colour": "#FBF5C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531849, "uuid": "2ae7cc97-e83b-4907-a530-761c6f7d1d5c", "value": "T1A6575B17B6E110A9C08DC474039BE566BB357CE842357B6F1688AF302E6BF74572DB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531849, "uuid": "f856fce4-ae66-4bda-b224-040bf0d7aeb7", "value": "786432:8DLS60fthZZZZZZZhvO7ZZZZZZyZZZZZZAZZZZZZedh6bbbbb2wQ10i:8DLMhZZZZZZZhvO7ZZZZZZyZZZZZZAZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531849, "uuid": "3d320896-41e8-4ed1-aad0-1e7335680c5f", "value": 28400512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531849, "uuid": "162d674b-f937-406e-9638-093e37a43864", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531849, "uuid": "457b49be-51cb-42b5-b757-7bf7ca8cc7d6", "value": "retdec-decompiler", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b66278-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506572, "uuid": "b2d7198b-c4bb-4415-a801-4cc02878ac76", "comment": "Malware payload (Mirai)", "value": "dce8879f7be6ef3d0e18a015f0368912", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506572, "uuid": "f06b6962-7000-4c3c-bc2e-44dbe87bc4bc", "comment": "Malware payload (Mirai)", "value": "79042b5b6503835908ad3286a850632e0ed2babf08a4971006ccc5f5354e6273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506572, "uuid": "f62e46d5-8ed4-4408-a499-fb97c6c63f7e", "comment": "Malware payload (Mirai)", "value": "8ab3d8504e680042e8a037d8efe7817e432f763c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506572, "uuid": "af4437cc-5a94-4903-adf9-c5a2a153080a", "comment": "Malware payload (Mirai)", "value": "f7dfccc505eae46cd724a95f236282e626fde953a7efc8f3ba472ca863b97dd1750780b5c0fecc736e16430aaab88d0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506572, "uuid": "d8b29227-43b9-4958-b907-64ac901163fe", "value": "T169331996F8019C7CF91BE7BE44228A0DF571724151830B2AAB67FDD3AC731A91D36E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506572, "uuid": "febe91db-1de7-46ec-85d2-b87a28fa2096", "value": "768:DsEeTldaJtQQVP3SorRF5ue8VN+RWmiYnhtQXOvw0X2w61XNp:DP4vtcPCoVF4e8jNm7nkXOLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506572, "uuid": "4580c912-9992-46be-abb9-b405be4a11ee", "value": 50680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506572, "uuid": "8a8a5d64-35ed-4a6d-aa09-550f3dd4af22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506572, "uuid": "c7b98649-75e9-4887-8d1a-d1e39242dbd1", "value": "dce8879f7be6ef3d0e18a015f0368912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e5bd26-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503893, "uuid": "d917efec-5c19-4b16-a604-008043c5044e", "comment": "Malware payload (Socks5Systemz)", "value": "8b8912380c4efcaea37f2bb0797e5fe8", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503893, "uuid": "f4d09dd3-8b99-4aff-8090-c913908e6261", "comment": "Malware payload (Socks5Systemz)", "value": "7a04eeb11211e0e109fd2255ea4ab5daef149575eaf5126e4a4fdf664c3aab18", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503893, "uuid": "89fb8ce4-7f6d-480f-83db-d2d6f8da7470", "comment": "Malware payload (Socks5Systemz)", "value": "2eefe4a9c36dc45e246397c7dd250dd6c606c7a9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503893, "uuid": "bbdfbc5d-404e-45f7-bffa-30ff42ba4ea5", "comment": "Malware payload (Socks5Systemz)", "value": "e405ce16edf998988e1e70a72c9c14fa800e3350168216445ac3f3d8b37589a383c8c4ac8d877ba504071b3fe09db918", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503893, "uuid": "88f58d6e-732a-46d7-bc5e-bdb2d3730b40", "value": "T1C2E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503893, "uuid": "b4af32b5-adc4-4afb-8eba-0b25bb3331a9", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503893, "uuid": "fe544522-53b0-4278-bf4a-745c91eb92b1", "value": "12288:sjsgiZdvAeRwAe+a2HL50cCdABquEcvpWwvmmDRKLiTOkwRpnHhoksiIjcBDQg5F:6sgwdvAgDFr50cCdABqulvpfvmmDR+ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503893, "uuid": "59188186-9472-422d-b5bd-0cda2859042d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503893, "uuid": "aa61d2c8-9d2c-48fa-b81f-4e96d33d659c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503893, "uuid": "97f77b83-2372-470d-9fb7-0eb680d32259", "value": "7a04eeb11211e0e109fd2255ea4ab5daef149575eaf5126e4a4fdf664c3aab18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167632e2-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504397, "uuid": "e6df7cff-28e8-4df9-9905-ed419b92f7ff", "comment": "Malware payload (Neshta)", "value": "29ae46d9fdbbb6d4a00a424cff777a02", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504397, "uuid": "76aec279-cc86-4eb1-89e6-6964b8f8f0a0", "comment": "Malware payload (Neshta)", "value": "7beeef39803a23f08fc997c4405899a99b6d4a5004c20fe0ac06263be0529106", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504397, "uuid": "5ac5b7bf-f97c-4af7-9fbd-d591b41e1f39", "comment": "Malware payload (Neshta)", "value": "ec7d9e837d0e69c33e1cde467fac557200077f2a", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504397, "uuid": "d4acfeb6-f2ad-423a-9104-7e01fcb3c53e", "comment": "Malware payload (Neshta)", "value": "5e9c1184bb531a1dc216ce517f8560c8d9bf99616b158f641e9cf4e455abf68fd7650c95f388d80cb6bf50c2a9cc2b5e", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504397, "uuid": "1f45204e-903d-4ce8-bd5c-ea6b7c643050", "value": "T12B757C22BC408131FAE612B7C6FD7A2445ADEE20072952D793DC3E5A1FB06D36B35297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504397, "uuid": "5fcd09fb-f060-48f1-9497-84d5cee86d80", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504397, "uuid": "81402654-e9c4-4d27-8d51-5f9ff3bfa0d6", "value": "49152:L1fiSvhsfZfyl+m6GlRh6fuFN62ugX88RPG62:L1cxghNFN62uWRPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504397, "uuid": "bb3f706c-28c4-45d1-b752-e701094fea6b", "value": 1603248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504397, "uuid": "7641819b-0a33-48b1-b70e-86963dd18940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504397, "uuid": "7db129fe-866d-4049-bdde-dd48af1fac5a", "value": "7beeef39803a23f08fc997c4405899a99b6d4a5004c20fe0ac06263be0529106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174a4dc3-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504398, "uuid": "7e82e21a-7cfa-47ca-a136-1c00868d28a6", "comment": "Malware payload (Neshta)", "value": "aab3059ae613a7e5458746644ce931b8", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504398, "uuid": "fff81091-fefd-4b05-ad38-11e2d6724336", "comment": "Malware payload (Neshta)", "value": "7c1b051466f2289698357c9a4dc2b01717d3630ec8e0326c603e9b168d1e00df", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504398, "uuid": "8dfa5c18-4864-49cf-9b70-2dbf37feee92", "comment": "Malware payload (Neshta)", "value": "c291b14240b6f35822912b9e9ba4fbb65a6af41c", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504398, "uuid": "dccf3b40-eadb-4686-b3a1-58588c193245", "comment": "Malware payload (Neshta)", "value": "3352b4e132483fa4dbb575b61a582c8a0910e0780dfa993d64ea3f3aa4e6bbfddac74037675973620e46b23f6419ca25", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504398, "uuid": "27cc25d3-077e-4921-9da8-59178524486f", "value": "T1B844700ABA99CCA0C2001733BB77D1B994546820DABCC7875E9BFF4D942D9F0DD0E9A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504398, "uuid": "fe2a0c00-a7de-4313-a55d-d0bbe3023be4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504398, "uuid": "06a657f6-ec55-4ffa-933f-83ec83344ab4", "value": "6144:k9a1nNwnwywk81FOeWgXiJeEmP6YsgKOEZbbhu:RvVRvi9crmbhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504398, "uuid": "2c45d8a3-eb79-4c27-ab84-aa9a863e0e6f", "value": 264072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504398, "uuid": "daa658c4-d73a-4cca-a9a8-9fbc224775fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504398, "uuid": "1cb045c1-d24f-4d0f-93d4-c6cbe4e1c5cf", "value": "7c1b051466f2289698357c9a4dc2b01717d3630ec8e0326c603e9b168d1e00df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7605725d-f495-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712463326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463326, "uuid": "994add62-bc5d-4609-858e-e9873ee99285", "comment": "Malware payload (RiseProStealer)", "value": "d31b57fc3b846519584933936867501f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463326, "uuid": "60dab32d-b283-4a3c-bba7-ca68c9455b2c", "comment": "Malware payload (RiseProStealer)", "value": "7d46e613a371056559819d8358608147edc0ebb8c82b3343e9979e3692657de8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463326, "uuid": "064fc938-8448-4440-ab64-5a699b195200", "comment": "Malware payload (RiseProStealer)", "value": "1e097a2f7eefe70177236f5653594593a460bf9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463326, "uuid": "54652d8f-f090-44b7-9586-9d8bcc6652f6", "comment": "Malware payload (RiseProStealer)", "value": "391387196917a3dfc2ac2f618846ad1815891489032a1bc1a6a6fb468c02427d0262e54ef9dd5aaa69fbdaeeb742bb23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463326, "uuid": "195f090e-4e1e-49b8-a0f6-44c68d755dc6", "value": "T11DE533B2A694AFFBD61183B64CD312635D4CF6111A750A2C222F8D7BFF5608CA7E1970", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463326, "uuid": "c394006c-4e0d-4f4c-9bce-9ba1940dcb5e", "value": "63814aaf116ba6abb6496ce4bcad24c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463326, "uuid": "01effecd-b4c8-4650-96c9-4f3f03c5f0ef", "value": "49152:GQHVUY8LOrlUVBoiQO9ZPMJMbZAv/WwGW0s8Yrj33CNOJpvk0MJLuYFGHPh0C3wk:GQHV8arlUMiQO8JMbZ7m5CA5fMJ6p1RZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712463326, "uuid": "9bc83f41-b610-4385-8f9e-b0e639dcc1d3", "value": 3137552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712463326, "uuid": "5d9b2824-9154-400d-94bb-a20958babf4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463326, "uuid": "c9024432-8fb8-42a0-8e5b-5d717eaa76f5", "value": "d31b57fc3b846519584933936867501f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcd0b76-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503896, "uuid": "1de15745-938c-4979-a1b5-1f7a9eba7640", "comment": "Malware payload (Socks5Systemz)", "value": "953ff4bbf200b84d0a57d37221125c03", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503896, "uuid": "a3e547c4-861e-45da-9a93-fd7140cec5e7", "comment": "Malware payload (Socks5Systemz)", "value": "7d8b3763dc80113cd5562613cb138391b1b9743ef74595023ab658bc6b9e8741", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503896, "uuid": "ceec00b9-2d45-4d6e-86b9-b1d04c08a484", "comment": "Malware payload (Socks5Systemz)", "value": "52608f521a101cc87877b04ffbbcdcb951a47a12", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503896, "uuid": "5f0656a5-cf8e-4392-90a2-3e0d72046fa8", "comment": "Malware payload (Socks5Systemz)", "value": "dc781fbcb1487ede71a5f0886de4e69b6d16bfb717a4eb339e3d040f50c52938471b1efe79a42f2090e955e97d0456da", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503896, "uuid": "0ab57cff-cef0-4bf8-853f-1334b1bf3aba", "value": "T1B2E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503896, "uuid": "63a22617-e55f-4243-a27b-2f69a662ea89", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503896, "uuid": "0067ef8f-ed07-40f4-8ff6-d6fe7d486fe7", "value": "12288:v+XssgiZdvAeRwC+atHrRqu9zO0t0WWNx04xi9kOjjI1Y4hwfS9wWjSC657Rk2kt:LsgwdvA3iLRqu9zO0t0WWNx04xi9kOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503896, "uuid": "21a756f2-09bb-4501-be5e-a5a32c8bf7e1", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503896, "uuid": "5ef5b476-28ab-4240-955a-724db4931913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503896, "uuid": "10e99b98-0a15-44dd-9d34-d592a3622da9", "value": "7d8b3763dc80113cd5562613cb138391b1b9743ef74595023ab658bc6b9e8741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6223698-f4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMoon)", "timestamp": 1712505175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505175, "uuid": "6158bbf1-9c51-4e26-9042-68ab43c9a5d7", "comment": "Malware payload (BlackMoon)", "value": "1e7d7c65e1b4fad024e5e1c556394a3a", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505175, "uuid": "27f72492-23f7-4a6f-99ed-6f01a7c7a2cb", "comment": "Malware payload (BlackMoon)", "value": "7e18f8cab640c22b33603710eaf981d366c70a5df68ccddb7f40560cf051f493", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505175, "uuid": "21fa26fd-a19c-4219-b3a6-b0c1c7525e5e", "comment": "Malware payload (BlackMoon)", "value": "5e738b8154c963a0b02ef31bc02b6c151b514524", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505175, "uuid": "5220fa3e-9fb4-4b9f-8232-a608fa15b49d", "comment": "Malware payload (BlackMoon)", "value": "abe154d33df9d3e6242085cf3acbf1dd09468769720c8a393779c10a9ba69a1337da660cbded6e0152c13b004cadd9a1", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505175, "uuid": "7279e44a-0a17-40b2-ab17-ed7b687d96b5", "value": "T12BA4960376219491E1595BFBA2AB433879F8976438F1CD23AFE4DD71ACB1121871EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505175, "uuid": "14d089f5-c575-4bb7-9444-07d1dcf33d83", "value": "389bbcc40b5789b0e933ff4aa418caa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505175, "uuid": "2ff88306-0ae9-4bbd-a433-1a6bed53d414", "value": "6144:3vbuWQu/cuaS2l8iE0B55FrJJJekPdJ0/21AgeXRM:3vqWQub2lrE0B55FpekPdS/2SnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712505175, "uuid": "35802517-53ed-402c-87d2-ed04c7f25b0b", "value": 483010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712505175, "uuid": "1846a904-ecc5-4597-b5c7-540337df6127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505175, "uuid": "c978e548-83f9-4f4a-bab4-23e51af1bd46", "value": "7e18f8cab640c22b33603710eaf981d366c70a5df68ccddb7f40560cf051f493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd6e61a-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503898, "uuid": "1992d528-fe5b-43d9-918a-a676d2ab3d95", "comment": "Malware payload (Socks5Systemz)", "value": "df472750835dc06703ec7fc190be4fef", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503898, "uuid": "2cf92c2d-d4e8-472e-b4ad-506a2b4934c1", "comment": "Malware payload (Socks5Systemz)", "value": "7e2b9cad1fb2ef5aa9c478abe04e8663a95af078f6e7751a2dc142c4462c7b5b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503898, "uuid": "64e1d6b6-8cad-47f7-aae5-ea216c6e1ecf", "comment": "Malware payload (Socks5Systemz)", "value": "8736a7af10f7df1a539d7fe248e53da4d472676a", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503898, "uuid": "1e6c3995-3ba2-4852-a85d-74a636918998", "comment": "Malware payload (Socks5Systemz)", "value": "7b6c0edc653f715d9a5599ef27592a846d954f98f36f2e1ab9b9d08288a3f141df824fd1c30b4c5bf232976bc93e9529", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503898, "uuid": "d6b9a424-d932-47ab-a378-3882648c1ae0", "value": "T121E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503898, "uuid": "988bc654-25c9-487a-a2c5-38dade25448e", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503898, "uuid": "eb876e51-d55b-4a3d-89d3-b03015c698b1", "value": "12288:O+XssgiZdvAeRwwk+aNHNwju9zO0tHWbNx04xI9gOjjI1Y4hwfS9wHjpK657Rk2Y:KsgwdvAuOtwju9zO0tHWbNx04xI9gOjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503898, "uuid": "0b0f188e-742b-4ff2-8463-82cbb7cff90b", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503898, "uuid": "f61a0b8b-6a9a-4391-9fd0-f98c51bab92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503898, "uuid": "f2e9e351-c342-4dab-8d0e-5c9c198654c0", "value": "7e2b9cad1fb2ef5aa9c478abe04e8663a95af078f6e7751a2dc142c4462c7b5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152becd4-f4eb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712500100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500100, "uuid": "559bd355-a9d3-4ed1-8bae-fcb3579fe554", "comment": "Malware payload", "value": "8c68a4a14bf7b18597377a7318813a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500100, "uuid": "528885a9-af45-46bf-82ce-2a0c5be1d8b7", "comment": "Malware payload", "value": "7fe21d2e184759989b487be1c0583d586f398d1060228a4384e2aa5a224ba0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500100, "uuid": "2bfcdbf1-ee2c-46f1-bb9a-568eb05d0804", "comment": "Malware payload", "value": "74a47ddfaf89718076eee1c4a3c362a6bb799e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712500100, "uuid": "45612be7-aca9-462f-bf1a-5d2e6088d91b", "comment": "Malware payload", "value": "d844909e1081a58181de47b7a66f38efadab7417c22c7e39fc078765dd523df9ecc9abe4f7fe908cb6d2464428c01f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500100, "uuid": "b0821789-c662-45e1-98b1-e9efa0b07287", "value": "T10E86339B07D27BCADC6852F0DD51E4BC6B058B07AAF1881DA48F5BD4EE2ED6013C9748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500100, "uuid": "3ec8fce5-74a7-4d84-b9ec-dbaf08cb1837", "value": "19fd2525ba9bcad8395c4640b483b733", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500100, "uuid": "e070400e-aa60-4419-9a29-4a0856926982", "value": "196608:mLKcsvdVNkdtxGhUKUw5Azp8QdUTvHFqvPs6yoNlgLdt450zK09K:mONjyxxKUWAzWIU7HF20v93454Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712500100, "uuid": "596a4a86-5238-47b4-a563-adb4304a30bf", "value": 8572944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712500100, "uuid": "545da0a9-93e6-4785-8a0b-3b0ff81ac749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712500100, "uuid": "c5e450ec-82c1-4737-9571-932a0ba6040f", "value": "SecuriteInfo.com.Trojan.GenericKD.72211083.13107.20477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a0b48e-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506162, "uuid": "4bbcd4ef-8f48-4a0c-9ed4-4e6709ede259", "comment": "Malware payload (Mirai)", "value": "613e5388d0ecb8ba81e4423409cd366e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506162, "uuid": "5bfe5089-2c19-4337-a5eb-5375246da352", "comment": "Malware payload (Mirai)", "value": "7ffdc8efec23485e5eb6df022f686e2d50c206dbcf5f4ef4ed5e0a0473779851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506162, "uuid": "ca8fe400-9375-442e-8739-7242917d303e", "comment": "Malware payload (Mirai)", "value": "19d748f00d7fcc6f65e6d6781431eeabc4c53531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506162, "uuid": "9f7bb319-b098-4ad4-9a6f-cd8e60b5b6be", "comment": "Malware payload (Mirai)", "value": "0c76c5aeab7b057ded0a9d60552ae332cb067414f07708ecc54b74fff6ad9493bfbedd3031c0aa5b4353364fdfbe1f71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506162, "uuid": "5cdc4886-67b4-48ba-b22f-f43003c8c043", "value": "T155234BC4A593DCF9EC1505712133EF329FB2F13B2268E997C79DD9339C42A42A50629E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506162, "uuid": "c5dcb189-32f1-45d9-bb0b-b16fd6774db8", "value": "768:K1PTuIt2eeil3VOaFrK/u/BxrrcWLgG0+t2hObeMMc2i2ZvB:K1PTuIMeeillOaFrKW5xCG0nobjMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506162, "uuid": "eaffaab8-548b-476e-822b-9c8d6b435f7a", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506162, "uuid": "78284e12-f191-499f-a07a-73b6efa0512d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506162, "uuid": "4a4019df-9d1c-422a-957e-d8d646a7261c", "value": "613e5388d0ecb8ba81e4423409cd366e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9d92f5-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503902, "uuid": "32ed31f3-7c02-4a39-8c12-7011dca8af09", "comment": "Malware payload (Socks5Systemz)", "value": "f6e5d8bace38d56de8ee1b92d5c614ca", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503902, "uuid": "5a5ecd5c-9283-4781-907d-cd3014bb4359", "comment": "Malware payload (Socks5Systemz)", "value": "83bd294a249e0b530a2af330af73f1e1ddd4dc981bb94f6966dfcbeaf07852c4", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503902, "uuid": "1791c78c-1206-4165-9cd1-7a321f40d143", "comment": "Malware payload (Socks5Systemz)", "value": "b401670fa1d45c56fa1d2249ede9b5c88647b559", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503902, "uuid": "a2695ddb-a3d3-4cb4-9e11-4e01a0e5b080", "comment": "Malware payload (Socks5Systemz)", "value": "8b971012d00ba3f253e83bf7575aa1f62a05143282a8323972865a37eb8de3d23b069ad2bdc28e61888cfa701c68a520", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503902, "uuid": "a1c0a7a4-c733-4353-bbb4-1ee267c858b2", "value": "T1B0E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503902, "uuid": "0b2303a3-c986-4aff-88d8-393ded20d3b1", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503902, "uuid": "8ec91bbf-d142-497b-9762-8b8ffdce655d", "value": "12288:v+XssgiZdvAeRwm+aCHrVGu9zO0t4WaNx04xi9EOjjI1Y4hwfS9wKjui657Rk2kt:LsgwdvAL1LVGu9zO0t4WaNx04xi9EOjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503902, "uuid": "4d29d645-451b-46e5-858c-000a9369259e", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503902, "uuid": "f140de8c-5573-447d-b26e-a234a437255a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503902, "uuid": "9d896796-73cc-45b1-b13c-a0853c9ca217", "value": "83bd294a249e0b530a2af330af73f1e1ddd4dc981bb94f6966dfcbeaf07852c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d4532e-f4f1-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMoon)", "timestamp": 1712502707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502707, "uuid": "88c0d645-fdb4-4557-8533-86e96a470fdd", "comment": "Malware payload (BlackMoon)", "value": "b9246e45f4048b90a61857e98b0b2b39", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502707, "uuid": "192afb69-ead5-4167-a8f6-2b5a62602fde", "comment": "Malware payload (BlackMoon)", "value": "83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502707, "uuid": "a6d10830-103a-4e0a-8a46-094aea827092", "comment": "Malware payload (BlackMoon)", "value": "a319e7d377bf80ed2661dea943a3bcdb4733f605", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502707, "uuid": "898a0025-9ca8-46c0-bead-60870d124a31", "comment": "Malware payload (BlackMoon)", "value": "ac89198e8569b4be4ed054f957f8fbfe92fb0aa8735d766f5e63df9dec6429defdeb5fa6e261fc610bf8128f8c83f6b4", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502707, "uuid": "62253865-1fb6-476b-a002-b214ae4153d8", "value": "T164F30822E51388F6E02D05F557F2073C9978876368B24AAFCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502707, "uuid": "22bd726a-ca8b-4dc2-a723-6b8a5fed7b2c", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502707, "uuid": "ff4db8cf-582a-4fae-9bb7-ca658b0ade9d", "value": "1536:ej+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8Y:eqSe5OmiEoAcCbZ6FNoutb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712502707, "uuid": "c7ce9e19-58c6-4386-ac8e-9e7b9f435050", "value": 159766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712502707, "uuid": "cb96f200-16ee-40d4-8575-285d24e3395c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502707, "uuid": "a58d1d69-e36d-4a98-856b-596a7c5d4519", "value": "83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8a9496-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712509451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509451, "uuid": "5790495e-3b05-4591-b839-57d0cbbdf614", "comment": "Malware payload (Gafgyt)", "value": "23fb98685d74f8a09f25904b2a2036ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509451, "uuid": "a795ad76-7ee9-491a-84d8-8185b1c74f3c", "comment": "Malware payload (Gafgyt)", "value": "83ffbdb34defdaeb8ef26be782583291a920a60cc22073d26d45bc247ce15648", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509451, "uuid": "4ae9e258-14b4-4b90-a243-43e0a37cddb8", "comment": "Malware payload (Gafgyt)", "value": "61f28135e440379a92c3588ca3ed8bf6da9d7f9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509451, "uuid": "1456d082-2299-4121-8d10-c28408ed3a71", "comment": "Malware payload (Gafgyt)", "value": "35b34e60bea374556b895fbf8fcf42629fd5825ee187979535e541fb00e86718fc3186fa0ca2ce7d00680c3250296a5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509451, "uuid": "909cefbb-2a00-47e2-b3d8-75ec52b68b31", "value": "T155F30A45BC509F26C6D716BBFB4E42CD772A07A8D3FA720399255F20378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509451, "uuid": "f744add0-f77c-427e-9790-39743c0de8ce", "value": "3072:HZ6nmpEf4qUY4qvi4kXMZD4D1Ll6CHdr:56nDf+Y4yi4kcZD4DZwCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509451, "uuid": "1a6edc74-8832-4b2d-8e56-76fe8670bff4", "value": 162528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509451, "uuid": "6da288b0-7d9c-4853-b9fe-de3a500455b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509451, "uuid": "a2df7707-b296-4e6b-aaf6-ba50c58e8d8d", "value": "23fb98685d74f8a09f25904b2a2036ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d63a7e-f4d9-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712492686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492686, "uuid": "54ec9f4b-c3e4-440b-a703-a853ac4c87dd", "comment": "Malware payload (RiseProStealer)", "value": "083d34a720e93ba837d4469162fe53da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492686, "uuid": "9a49f0e3-b91c-4fc0-9d51-844e3966da15", "comment": "Malware payload (RiseProStealer)", "value": "844d9d6802415011c004bb08fd9531f08234dc93c0139a5b9ddbceab2f488546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492686, "uuid": "5fde3b72-6664-4f51-bfcb-6cadbf070986", "comment": "Malware payload (RiseProStealer)", "value": "d12ead960ed0b8e3712e5dd37598d4d5a7b67e29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492686, "uuid": "b083cc2b-8e0b-4090-90f8-89c9559d8d93", "comment": "Malware payload (RiseProStealer)", "value": "956589badd62c08535338b7b554dc76d67b0b93f1479c9b7026b8bc19f51088a39de1fcd585319b2d36c2d1c381b88ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492686, "uuid": "44e4d628-9046-4917-b504-9262a1955e46", "value": "T1ED46330C48C519C5ED86FAB82749BEFD36F829EA0013DE1E642D68CAADF35655372307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492686, "uuid": "bc5ae008-074f-43de-9fae-9bb3fc370e3f", "value": "fce2185f86316405847dae4f4adccdc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492686, "uuid": "3d105706-ffc2-4046-9903-fa37d4898789", "value": "98304:wVgKLU26PzqhVcJOvJ1r2Zy0HVQ66Klc/pKBvxo1mx/YM3W1qps7+hyKsvcapM5s:wVgKLwPzMVDh1yo01kKlc/pKBJoI/YMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712492686, "uuid": "16b54dfb-d151-441a-acf2-d9247688ada6", "value": 5845504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712492686, "uuid": "e660827c-32e5-4271-91ee-8cb5e36b5594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492686, "uuid": "8f620d7f-51be-48cc-9245-44470fcada34", "value": "SecuriteInfo.com.FileRepMalware.17769.21135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7339feb-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509445, "uuid": "58520ee3-4e89-4e09-bcd3-4c9c460905f0", "comment": "Malware payload (Mirai)", "value": "9eba88c22ac436ecac8e49211bab4023", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509445, "uuid": "bd15c453-ab7c-4efd-aad6-6cd5d0df56ca", "comment": "Malware payload (Mirai)", "value": "865faa99156a6701dc4757671a510262ed2873e0203193e74e613feebf207753", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509445, "uuid": "7e5a605e-ce5b-4221-aa33-78ba7d6bc9db", "comment": "Malware payload (Mirai)", "value": "8a97778e6b3257a9bb7b8f0005cc1f7f04193a69", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509445, "uuid": "69f224ee-5f76-4da9-a94c-8230856da3e2", "comment": "Malware payload (Mirai)", "value": "ff76f3a917d1432cf8ba76ca386c110ddd29fce3976b8f726c9e1e6ae24ba37e55ba53c3ddc039780aa270005258390e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509445, "uuid": "636a99cf-a3fe-44a6-8f11-41bd191a65fd", "value": "T12D531817F58182FDC099C13417BAB93AE92734FE0238B6A67BD4FB263D46D211D0AD49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509445, "uuid": "4d6a6f01-5b72-46f9-9870-c739f351f582", "value": "1536:bklYu9RPiANIzTtAmIoR6mvyKmy03hB8BQX0cxygcYNLE:mYu9UEIzmXoRHZCcBgygcY1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509445, "uuid": "881fa55c-25d1-4cff-93c2-93786afe45f6", "value": 66224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509445, "uuid": "7c6a8a72-10f3-40ef-982f-1adf2e0f45a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509445, "uuid": "806e06b6-8342-4053-bb62-1c3345468152", "value": "9eba88c22ac436ecac8e49211bab4023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195f23c4-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504402, "uuid": "00592e38-ebce-49e9-8327-141aadf3c01c", "comment": "Malware payload (Neshta)", "value": "a0b7b50e018db3a9e383eefafea0c568", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504402, "uuid": "02037679-2813-4418-bfe0-4c5580a90eb0", "comment": "Malware payload (Neshta)", "value": "86a8b2b48b3445d9be15d50fe35d916aedd230826dae4065743f2bc37bb04742", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504402, "uuid": "03c6ec36-49c6-480e-b43a-0a4c6b6a670b", "comment": "Malware payload (Neshta)", "value": "b8163dc061c246db504b203324f3e79a08fd3e1f", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504402, "uuid": "9fe15f37-0db8-446b-906a-b851902cce93", "comment": "Malware payload (Neshta)", "value": "571ed5a967ea211e35c2cd7c71c39773dc39fed14e6039342881c98a49ed3baf0187b3f262b0f17860f0bc7f4d65a583", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504402, "uuid": "495cf0d3-7c6a-4047-9c18-9f14b59d09f5", "value": "T1A9B4F8522C81C25EFBBCF6791CBDB73618FE902816652F9FF297DC3A7209163A025245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504402, "uuid": "9ff68d0c-7971-44c6-b009-953195e4b7b0", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504402, "uuid": "2a945f8d-df00-47a4-ada4-0e274efa115d", "value": "6144:k94OrDVJ6/S6bqhCdIcxRt0BgeP0mm5u/NsRR9XrzCg0l7td0:BAISs7TxH0tNIu1e8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504402, "uuid": "f8a184aa-9c9c-42bd-903b-714a1c32b8bd", "value": 518024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504402, "uuid": "e661e62d-0f69-46e9-9713-8d0f75d99fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504402, "uuid": "2092a316-7951-4e0c-b820-2e7f8a5b0949", "value": "86a8b2b48b3445d9be15d50fe35d916aedd230826dae4065743f2bc37bb04742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2163d4-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504403, "uuid": "3daeba97-694f-4a25-83ac-4e254309caa2", "comment": "Malware payload (Neshta)", "value": "a66ddf8517a0b4e636501995e1c6118f", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504403, "uuid": "f387b6d1-37a4-4bdc-81a6-c2e5ae79ce49", "comment": "Malware payload (Neshta)", "value": "88f04c82d95a8e27e9c03fc4fc53dee49f20c628900af5838968eb3f51ad48c6", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504403, "uuid": "bdec68ce-723f-46ba-b12e-baba48900409", "comment": "Malware payload (Neshta)", "value": "54da83ab44cd53dc3d9148db39eca1709b04fa4d", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504403, "uuid": "9d454a4e-fc72-42ef-bc38-9e9849a61ad1", "comment": "Malware payload (Neshta)", "value": "e28e58503d865133608ac12132d7e2ffd07a809940c214845181c3c8a191e64db510da6907822a90cb8c7b47225ce65c", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504403, "uuid": "9856a9d7-b06e-48bd-ae17-fccbcb5c778f", "value": "T135939E13FA9184B1D6105BB80C3E973AC97672212F295BD7B764DD5CA8352C27C2E2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504403, "uuid": "b729bc4d-586e-407f-8e53-4f588bc84a03", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504403, "uuid": "1b9ae841-0f31-4223-8997-03bbffc01828", "value": "768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJklHRCo1QwLPDEuuPWvtEpsXaqwfAi9A:JxqjQ+P04wsmJCflgoSw7DE3eu8UfwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504403, "uuid": "f9e52436-71b7-4e8c-9b8c-3d1bb0b998fb", "value": 92040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504403, "uuid": "c65928f8-9431-4f11-a094-c745db19e423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504403, "uuid": "abdf6c07-5d1e-4ae3-b4a4-df9ea2b0db6a", "value": "88f04c82d95a8e27e9c03fc4fc53dee49f20c628900af5838968eb3f51ad48c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f60df86-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506533, "uuid": "956de6ef-fe4b-468c-aeac-f6e219624219", "comment": "Malware payload (Mirai)", "value": "64f700ac97a870b099daa1a3b8638c48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506533, "uuid": "f281634d-6de6-43cd-9aa2-98cf6b6b21f2", "comment": "Malware payload (Mirai)", "value": "89151cfd61e7a76a11f3233392a7d8a52e65ee4fa3fe9a1d13230311e2aeb65b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506533, "uuid": "c94f23ed-09fb-4be1-9f37-0c79c23e93e2", "comment": "Malware payload (Mirai)", "value": "5173dd24ed8e26fbe3632f2a9cf05b650c748344", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506533, "uuid": "aad95e04-3c2c-4a6d-a5a2-d2736a8cb931", "comment": "Malware payload (Mirai)", "value": "0b37007e135ee076a879ff228b31657152a43fe39a5ed3fabe3a98feeb52e29a3d33a1f6a7202475129a16db37b4a0c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506533, "uuid": "01222306-202e-4187-9c14-68d3b52970bd", "value": "T1C7E31A46F8819B12D5C111BAFE1E124E37131BBCE2DE72129D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506533, "uuid": "09d82e20-3b59-42f2-8ed9-3f89ae1cda92", "value": "3072:eA10nY1Ugg+WWXX5bXHTaBHP5IA1ROCBh:eAl1b+WXpbXzax5ROCBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506533, "uuid": "05177c98-968a-4df3-8b1e-df5f92d19d69", "value": 145756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506533, "uuid": "b219e646-c67e-4b46-b91f-552336def477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506533, "uuid": "0375c7c2-e19b-4f23-902b-e1a3d633cac6", "value": "64f700ac97a870b099daa1a3b8638c48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9313648-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509421, "uuid": "4019132e-429d-4428-b150-8b09c5a4dd99", "comment": "Malware payload (Mirai)", "value": "02ba361b08f9b17294cb1d76805a43d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509421, "uuid": "214fd95f-8718-4f98-b542-5b8d67bf2068", "comment": "Malware payload (Mirai)", "value": "898e03a639f85234b87d90134e1238e64a2b4b4280e2801cd70d7f4d1ba9e8b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509421, "uuid": "f60e70a8-1e13-41b3-8a80-7282a70367c1", "comment": "Malware payload (Mirai)", "value": "073d79ea75c84afedc5c0d52422d62372fe6b912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509421, "uuid": "3b44472c-771b-4f15-a08b-25ea49377170", "comment": "Malware payload (Mirai)", "value": "5799a80722cb5e16beb5f0b03f4eff6bdd4b1c31dc6de732cf229aea6ad81d160532cff8dbd070bc4691a12d3eeb9a0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509421, "uuid": "2473bb4e-844d-4fcf-8cc7-e66124676c9a", "value": "T125F30846B8818B15D5D651BEFF0E528E33231B78E3DE72029D246F347B8A87B0E7A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509421, "uuid": "ec5f0017-83b5-4b15-a479-079e9ce58829", "value": "3072:8gRXBxOPTGEwHbTux0Pn5XLXvSSOaQ2/b5jy42/gLlxaZhc:8BPT+Ha0BXLqNapbA42glxar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509421, "uuid": "98f64497-96b0-47c9-ab85-2a0c2fba266e", "value": 171356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509421, "uuid": "6665b3bf-b0f1-42e7-80e0-7862f566c5bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509421, "uuid": "79f3e54b-599c-4db9-9f21-62b7a4d0b828", "value": "02ba361b08f9b17294cb1d76805a43d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5d6e4d-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504405, "uuid": "5bae4137-9b8e-4e46-b9fb-0c6a5494ee68", "comment": "Malware payload (Neshta)", "value": "b2340c1f73c5267df6fd3e49cfd21efd", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504405, "uuid": "704bcf36-121c-4248-9c14-1525a3f00262", "comment": "Malware payload (Neshta)", "value": "89daa972fd915bd308428f32df0938bb912a2287379c25bcb760b179e4e12ddf", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504405, "uuid": "6e82f127-b9a0-4adc-ab33-25139f2ed57f", "comment": "Malware payload (Neshta)", "value": "b9e338f4b99710f162b83eadf8a3e43eade3f0be", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504405, "uuid": "0ff32046-9d06-4ad5-abb5-7bf8ba184760", "comment": "Malware payload (Neshta)", "value": "4debee23a9cc1e59cbf85eee41d8b2326e9adae100311a5be121b698c910f67bb0927d2bac1f287c246fa755fbe575db", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504405, "uuid": "419d1b4d-fb8f-44ec-95bc-64e01b7ced98", "value": "T1EC250615764EC572C47C80B42978EFB62478FC722C2886D3B24CBF7D9E355815AC1AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504405, "uuid": "23f964c8-f4b0-4ab4-bcb6-06f16e83fad4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504405, "uuid": "e0b536e7-d9e8-4aeb-87ac-70e1ed2eff5d", "value": "24576:Ii2PxJ43N7zmdYvoKTZC0kGDNkWHwbO0Uts+wjA:IzEkKPkGvHwbO0UV4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504405, "uuid": "47959bea-9f15-4901-aa61-9338087aa4bb", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504405, "uuid": "11219b50-6c7a-483d-87a6-e102401c17b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504405, "uuid": "48bcfabb-b532-4ab6-b846-8544b8b28450", "value": "89daa972fd915bd308428f32df0938bb912a2287379c25bcb760b179e4e12ddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefa1674-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712518075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518075, "uuid": "681fe51c-2b8d-44dc-9039-b7468b1a5348", "comment": "Malware payload (Gafgyt)", "value": "8b0d8f10af4225b8cca15f8e2a57fef6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518075, "uuid": "4a3639bb-4aa2-4c89-9f0c-bde7215bb365", "comment": "Malware payload (Gafgyt)", "value": "89ee52f52be58d02b0adb7c7948079eec44eb739eda32852da9800a2d415fb9b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518075, "uuid": "b5f1f7b6-3891-47bf-b2f7-e091b68a69cc", "comment": "Malware payload (Gafgyt)", "value": "68c2fa5a5cc0bdb8a49c4fdaecc366b01efb4ddf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518075, "uuid": "0fe69fdb-8adb-4371-9ef0-757d8ac2e566", "comment": "Malware payload (Gafgyt)", "value": "976d3f445eceeb11d3c0a9a3ff43e2b9b9c18de20307588b78d67a83ae0428c5425aa17f553ed267a7e50e780d6e2502", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518075, "uuid": "2ce54497-1274-4872-a353-95db39dae796", "value": "T187D3F81B2693CDBAC0438B795B8EE01374B2FD3F073A51066781FE682F35AA4599B351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518075, "uuid": "663d46ef-8a29-45ce-a79e-ad9a39d5b3c8", "value": "3072:1dcFWwftVc49xq4Jj9xC2DMChEoZn3ppEYeRlVUncRSdws:ET9TCTMnHeRlVUncRSdws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518075, "uuid": "7bfe14e8-2e07-402b-b3fa-b81699b1e8ff", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518075, "uuid": "891eb4f6-6a3b-4d66-a927-297f2a10c1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518075, "uuid": "0458f20a-5530-4d50-a76e-d79b5bec58d1", "value": "8b0d8f10af4225b8cca15f8e2a57fef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1e6f3d-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504407, "uuid": "19dfbaca-b397-42f3-9262-d33a984299f1", "comment": "Malware payload (Neshta)", "value": "13de24382be7fc8513fa7a49bf3ccbf7", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504407, "uuid": "565f7f17-3dcf-4a5f-a716-c219f68f0053", "comment": "Malware payload (Neshta)", "value": "8aa0de94a6b6355d53188105933691fa926263493cfe832e1a9d9fcae800031b", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504407, "uuid": "60f8d695-17cc-42bf-b5a0-2033416b9ce4", "comment": "Malware payload (Neshta)", "value": "46bcaee90a96e37e10fde37b06373a9940048327", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504407, "uuid": "001f1727-4a22-450f-8cc1-aee17933006f", "comment": "Malware payload (Neshta)", "value": "ea4266496443735dd53b6ad3727b21be8c8c0ec209d61291ed4343847ea30b6cdac765e574b1004a9ccc7a97907ee695", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504407, "uuid": "efda1a5d-ba2e-4db5-a654-a23d9668d3ec", "value": "T161836C66F6E1C871D1241EFC8C269268D43B7A317D2A2AB2BAF51D4DDCBD3C12D0D44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504407, "uuid": "8bd2fe3a-c51d-4dbc-90a7-c01cd1aa8440", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbN6yxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPV:32xqjQ+P04wsm1txqjQ+P04wsmJCcB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504407, "uuid": "2f53d8a9-ac43-412a-95f5-b786f29b5981", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504407, "uuid": "e1aaedef-316c-4349-9ec4-57116312ce0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504407, "uuid": "b3ecc0cd-df24-4998-b217-b3503818ce6b", "value": "8aa0de94a6b6355d53188105933691fa926263493cfe832e1a9d9fcae800031b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26396dc-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503907, "uuid": "2a89d9ac-92a2-4905-afad-8abc59650944", "comment": "Malware payload (Socks5Systemz)", "value": "b17d7aa336ba60170dc131cac9c1d3d3", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503907, "uuid": "8c880776-ebb4-455a-89a6-ab8b4d4f3730", "comment": "Malware payload (Socks5Systemz)", "value": "8b0a9d20028e777b1ed654ed1fb6eac81bd27f5a47d3c31356be71c0bc583557", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503907, "uuid": "bf12e55b-0f7b-4a6a-9958-041c0617ef8e", "comment": "Malware payload (Socks5Systemz)", "value": "f4c2a463ad1bb619d376d5ce266dfd095c5d5fbc", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503907, "uuid": "c5ef6c82-a1b5-4c82-ab7f-dc6a6992ebea", "comment": "Malware payload (Socks5Systemz)", "value": "99a2b676b102da31d12e836e47bc7d912e0a68cbfff4da797d0f55b08d600b4e99454b0fbefed50183a90bd37aba1022", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503907, "uuid": "9385b006-5ad5-463c-af7d-7f591f44e132", "value": "T1C9E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503907, "uuid": "f62d0f19-714a-4e40-ac86-e9133de62630", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503907, "uuid": "f3405ee1-5d70-44d7-b519-c36da6388423", "value": "12288:O+XssgiZdvAeRwd+aMH3Xcu9zO0tiWgNx04x+9MOjjI1Y4hwfS9wEjgm657Rk2kt:KsgwdvAkPXXcu9zO0tiWgNx04x+9MOji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503907, "uuid": "889f7817-c847-4e33-9992-923de021fb21", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503907, "uuid": "bb629b97-aa24-4856-b91d-7fb2d4390d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503907, "uuid": "34365e91-63dd-4588-9696-552b0d0b32c6", "value": "8b0a9d20028e777b1ed654ed1fb6eac81bd27f5a47d3c31356be71c0bc583557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e37d35e-f4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Xtrat)", "timestamp": 1712502424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502424, "uuid": "52cccd8f-bf19-4964-8afa-6ebf5e9a5e6a", "comment": "Malware payload (Xtrat)", "value": "e10c1c8c7fa0069734cf690baa7db892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502424, "uuid": "9f061455-91d9-4d1a-b066-490f163aadf1", "comment": "Malware payload (Xtrat)", "value": "8c537fcf1fc08243455647d91953398c1a3d9052921e7fd7a88644cb368ed200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502424, "uuid": "6a02b742-63c4-4514-a4cd-528bd75415c1", "comment": "Malware payload (Xtrat)", "value": "ea5bad795883a64d7e1772fbdf49a4bdbc198d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502424, "uuid": "7e28a033-f297-4b58-bfa7-59d631ef4d0c", "comment": "Malware payload (Xtrat)", "value": "9ea4f768fc2ad700bdd4c08ce0ae4b8e883fcdcf18e4a630e78493c4cf87387c0be138e3639c2c8ceae9f5c6d60d7437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502424, "uuid": "2040a18f-bfa5-457a-856e-602284c07762", "value": "T16D547C16A3D049B7E0312E7CEE195128A57D39313EB69849EEF12F0D9CA92D207CD297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502424, "uuid": "12548dec-5ac1-4f97-90cf-00d2fe767e47", "value": "768:i8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiZKPA+7Xoa:Qsq+QV4rObAdXWpf/y+7ozNwiEohA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712502424, "uuid": "a5d9982c-cdb5-4a60-96f8-334d92ad614e", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712502424, "uuid": "41c1dc0f-eebd-4ae3-9611-37cb973cfe8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502424, "uuid": "1236269e-9554-4f3b-a071-1a76427edcb7", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f372d685-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503909, "uuid": "a62c62fd-2c85-493c-9d0f-06243abd981d", "comment": "Malware payload (Socks5Systemz)", "value": "0e9d72cd79904a0245682a8632197f06", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503909, "uuid": "2567b153-fd59-4b6c-9de7-fcc71622ce6b", "comment": "Malware payload (Socks5Systemz)", "value": "8e82e2c2c21b074fba03c5fb5c5a7c0c79ae2643e43b2c969293bc53c0cec950", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503909, "uuid": "16d9a736-3606-4959-854a-776f0f30151d", "comment": "Malware payload (Socks5Systemz)", "value": "c08d1924ea1cd89ebc467c947c58d9d677aff327", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503909, "uuid": "54593568-6152-422d-8ccd-4acdc57c8a2d", "comment": "Malware payload (Socks5Systemz)", "value": "4a35dd9c48a22abf5acdee4aa4547ca048dc1db02a7faf544664bb46f23c8d11476399dc30ef47fbd71d8a7ee1b121e7", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503909, "uuid": "2b164292-ced2-4ef9-8512-1b90d4102664", "value": "T141E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503909, "uuid": "e8d198d8-b1e6-4947-b380-694f8eff745d", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503909, "uuid": "4d42f7ec-84ec-4dc8-bcc5-eefe5215ce88", "value": "12288:v+XssgiZdvAeRwT+agHhe1u9zO0tNW1Nx04xU94OjjI1Y4hwfS9w1jbC657Rk2kx:LsgwdvAq3Be1u9zO0tNW1Nx04xU94OjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503909, "uuid": "e9bd4ec0-7594-404d-9231-e9fd692001fd", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503909, "uuid": "98f63082-176c-4665-a650-6078e49ea409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503909, "uuid": "3fd3518f-5dc3-442b-88b6-30f2518f9a65", "value": "8e82e2c2c21b074fba03c5fb5c5a7c0c79ae2643e43b2c969293bc53c0cec950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1412ee-f4ff-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509074, "uuid": "9c8881d4-d2b4-4ee4-bb87-f5521f09d9ea", "comment": "Malware payload (Mirai)", "value": "6ae4206cc38ce128be72ceb8eb862dd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509074, "uuid": "f200a60e-a7d8-440b-bfd7-e2bad74cf3e1", "comment": "Malware payload (Mirai)", "value": "8f861b1ee76616361676fad5d03f92aefee28c33c087a88ca2d602ef598ced9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509074, "uuid": "bd4168f6-7792-45df-ade7-5728c4191819", "comment": "Malware payload (Mirai)", "value": "030f030be4b3dc300a509aeab2587f167387a519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509074, "uuid": "0ccd2a2d-2c8f-46e2-9dff-e7c13d473407", "comment": "Malware payload (Mirai)", "value": "def03634f6f9bcb7b6cde03a52ff3c6dfa865f9929abb7d55c555d1ce0086d6dc66c9d263cc49176477838c092b029ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509074, "uuid": "1cd96286-9bcd-4e05-9e5d-7a7a40b1459e", "value": "T172538D75E42A9D14D0840130B4A8CF705F63F2C982663EF75AE586B6540BEACFA0DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509074, "uuid": "80dbdb9b-5293-41e4-a8ea-50ee35b19522", "value": "1536:WjhwW9QG/+DVWgDVKqlk3viCwCl+Ja10:WuW9QGPcbO3viCwV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509074, "uuid": "60c24033-6218-4325-b0b0-a02c38fd236b", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509074, "uuid": "2bf4df22-e87a-440b-b5aa-6cc6dce938ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509074, "uuid": "8840e855-f898-4415-9675-9c8933fc6774", "value": "6ae4206cc38ce128be72ceb8eb862dd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a9cf4-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503911, "uuid": "130cddb2-3098-47e1-b4d1-1cdb35bfacb0", "comment": "Malware payload (Socks5Systemz)", "value": "6a3a238be1ed22e35bf58858e76d2653", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503911, "uuid": "930b9aa9-4160-45a4-ab48-1604f0e8e20c", "comment": "Malware payload (Socks5Systemz)", "value": "905d00a027d54a482848a74a59b26b05aa7efe47b0b6bbd847f3f8bfd1f3a6e0", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503911, "uuid": "12f1b0e5-9e5d-46fb-9072-79a8fa738dbd", "comment": "Malware payload (Socks5Systemz)", "value": "0f8cc4e841e054b221e3ada4c1aa6d6899494042", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503911, "uuid": "d7641b3c-aec6-40f7-bdac-4964b47646df", "comment": "Malware payload (Socks5Systemz)", "value": "01d12a2017aae4062d8680797598ef1c3e5aec41fce5506552de4d80134a84c396d5853067ff298e70145e65b9ddc7d2", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503911, "uuid": "03a416bf-9454-45eb-9b5e-1a353588bfd3", "value": "T16BE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503911, "uuid": "0ca525f0-92c0-401a-8dec-db0052f92ed4", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503911, "uuid": "8367eef6-e0ab-4264-95aa-d6d666dc3132", "value": "12288:O+XssgiZdvAeRw3+adHFUfu9zO0tTW/Nx04xg9oOjjI1Y4hwfS9wLjVS657Rk2kN:KsgwdvAOulUfu9zO0tTW/Nx04xg9oOjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503911, "uuid": "531f6f74-3b77-485f-85fa-4f0aa882da65", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503911, "uuid": "b12ee5e4-7585-41a8-8e08-e122b31a97c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503911, "uuid": "bdd22365-5c4d-4330-b8b0-75ebda0ff77e", "value": "905d00a027d54a482848a74a59b26b05aa7efe47b0b6bbd847f3f8bfd1f3a6e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbfe201-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506609, "uuid": "5df15d3d-4c4c-4264-bc95-df82592162e3", "comment": "Malware payload (Mirai)", "value": "90d138b2fa4268efe12e70e468348892", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506609, "uuid": "9ebbd0bb-7f2e-4452-be5d-c20bb0ae7072", "comment": "Malware payload (Mirai)", "value": "908e904c9d2038acfb700a6770abf7faedcff404595e1c09e62a9b3492370a28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506609, "uuid": "63f7f9bf-04d9-47e0-b8dc-447926e76a41", "comment": "Malware payload (Mirai)", "value": "c9b139abcbc0d013ef929b08b6d12b16e5c5318e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506609, "uuid": "c8e2f223-3636-42f6-b1e0-52f4badada05", "comment": "Malware payload (Mirai)", "value": "f80e0c763b1bd51510292155f7d0a1f911560a3f74c2ce7d37e61aabe1ccfd245b363642bc227c88ba4d0aa07ad8589b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506609, "uuid": "e8999d9a-9bfa-4874-a717-8da6cba65451", "value": "T134332982B9C19A13C6D4237BF66E41CD372523A8E2DF731B9D122F50379A82F0DA7645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506609, "uuid": "e099c572-fac7-42a0-8bbc-07bc4bf7e83b", "value": "768:Ura1rUoanXKCHrpx4Upr/XoSpDvDe4lDn/JA16zokr6hT6NORfJ2r6RAHUi2ZvB:b1gfXKCp1/XD/w6onbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506609, "uuid": "7ab4d46c-b35b-4074-b004-6b7262a7e9b7", "value": 50764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506609, "uuid": "52e32923-570c-4ed9-8deb-4c985211a83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506609, "uuid": "9adf0903-0be6-4ffe-82f2-f5100a993cd9", "value": "90d138b2fa4268efe12e70e468348892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28396c0c-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504427, "uuid": "b5535433-56f8-4bce-b3d5-a06afabfad6a", "comment": "Malware payload (Neshta)", "value": "bd8594626ba14ad09f71b16ad853262d", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504427, "uuid": "6e0038e4-49ca-4ccb-b6c5-c02a2af9f8fe", "comment": "Malware payload (Neshta)", "value": "90d374900ca16edbe3492fd7a2f646be208742a4e6b213f053b1f793ab263c7d", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504427, "uuid": "51d4e29b-d553-401d-956b-b9903364b54b", "comment": "Malware payload (Neshta)", "value": "44fbfc9e73b6b367c2d6fc5c1f88c9abf22e9141", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504427, "uuid": "932180da-8bc3-414b-b776-4b0d4ddc27be", "comment": "Malware payload (Neshta)", "value": "cac142f4bd487f66d25db4c56a180e1a4e9fb07bf9fbdf70aace69c2bcb75e230db4425f4ffc04e0f869256b9cce63a3", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504427, "uuid": "67261ccf-4def-4a7a-981d-4bfd8ef0f4ba", "value": "T132371902D3624063F1612470C85B7B9856617FB42E63E67BFE51760AFE32BC654332BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504427, "uuid": "44725ed3-7129-4984-b2e3-093737e07635", "value": "01392ca861cf87b8d28ad9ea90016bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504427, "uuid": "2ecdf195-ae7d-4ef6-9db6-6f8046b47027", "value": "98304:olerjesRJ8YQU/HlgIDQnJdziwIDQctPRM+M6RkMkIM7R:frj578YQ4guQTuQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504427, "uuid": "91933cef-4e30-4a67-8442-4343b981a982", "value": 23239561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504427, "uuid": "2f903bcc-12f8-4546-b782-47a7f97df7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504427, "uuid": "5247c6d4-1ecb-44ca-bfc4-b52de0c01968", "value": "90d374900ca16edbe3492fd7a2f646be208742a4e6b213f053b1f793ab263c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f593d56f-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503912, "uuid": "96aac0b8-6965-4859-a42d-38ec0b4c87a9", "comment": "Malware payload (Socks5Systemz)", "value": "8a3ee793cd0fb1c612d6300953f59df3", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503912, "uuid": "d6526890-29cd-4699-aac3-606c8c839a2b", "comment": "Malware payload (Socks5Systemz)", "value": "92154c1e71fae3a66a0ef59378a8037eb3b9bdca913ba56bfbc84a422bf1d7c2", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503912, "uuid": "7f1d1b8d-4640-4657-b250-7c001d053818", "comment": "Malware payload (Socks5Systemz)", "value": "8781612eae1cfd55a875228050d58aa0ffe69f72", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503912, "uuid": "c2284d4d-9da4-41c7-b2ca-dbf7267af17b", "comment": "Malware payload (Socks5Systemz)", "value": "77ba287bdc0dd54b2ecb0163ae5edd4d5e6421c99adc66c2803b95d02a72fd259302a3a86d14627dd2b6c3a22742c20c", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503912, "uuid": "030c9c2c-505d-4966-8e84-019e858c60b3", "value": "T1B8E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503912, "uuid": "b3d0e724-ce7f-45e1-9877-1f453b98b8a2", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503912, "uuid": "8b37c862-19b7-4a40-82f3-c9b0607ebcb3", "value": "12288:v+XssgiZdvAeRwc+aMHRSRu9zO0t5WJNx04xM9AOjjI1Y4hwfS9wpjXS657Rk2kR:LsgwdvABvxSRu9zO0t5WJNx04xM9AOje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503912, "uuid": "e26886e4-6766-4501-bda4-c73e5f982f8d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503912, "uuid": "56c2d8d5-9fa8-4fcd-b4d1-46ff1531ec8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503912, "uuid": "7541a7b1-4be0-4312-8b2c-5edbbe2a7b30", "value": "92154c1e71fae3a66a0ef59378a8037eb3b9bdca913ba56bfbc84a422bf1d7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2baf02-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712475036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475036, "uuid": "f7d688fa-5adf-4d3e-b68c-15569777d861", "comment": "Malware payload (AsyncRAT)", "value": "3a71554c4a1b0665bbe63c19e85b5182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475036, "uuid": "1dceb133-ec51-4164-9cf0-5b96c7e7eae3", "comment": "Malware payload (AsyncRAT)", "value": "9340551164eb763cd63db1f251b535dea497edfcf1eb46febcb642b1369f8595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475036, "uuid": "47259693-e88c-43ab-b503-600d3ab9f8c1", "comment": "Malware payload (AsyncRAT)", "value": "9d90887ff8b7b160ffc7b764de8ee813db880a89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475036, "uuid": "09099be7-43e0-4259-bc95-a98a56f2efe0", "comment": "Malware payload (AsyncRAT)", "value": "aba66f9ac2e0990ef6ccbaa643456f9dded636fdc9286e0e5207ca75520a197fafa025c31e9d75c299cca11871ee1fec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475036, "uuid": "dbe7313b-ad2b-488c-aa70-136953cef28a", "value": "T1A0537D1837EA4526F1BF5FB168F57162DA3AF7232812965F18C5028A0B23E85CD507FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475036, "uuid": "7913051c-2d1e-4c32-9dfc-3f270c6565a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475036, "uuid": "e3a3a7ab-ee2b-433c-b85e-76b2eb555a08", "value": "1536:qF/wi65oGvnxZmEkbBAf3xAwK6s9EaOwD7NO03:4WoCmEkbBq3xa9EaOwD73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475036, "uuid": "5f9f5ec9-734b-4437-a5fe-2311c09c63b6", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475036, "uuid": "62c57b7e-bc26-40a6-a6e6-841cb5fe5472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475036, "uuid": "c5c5636e-ae51-4cbb-8e09-ad27224392da", "value": "3a71554c4a1b0665bbe63c19e85b5182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a7c60a-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504429, "uuid": "e9d4145c-2317-4af8-86b6-a96f56c20bb8", "comment": "Malware payload (Neshta)", "value": "0483dae83b790dfd3937fa488482d931", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504429, "uuid": "5c387b1e-d279-4019-b220-c52a3370de1b", "comment": "Malware payload (Neshta)", "value": "93b81cbccfbef6df6235de59336340fcd6e15a9fc994912220cbe173352fa4dd", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504429, "uuid": "ce641717-56ba-406b-9d1b-ea6e2b45f29a", "comment": "Malware payload (Neshta)", "value": "396199e3b47e4a7ac6e47baf8ab35b6bd9199b26", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504429, "uuid": "11241a69-d7fc-4012-8512-c57c1364d4ba", "comment": "Malware payload (Neshta)", "value": "67010e648ca65583c4db771a90137bfff1e89eb43da40c2ec950b72d802ff0bfea56c405c3c323254f4747c976063237", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504429, "uuid": "31a542a4-49f4-4792-986d-f61312bcb238", "value": "T1BF555B207741D5F7C561127D4A6A97BA90ECBD140BA136CBD3C83A6E2DB42C32E33B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504429, "uuid": "ed49d771-36f8-4432-a464-e68808aa4bfe", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504429, "uuid": "ac907fc8-6cf9-40de-b4f9-25cc95340ea8", "value": "24576:UfWsc1RVmoBqxC1gV7mQOt6btLqtR4pr6ImPgjLtpt9:UE1RVmoBqxC1gV7mlt6Bw4NHmPgdn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504429, "uuid": "688168d3-8751-4e63-9ae7-ce925c347fed", "value": 1349440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504429, "uuid": "9b3db1e0-aa42-4df6-99eb-c337126beb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504429, "uuid": "9cc87513-69f6-4eea-99ba-fef5a234b88c", "value": "93b81cbccfbef6df6235de59336340fcd6e15a9fc994912220cbe173352fa4dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30079a4a-f481-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712454618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454618, "uuid": "f450709b-083e-4aac-858b-a9f50af7753c", "comment": "Malware payload (njrat)", "value": "2c06dcb2d6df459fe1179a18212efa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454618, "uuid": "f69d1799-2d12-4c4e-b942-1c41ccaf2e44", "comment": "Malware payload (njrat)", "value": "965bb9b053f8e76e687b5d26994978c8a7de03810b77b00c784e398bde3ede06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454618, "uuid": "b66cc2b0-f643-4b8f-8279-da220a8a1bed", "comment": "Malware payload (njrat)", "value": "b1b543a418a42bbc394b80b7b65f384671c6775e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454618, "uuid": "602a4a61-7255-4c77-8f67-b2609c337aa5", "comment": "Malware payload (njrat)", "value": "59b0df1e3f861798906fdd9eec88f16521c8e3a07fdf1da4f1a86b9de3826af43e12ebac4eb22e732b53e95c6e01f29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454618, "uuid": "b0ca31ac-040a-420b-8b84-44ae12aa7b19", "value": "T125B30D387D952133C67AC1F689E50A8BEB69223F3191E8ED4CA752C418B2F156EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454618, "uuid": "181daa85-c2bf-4ecb-9985-bd381e1d77bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454618, "uuid": "a434c86a-a930-49bb-b103-7bf2da732775", "value": "1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMY:P5eznsjsguGDFqGZ2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712454618, "uuid": "5602f911-3b6a-428a-b209-14c1163ab6ea", "value": 115488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712454618, "uuid": "a9f8144a-ef25-48d8-be1c-2f7fd69735c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454618, "uuid": "d5d3d403-3f1d-4b96-93c7-f33d2924bc95", "value": "2C06DCB2D6DF459FE1179A18212EFA6A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e94c4b9-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504438, "uuid": "ec39c8b7-0110-4241-870b-5889446e1e8a", "comment": "Malware payload (Neshta)", "value": "1a3b0d180547c1a2238ad27072d624ef", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504438, "uuid": "3400a2ab-f980-4fc6-b2ce-f3ed308a2cc7", "comment": "Malware payload (Neshta)", "value": "9668fb45e881c454fd30938e649490900dca6e4138887641d3fa70b81fefb6e7", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504438, "uuid": "499c2126-a949-4ab6-bd2a-2628ff18a6b3", "comment": "Malware payload (Neshta)", "value": "39f3793e22e0ee7bef754d1bb70975b9112d358c", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504438, "uuid": "99575de6-f7eb-440b-b969-5ab40dcd65b0", "comment": "Malware payload (Neshta)", "value": "96c5eb76ba4046740c43309a6f5353220514bcccff021159b38346cd43873b51c0581e3234d2eac74e19038c52a4c64e", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504438, "uuid": "b6c0f3fc-5fa0-413b-b3c0-c7201cd45f4d", "value": "T173A35A82F7E088B0F4B20B74BC37C7205E36BD266D64469BB3A1764DDC717C1A92934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504438, "uuid": "5d218574-2c26-4994-afca-67e9eb55c59c", "value": "1536:+QN6Q+P04wsmJCZLURD8ib8tCIFauT41a/kxWO7iIy4LXqpmfuoy6te:1N6r85CORD5b8C57y4jem7y6te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504438, "uuid": "ddc9706a-4298-4047-b67d-a2a7a010a1cb", "value": 103394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504438, "uuid": "86cde2c6-d6bf-42a8-bd3d-3f47ec7a18d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504438, "uuid": "8fba8ed3-74ba-4927-950e-4d60b443e188", "value": "9668fb45e881c454fd30938e649490900dca6e4138887641d3fa70b81fefb6e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c28dcdc-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509104, "uuid": "b18bcea8-0e2a-41c8-9aab-727944d22df8", "comment": "Malware payload (Mirai)", "value": "e6032cc261ef703304e1e7de19204e89", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509104, "uuid": "045d5671-b9b7-468f-9998-113c378c6eeb", "comment": "Malware payload (Mirai)", "value": "991ba7483c208885bac059727b8356824d241a78a7162cd23769a3b44a5d9963", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509104, "uuid": "cec1dde8-8330-4dbe-8fda-08ab2d91840e", "comment": "Malware payload (Mirai)", "value": "c8fa6d1d71e57c7c6ad79e430661396582fceb68", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509104, "uuid": "a7503169-bd5d-42b5-a5c0-2d9d21e5f7f3", "comment": "Malware payload (Mirai)", "value": "9ec3daedc42973abbf3c8a85327d816bea40f13fd44aa5e98a4f75081e2a7c0163500721371b42591003c878728344cb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509104, "uuid": "460a17b9-cc67-4475-a62e-8aec1a92feab", "value": "T195833B07B5C1CCFDC09AC134177EB936A826F0ED1328B2A727D4FA253E9ED612D5A944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509104, "uuid": "89e4e0ee-5dfd-4cf7-9bda-a19d4b5e19aa", "value": "1536:xOEpvXapb4VzMijZOjRvPefoX6sfW7q/CWPlFGKjUKLLPQ:sEpSh4eijZqJef4fW7qxPiKjUKfPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509104, "uuid": "d3a14f8c-6d6b-4b31-ad8f-15ed899c915f", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509104, "uuid": "93265e3c-8e6b-4727-ac5e-fabda37463a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509104, "uuid": "4999f5d7-f71a-436c-9a0f-0b2f6ae9cc75", "value": "e6032cc261ef703304e1e7de19204e89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b871bc7-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506150, "uuid": "01ff1bde-e158-4157-ab52-5a2c04be7b1c", "comment": "Malware payload (Mirai)", "value": "fee1e6d8a55265164d14c90dd50a7e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506150, "uuid": "edfa72ea-1685-497e-9a1d-af3904fc4f92", "comment": "Malware payload (Mirai)", "value": "9a8cca31605c1e4c67c9e28e10ba7015ed93a1cd94b79521b7799e14c8f4e352", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506150, "uuid": "f9845c7f-b95d-4252-aa95-7485bf171d7b", "comment": "Malware payload (Mirai)", "value": "00c4dcfe03c4b46fcb0d8a6821156801bd1641ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506150, "uuid": "ca8eed82-567d-4be3-a15e-ad0aa1989efc", "comment": "Malware payload (Mirai)", "value": "63837ed43daaed175e4a0c26a985c913cedabe781896211f2e1c387bc78fb8c29e8459500ee9d8ca92f788beb3b67f1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506150, "uuid": "b5150cca-1149-450d-a06f-f00ebd0baf9a", "value": "T1E3F2E756B892962BC1D5137AAB6E9B8D377173E8D3DF7313E92007A0368611F4C22F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506150, "uuid": "4421c5e5-160c-47f2-8705-98b67f2b397d", "value": "768:jOXLoXjFi6293PMG5rfKgoLEn1HL2oS9w5:jMLmF7G3EG5rP1HLl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506150, "uuid": "62cfa9e6-cb7e-4d45-a38f-13f678fe4bb4", "value": 37248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506150, "uuid": "7ff8eb02-06fd-406a-af52-509f23306399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506150, "uuid": "a390b7d1-4e2c-444b-ac7c-7a3ed14b8c0e", "value": "fee1e6d8a55265164d14c90dd50a7e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ad7071-f473-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712448617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448617, "uuid": "bfba3da4-f56e-4b1d-a5f9-960652bf460e", "comment": "Malware payload (Socks5Systemz)", "value": "d21d87de27e3201c708249416c041c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448617, "uuid": "7e1f8a0d-1d10-48c4-9a9f-b24ad3ec7b44", "comment": "Malware payload (Socks5Systemz)", "value": "9af60bcb43b67b54533b5ce9cd6853d97b1ef6d9f068541347023204323b1ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448617, "uuid": "4d5117bf-613d-4743-b3eb-852772ffe47b", "comment": "Malware payload (Socks5Systemz)", "value": "390fe51f1fe59afe193258a9ed4e449a5a6e3714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712448617, "uuid": "1ef97ebc-572d-498c-99fd-fe72e6625935", "comment": "Malware payload (Socks5Systemz)", "value": "7084577c40ac28361da3a6dbf612a33ad1566ba5ed12da8e995b49669656245edf6b071c800d177b5c156d449a3f54a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448617, "uuid": "9051ba6b-f56b-43a7-9ceb-faf5605a1bf0", "value": "T11916337A52CACCB7D2AA4DB89C76C488165F3936A82A03567F0544DF5F428E44E1F32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448617, "uuid": "b17a9e7e-2e08-40c2-990f-a6baded035ba", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448617, "uuid": "e08a060f-25bc-4a71-9d31-31c81430d139", "value": "98304:CB8hlSOCYW+jc0mfCkyTPJ4L/iMPJEdkb6erxHyB/MwkMoWKPQxi:hhlSOCYW+QffcTR4LPaw7xHyBHQWKPQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712448617, "uuid": "353fe9dc-9d86-4878-b7ac-11c6cea06bb3", "value": 4310039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712448617, "uuid": "0930cd4f-b454-40ad-9d2e-893d72eb3211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712448617, "uuid": "8a4ec4eb-5f71-44be-9b47-656af14232c9", "value": "d21d87de27e3201c708249416c041c51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f057df-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515639, "uuid": "b6d601f7-4628-478b-9ef3-0b0d71ff01b2", "comment": "Malware payload (Mirai)", "value": "f5741ccb35c3b83775257f0d5f004fa0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515639, "uuid": "dfc74726-3ef9-416c-94a6-86db0330d2aa", "comment": "Malware payload (Mirai)", "value": "9cbecfff26313ac13246d27ff1667c4c63654022a5fd57eef7f6ba4fa968b6cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515639, "uuid": "b75dcb92-718d-43d9-b3bb-88c41b20b911", "comment": "Malware payload (Mirai)", "value": "4beb4b38dbef97fd52d409bdb1ad342275d3293c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515639, "uuid": "96b800cd-f503-458c-a224-9c937b029e85", "comment": "Malware payload (Mirai)", "value": "5253cdb2fc71332fc7439ec984ed7b1891ff0e9a916d6b8ce416b64431e84210fa5c7a359eb9dab1acc50b3d23b208ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515639, "uuid": "d855e56a-a2a3-45ca-b028-b5289f5cf9c6", "value": "T1FFD33A17B5C180FDC4DAC1B44F9EF536DD32B1AC1238B26B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515639, "uuid": "87cf2308-e67a-41e9-9a08-1fb5c6fa21c9", "value": "3072:tGtwnNiaOnUTVFiPT9OSQ7AOaogjV2iZlBWCgxiAPQPdL:tGtwnNiaOnUTbuLy7PQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515639, "uuid": "873a9356-48f4-44e9-b05b-f374038017f6", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515639, "uuid": "aee30ff0-8fc1-421d-8541-e7e2d9bec445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515639, "uuid": "ff575602-a06a-4d6f-93dd-6fc2e81665cf", "value": "top1hbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13f29cf-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1712504657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504657, "uuid": "0ed9759a-4449-43e3-ac6d-a2c08d4026db", "comment": "Malware payload (MarsStealer)", "value": "a74c9036ba18a91d23733f21f0965352", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504657, "uuid": "e4d33667-61df-4c6a-b237-581bdabf07f6", "comment": "Malware payload (MarsStealer)", "value": "9cc1d2cf5e3b394fbb7f4d470b6c4e094aa8691fc759f9f75faa88a5772c882b", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504657, "uuid": "702d15a9-eeb3-428d-8164-8d9058ac603c", "comment": "Malware payload (MarsStealer)", "value": "f39eb55e6fc74d112e7e3b8f72053cf139f1f6d1", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504657, "uuid": "dd2b755b-7345-41c0-9001-58cb73c0361b", "comment": "Malware payload (MarsStealer)", "value": "5c2ce7142e9133aff6c54f862d0860d0f0031d3991abb827147ca8e82d59e5ddc8d6f4871292bfb2ea9c6e5182cf6c6d", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504657, "uuid": "f26a95b3-8cd4-445c-8293-5bcc819f7c01", "value": "T10CD46B2439EA8019F173AF794BE475BA9A2FBB23EB02DB19105133464723B41DED153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504657, "uuid": "eb33dbb9-5a99-4abc-8291-b15e1cd59968", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504657, "uuid": "8296ccc1-7553-4408-bc5b-f8b6145616ad", "value": "12288:6jLIHe+qdOqQ/H6OKnA5feEq8sdvuxi+vC/tKJ+2BAMSsjgZeS1I/XUta93poy:CRtwtvagbCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504657, "uuid": "9fedddfa-649b-4ecf-8eee-6ee8fb5582cd", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504657, "uuid": "c03fe79d-4a91-406e-b6f7-cfa44f28287e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504657, "uuid": "41ce8f24-171e-4e9a-b5f3-55805df7a3d1", "value": "PERM Flow Chart (5).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521f4137-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515664, "uuid": "2b8b3ace-e701-469f-a343-3d94d6ebab9f", "comment": "Malware payload (Mirai)", "value": "6713e2d354993ef06edc08ac1e736997", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515664, "uuid": "4f866b75-31f7-4d91-8248-a2678b26dec9", "comment": "Malware payload (Mirai)", "value": "9ebdcfdf159cabcf33a23d46f610c615555731285f3198c5f8ee7c85618ab79c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515664, "uuid": "7132c0ff-f38f-47c7-b230-ae4e14f4b1a9", "comment": "Malware payload (Mirai)", "value": "542790761fca1fb1f3aad00c14e296974a45fa27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515664, "uuid": "8cfbcd12-342b-4dec-a229-6d25265eeb38", "comment": "Malware payload (Mirai)", "value": "daf5bdd33647a2882cce3c871e61ffc5de3ace03df44095fa1df855a465c5680f059fbc96ec292bad6f2b898f1f4a292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515664, "uuid": "5e04fbb7-4e99-42fb-910e-41c9bc5895c7", "value": "T10504885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515664, "uuid": "bf9bf137-656a-46a1-9087-f73d443501e1", "value": "1536:Cl2JvnXP/LBQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zdt/Y:Cgv/FcwZsCK9VRhAX+bShFSP0HbbdlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515664, "uuid": "31d3c507-2861-4331-aadd-d2361b5a7883", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515664, "uuid": "fb1115dc-f606-4ced-8f1c-ad44b9f47b12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515664, "uuid": "235ed90f-d6e2-43f0-9ba1-268830fe71f9", "value": "top1hbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3007d744-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504440, "uuid": "af28a42c-3be1-487b-8857-4910be6d054d", "comment": "Malware payload (Neshta)", "value": "8e2cc41e431e76a983e7a00bf12d48ea", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504440, "uuid": "bb715a95-7d0d-488a-970a-c0fafe916917", "comment": "Malware payload (Neshta)", "value": "9ec13c484e3752da474eff014cdc74ca28be45dc18ab91d5b50152f7ebe383b5", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504440, "uuid": "75388402-4e5c-4ed9-a514-04fd591e0e8a", "comment": "Malware payload (Neshta)", "value": "918af1165b1cd7c13e49db546ddc120dcd95b364", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504440, "uuid": "8dcc1043-653e-47a2-8f4c-f973d847a235", "comment": "Malware payload (Neshta)", "value": "2d1a0df708e44712c7c23af1e8e88b8ba98ceacf708e9940d5d260b2ba1c0b650c0a58a66c7206462e5b95fe1f520b78", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504440, "uuid": "22ffadc3-c824-45c4-9a40-d7794b888010", "value": "T15304B052B9D0C471E5320D34486CEA758A3FFEB05E608DA73368396F5F352C18D2996B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504440, "uuid": "90cbaee8-91bf-4e4c-a9c1-93628eafe059", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504440, "uuid": "8922bcd1-6b32-41d0-92ba-3d75cefabf64", "value": "3072:sr85CVs0EHu9e723AlIxh1KhkSadXkM/Ajx1CnM/2hkKqELSFBqrD:k9P3AEw5PM/tM/0q2eqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504440, "uuid": "84da4590-1239-4026-8d7c-2d0f81a1f5ba", "value": 177816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504440, "uuid": "bfab92c7-2307-4b08-b0dc-9ce36a9a3603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504440, "uuid": "a86076dd-c666-4e7a-ad2b-50d8427a02b3", "value": "9ec13c484e3752da474eff014cdc74ca28be45dc18ab91d5b50152f7ebe383b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cdae4c-f51e-11ee-a120-42010a9c002e", "comment": "Malware payload (PythonStealer)", "timestamp": 1712522111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712522111, "uuid": "31bd2873-e177-47b4-bf5c-18b77ba0214d", "comment": "Malware payload (PythonStealer)", "value": "8ff71f96f7aa34b8678e386bb81bfea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712522111, "uuid": "3305ecbd-3617-40fe-a08a-981a34f43467", "comment": "Malware payload (PythonStealer)", "value": "9f87755ea15a94186f2a0c5c72fd9edcd2d9a079636fda9848d89381fd9c8646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712522111, "uuid": "51c49439-70ab-4cda-99f8-54d51b37d17a", "comment": "Malware payload (PythonStealer)", "value": "c53d5528a7eacc2004041064ef72d310e9957c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712522111, "uuid": "734aa538-d05e-4415-8cd3-95df821daf8d", "comment": "Malware payload (PythonStealer)", "value": "4c2acb6a1e23c3b19f4f08804052539ec1ff4e7a6ea64b95b9b35f468b9b483a6b63032360db7e272c76fa3da170b4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712522111, "uuid": "ee04bfae-f26b-4134-bdb1-cf6df1de5588", "value": "T1DF863321C1328C9DE29B8A3126A5389B3A647D7E1331F86F83B4D6B16F067E44F6D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712522111, "uuid": "c98aca6a-7e64-4db2-831c-328ab46f969b", "value": "a5265cad677687f09e3f564adb36da98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712522111, "uuid": "10ba1ef1-e486-4308-9661-ac23fd75fa6f", "value": "196608:1teafCtPz9lH9czmcYSukiK7ndIeU9r7Pwimdvdz173l:vdCz9lHcmmP17n+eSrqd1z17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712522111, "uuid": "e879cd97-5f1b-427f-b537-d2ced628ef3e", "value": 8175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712522111, "uuid": "dfaa3e50-381c-49b4-8230-5714d225f358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712522111, "uuid": "c184837c-8d1d-4667-84a6-2d07f163a1bf", "value": "steamodded_injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f991526e-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712506496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506496, "uuid": "4d7c0618-27f1-4b46-9216-9112328f907f", "comment": "Malware payload", "value": "be3dacabd2b60f0ecb759d60a8100f88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506496, "uuid": "1c7d04f1-a674-4a6c-a580-37d5baa4658e", "comment": "Malware payload", "value": "9fa7f09168a58b6ae70fb7c2e0a5251911516adf383c404a635e7075fd2694dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506496, "uuid": "1ad48005-47ce-4004-87a1-6585f5fdfb01", "comment": "Malware payload", "value": "70047d183515fef2209573660fb2011abe597f5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506496, "uuid": "81612952-ee39-4339-8846-3f50a713c4fe", "comment": "Malware payload", "value": "3fbebb167da79ecbe46bf33432d1366d4e15b70885ec79f3c7de51f15154767a8c5fa161f507fb51b5f4e352f3490eaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506496, "uuid": "1377579d-a2bc-4c78-89bc-2bb2f3a37439", "value": "T156236CC6D915E5B2FC3501B01162DB92EEB4E0FA7426D497D3EA2E34E4718D1AA013BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506496, "uuid": "04f9ec08-54f6-4354-aa8e-a471de628f7f", "value": "768:86tAXsqJCKpwqY174Sy/k+qUHwf7NqQfA+qL+EM4:8WAXsqJbXA45wf7NFfVBEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506496, "uuid": "7db32936-6dad-4d1a-a632-bf2155f9ffec", "value": 46020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506496, "uuid": "eb10f420-6e3a-4cf1-b45c-0ed223e43fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506496, "uuid": "7f91c207-0165-4843-8d71-c4ecd69aaae8", "value": "be3dacabd2b60f0ecb759d60a8100f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105fde8f-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506964, "uuid": "4d1b18b8-50e3-4266-be01-4998a2d8fbc4", "comment": "Malware payload (Mirai)", "value": "ee0d95421a020de89665a7a9560b6577", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506964, "uuid": "0dbb2d08-e39b-4c66-84d6-8e2ed822a8cd", "comment": "Malware payload (Mirai)", "value": "9fd73838b7fdb35d0a9d9d4e454b8dd0ac4a04f6e5dc9b5df123683f99c03e18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506964, "uuid": "b5573c0b-b80a-4a7c-b195-827479c263ae", "comment": "Malware payload (Mirai)", "value": "511536bc50b509099e8d2992dc1bd31303a08be7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506964, "uuid": "49c28ee0-f22a-4e77-b47b-043791360eeb", "comment": "Malware payload (Mirai)", "value": "3ae97ab78c1fc6c4e4d90fce9d4c41352c22549d5b8c83554334620c1c348f32304861d7d884e173303df3db2dde098f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506964, "uuid": "c0506644-5d20-4ec3-a253-2d6fc6166e0b", "value": "T151043B46EA414B13C0C727B9FADF42453323AB94D7E773069528AFB43F8679E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506964, "uuid": "189ebdb4-56e1-42b3-939a-ce062368e6f3", "value": "3072:LF7z9YH1rrJ90HI3Ua3lO4CDAtcpCTBBDqPy0QoyM/RADIz:LF76VrJWoEa3lO4CDyhBB2PVdyM/RmIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506964, "uuid": "4427c36c-becc-4e19-9b97-4c4ff0611886", "value": 183754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506964, "uuid": "14a22330-0dbe-41f3-9cf7-5f1457189daf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506964, "uuid": "540f4ada-689c-4a48-af2d-db9880b23b7e", "value": "ee0d95421a020de89665a7a9560b6577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0113700d-f515-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712518105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518105, "uuid": "2bfbe630-98e9-4c4e-81d7-9cbed0849548", "comment": "Malware payload (Gafgyt)", "value": "bd3f25ecd4db03e2d2b29b4a930053dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518105, "uuid": "5fe9bdc9-d822-4075-b048-547ad8d0a6b8", "comment": "Malware payload (Gafgyt)", "value": "a0f92663927099ad5d41327ba85c5cfe8a3bdbf77ce27ba9d88a6c3114976ff3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518105, "uuid": "52a82fb6-238c-400e-b629-a4209a0ab230", "comment": "Malware payload (Gafgyt)", "value": "d33c4563734ee8a3781c4ce1b262f2205310e789", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518105, "uuid": "2b15c2ee-b336-4a08-821f-e1939a408778", "comment": "Malware payload (Gafgyt)", "value": "9a45758e7885add1e5d003c45f2e62aa96e01b1d00157777175e685fa451f27b57fd26d5fe65727c477e6b7f85db1f38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518105, "uuid": "baa9af7c-9106-476c-aac4-5d91e96032bb", "value": "T1CD732B02E653CAB3C8930BB602AB5B6A4631FD2A1E2B9F59F31C7DF49B124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518105, "uuid": "bb072c12-b629-47b9-8e53-b3c4472f9a65", "value": "1536:zmic5MIQWiKLoxKFn6pD+OTxzMppAymLI2VOCjXUfJRk:A5Myr0xKFn6J+O6pAymU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518105, "uuid": "544ae342-2e76-4cd6-9a1c-1911d3f9b687", "value": 74017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518105, "uuid": "7f25a394-b99b-4624-9479-9862694aa503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518105, "uuid": "951033d3-50c8-4558-af13-a8af3cb04635", "value": "bd3f25ecd4db03e2d2b29b4a930053dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c09bcc-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506512, "uuid": "fd5e9d99-6736-4a45-8625-11632f3a6327", "comment": "Malware payload (Mirai)", "value": "26c5466fb7cbf8496a68f0c916e51d88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506512, "uuid": "85a2d64e-924f-4569-b109-6701d30bd797", "comment": "Malware payload (Mirai)", "value": "a193f8c8700c2403ecd675c229fc3c75598799121256d4bfa5449e220e48a181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506512, "uuid": "d46f72ad-be41-4e21-a0b8-bd7ab1dc0be2", "comment": "Malware payload (Mirai)", "value": "9cd17d32e0270296c5ccb454b18ee45ef38d7347", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506512, "uuid": "29b218ac-d079-43b8-a988-1eb745bafc5d", "comment": "Malware payload (Mirai)", "value": "29f0518125f36b0debfd0ab97a323ce7ee2a6cf626eb0a046bc18cf753615f99cd26164ba0a4f48367f32676cc224e92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506512, "uuid": "95711fe3-9801-4078-9eac-e7185014ddf5", "value": "T15AC31A55FC405B13C6C212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506512, "uuid": "bce0d6f2-bd9d-4559-999f-8a58678a0423", "value": "1536:Jtv+s43G5bUWkwRAVSh71QAFMxK4VIGUT2yR2hO/CoA46n/txlc6wyw1FrR7PVz1:bv+XQjRag71QNE43UqyR2hOO46/ykbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506512, "uuid": "29f1e0bd-42eb-474a-9b72-59e3e03f35bd", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506512, "uuid": "40005cdf-f35b-4e27-a58f-d62a8ee30c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506512, "uuid": "9ad17ad6-1291-41de-abf4-7afb7c88545e", "value": "26c5466fb7cbf8496a68f0c916e51d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd91c537-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509456, "uuid": "96da08ae-c867-4cea-a8bf-f1c1ece8cb4e", "comment": "Malware payload (Mirai)", "value": "655c00353982b11b5789ac94143a06de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509456, "uuid": "80cb9eb7-d182-4e29-b70d-9825a80cd1e0", "comment": "Malware payload (Mirai)", "value": "a1e0c44678b9c68b68edbf440dcd1613ad036f0d4622b0a8caf152576be70b33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509456, "uuid": "481e904d-a02f-40b0-96d5-e068af18b21d", "comment": "Malware payload (Mirai)", "value": "a10e49f4a87f95b59deb29a72e05ec0085973cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509456, "uuid": "230c3a29-838e-41a8-9695-eea3f2e82980", "comment": "Malware payload (Mirai)", "value": "5337cea027b5cc8496a790e3637b3f42bd7e769dbf4b80fe4a6cdd9e943bc867ab2e34923fe26a9636b3ddf1d1837f8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509456, "uuid": "53446277-c594-406d-b325-e6ddff618ee4", "value": "T1A3434CC5E243E9F5DC13017020B6EB33BE36E1F91119DA97D3E8EB236D92512E44AA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509456, "uuid": "8712570c-47c7-45cd-ab14-8f15f247e85b", "value": "1536:DgLG/crzf+oXU8GBh7CHj54U5UtwUSNLZKB:Ui/crzf+oX5X5yNS1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509456, "uuid": "f1a5d2f0-6c16-42f7-ac68-a3c1de7f4482", "value": 59444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509456, "uuid": "7f23c4f0-5b88-4c12-ab15-f424a987532a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509456, "uuid": "24a8bed1-b3e8-4926-a37b-270207fb3e21", "value": "655c00353982b11b5789ac94143a06de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bdf953-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504443, "uuid": "e60b7976-14ab-4619-99a8-03c9e58ac163", "comment": "Malware payload (Neshta)", "value": "0722b62473738dd0ae6132c94061477e", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504443, "uuid": "bfec71f9-05f9-47fb-a86e-51e76af49bab", "comment": "Malware payload (Neshta)", "value": "a24242d7e51f10a77ee3a7ac7a25457fd4541f121aae9de2d04ed8b1d84cc02d", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504443, "uuid": "fee6a647-031b-4ffd-831e-3ea65b0a858b", "comment": "Malware payload (Neshta)", "value": "7f4c97e8569762de72bf5014b55f69081b5d4fe4", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504443, "uuid": "05300aa4-4534-41eb-8a1a-60adacf80761", "comment": "Malware payload (Neshta)", "value": "6b05529787f02dc9eddfd754829401e593ef63aa757ada3e166bef1fdfee62ac6d0cd131525d1ca826d79afedb675aea", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504443, "uuid": "428fde9d-be35-4f86-92a2-2110f6cab01d", "value": "T13564E113B6F0D475D1A107B98A497FA8D1FAF7300B248E177BE40D096E69786E70E24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504443, "uuid": "649bdf81-4f08-48dc-9cfb-ef6db7c6fdb4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504443, "uuid": "094ad5ff-fed2-493a-8157-ea080b60d9d0", "value": "6144:k9P2+Mq9zntr0kVlkqsgFb592VTarpsH7vlAkAsl3D5vlAkAsl3DQ:c2FqPHlkLgh592VT6psOk5Ck5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504443, "uuid": "8bca6048-5e6d-4ee3-ac86-e5311bbd5066", "value": 321104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504443, "uuid": "cb118a86-6f5b-49ec-b69b-0a8a37bf6123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504443, "uuid": "5a743451-942b-4332-9661-ecb74817828c", "value": "a24242d7e51f10a77ee3a7ac7a25457fd4541f121aae9de2d04ed8b1d84cc02d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1599da-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503923, "uuid": "8961402e-27a8-4986-a91b-f2e7baadcfde", "comment": "Malware payload (Socks5Systemz)", "value": "4729dc22553f74565be92b5b8c7eaa68", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503923, "uuid": "9a3e3886-00c9-461b-adcf-b730d2b1d144", "comment": "Malware payload (Socks5Systemz)", "value": "a24a89818de798650e18fa755e73f772fd0494a4dda3dcf9c5b3e3266840059f", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503923, "uuid": "2c24bb40-5fb1-429b-a0a8-4cfd315e203e", "comment": "Malware payload (Socks5Systemz)", "value": "6fce183f1585514680bf61b4dac61a916c9d6e48", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503923, "uuid": "f883934e-612f-4ee1-9014-af2a1d099683", "comment": "Malware payload (Socks5Systemz)", "value": "7d686a161994096144e0ccadd13834312e93e83963e929cb736cd9d1280335aede299c22143c28062576dd8812b97e98", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503923, "uuid": "bf33ad76-8773-43af-9319-9f6d88fb1a47", "value": "T119E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503923, "uuid": "96f2cd9b-7f03-49d0-bc81-d003c611f262", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503923, "uuid": "b4afa643-0e31-4abc-b3c0-492f7884cede", "value": "12288:O+XssgiZdvAeRwc+aJHrpSu9zO0t8W+Nx04xC9EOjjI1Y4hwfS9w+j6S657Rk2kd:KsgwdvABCLpSu9zO0t8W+Nx04xC9EOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503923, "uuid": "b9b84ca8-7c45-4c2e-83ef-c2cd53a5603f", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503923, "uuid": "fd4fd9fa-8745-4201-980e-b8fbf5e8553b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503923, "uuid": "7d14a2b4-441a-4e3f-95a6-2b18c6b48dd9", "value": "a24a89818de798650e18fa755e73f772fd0494a4dda3dcf9c5b3e3266840059f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32890ec0-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504444, "uuid": "0f49fa0c-ffcf-4d7f-8af8-de3be023c366", "comment": "Malware payload (Neshta)", "value": "08c0ea7f261c2c49241b143bb7dda0bd", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504444, "uuid": "3c099fdf-d640-4012-b977-cbcc6778bb98", "comment": "Malware payload (Neshta)", "value": "a27f6a8cde55da2008b6647bb819e62269d0f45860c285c83534cdad050da882", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504444, "uuid": "4e748159-033e-44b6-94aa-0fca9ebee127", "comment": "Malware payload (Neshta)", "value": "6d7521fb2f99bcf7d7e8309934dd1d975881d627", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504444, "uuid": "13a58312-6fe6-4b96-a9c5-e79208910878", "comment": "Malware payload (Neshta)", "value": "cb3528ea4429545cabd670b15604316d8932a28d60965d4c9c22fbc0609588430f8ec7e2bb0eadf7eb7c03924a11e4cc", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504444, "uuid": "a44f63cc-c753-4947-938e-8451f79892e3", "value": "T185E38D4673E054F9D0265678CCB68614D3B3BC364A78974F37A43B5A9E733822D2E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504444, "uuid": "52c191dc-4c94-47da-959d-689297d0bd69", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504444, "uuid": "21648cd0-3a41-400c-b9e8-bc083e38f3b6", "value": "3072:sr85CkkbAYn2GgYlBYN2fHYTo+OAt8wDSRUTT:k9xbAMpgY3gTD8DRUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504444, "uuid": "d126bc8e-f03f-4186-8b26-be9ea9654a24", "value": 149882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504444, "uuid": "16b24454-82c7-4f12-a480-cadb720845d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504444, "uuid": "2483db67-659a-4a9f-b788-7ff1b7afbdf3", "value": "a27f6a8cde55da2008b6647bb819e62269d0f45860c285c83534cdad050da882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6b9318-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506556, "uuid": "c46fe88d-365f-4553-8437-adf8e01adc97", "comment": "Malware payload (Mirai)", "value": "08f3d0ce5d592fa95b5874a1582e840c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506556, "uuid": "28bf69fb-cbbd-4ea2-b9f2-7412f5cff936", "comment": "Malware payload (Mirai)", "value": "a320eb810e6f2de618742978b516e01339d95f5e185a82d83e415dd2593c7c78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506556, "uuid": "d9f31769-0f52-4438-a5b9-b6faf65f5352", "comment": "Malware payload (Mirai)", "value": "808c6966757f906bde6497e9e509caefe07832c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506556, "uuid": "154bfb39-09e3-4b4e-a44a-d0eeb35679aa", "comment": "Malware payload (Mirai)", "value": "acea0b6c1892213ecaef165d0e346ca99a2b7d10a4e7b611648677ee389ed4946a30cf02f506a5b573b07e6c588f8fe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506556, "uuid": "23c70d92-5a44-4a4d-b196-277f95c383f7", "value": "T10AD32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506556, "uuid": "6c4ccea0-4081-4327-b68c-f9b186383ef7", "value": "1536:a0nwryWv6n/qZIc9SH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/zJ:BWv6W9y8z+x57ndngpPMVtUpdbBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506556, "uuid": "b220707c-7dac-4ea2-acd3-d268e5752286", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506556, "uuid": "5640b8b6-f0e6-47fc-84c3-0951a8b7fc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506556, "uuid": "9626a316-3593-4f43-8d63-0c8fa1867916", "value": "08f3d0ce5d592fa95b5874a1582e840c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5d1a97-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503446, "uuid": "36ec8af9-dc42-4ab5-9cd3-d65d55655d22", "comment": "Malware payload (Gafgyt)", "value": "dddeed7a82ee715b00ff967b7f368ae8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503446, "uuid": "fc0f4c8f-f1c4-47b7-b687-4016d06bf484", "comment": "Malware payload (Gafgyt)", "value": "a33fade64b08311e33d527fba12741785898128930955e262850a8c7603c15bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503446, "uuid": "8a0ffd7e-e9c4-490b-8811-65acb52a4434", "comment": "Malware payload (Gafgyt)", "value": "9a1d63ff27762e0d0b81c7e761246b52d09c6adc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503446, "uuid": "92adf28c-df0e-46ca-92e7-0129fc5a843a", "comment": "Malware payload (Gafgyt)", "value": "a23ba827ec0a882a3b4c98e7287ca6566e65909664f4800c33e4f2639b073b8420e032528800cea5220b4eb259e39ae7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503446, "uuid": "d5418076-04dc-429d-b9e2-79df2be1cc10", "value": "T1F404717AB7618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503446, "uuid": "5f9f1fd8-cd96-4b7d-9c3b-8d06cf9af94d", "value": "3072:aaF7XSy6Cv9RD/5hCs1ZQhmv8uqx1BVnKoe:aICGVF/5hCZhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503446, "uuid": "ac1e7e5d-6f06-49d3-ab0e-d5ec06b66b2e", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503446, "uuid": "46979c9d-b6bf-4a36-b401-badeb284aacf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503446, "uuid": "f1ed8ae7-dfaf-40ea-8442-6ac5301810e9", "value": "dddeed7a82ee715b00ff967b7f368ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044740cf-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517681, "uuid": "042a8b4d-3435-46cf-a5e6-65ef796ba1ce", "comment": "Malware payload", "value": "d66b3faa918f8a1388bf1b9053ba064a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517681, "uuid": "3834fb09-ba7f-4b41-b711-15141a143e29", "comment": "Malware payload", "value": "a34c48389406d1ed1fae895ee0af3918651f4736a6341f87327404d19fa526fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517681, "uuid": "f559e925-401f-4805-bcd9-df4a485762df", "comment": "Malware payload", "value": "711a9bd308723a05773927201bff897b984e6de6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517681, "uuid": "ec86a300-9f08-41d4-a548-5a46db0c8672", "comment": "Malware payload", "value": "d3929bec1aec4ee62e7d6a2e853c5a49829a09b02765dceb0011920b28e69d7b42b8ea4be3d2f871748562bd33965d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517681, "uuid": "3f6f6b08-026f-46d0-86a5-10744bfc083c", "value": "T142C3D8834A20DEF7C053AA7136B25524B795BF690B1F0A867E1DB6A00F3B4CE741F660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517681, "uuid": "ebdaf334-e9d3-4da1-a650-7004847536e0", "value": "1536:OqJB3Ah36o3OO+KGSBgs0QgsYsCx4FCC3kVPLLlX0BmqXTWXFRRT0IAf1BgeJ8:XvBo+GGO0QgIF3uoiXFLT0IA9BgeJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517681, "uuid": "67ca6d16-cf1c-4915-a54a-d6661467c7e3", "value": 126587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517681, "uuid": "d0315351-683f-48fc-a95a-06bf08d0dd77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517681, "uuid": "2349025c-ea91-4dbb-a98a-4c848f850cb0", "value": "d66b3faa918f8a1388bf1b9053ba064a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334dd158-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504445, "uuid": "4c45b41a-00c4-4e85-bb2c-d336f9959231", "comment": "Malware payload (Neshta)", "value": "7ae7bb4459da11c5dafde0c17747ae91", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504445, "uuid": "41e46e59-76d1-4a58-ab3e-978afc233757", "comment": "Malware payload (Neshta)", "value": "a42a20c7975dddff5c6327b81a610f585cad701afa07a074e4d01ce423deff1b", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504445, "uuid": "44b8e274-0c8f-4ca2-8221-bb70f8fc7ad0", "comment": "Malware payload (Neshta)", "value": "53c6a3cd4cb0c98d01a4891dd8d21a4c74fc79c4", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504445, "uuid": "08333b47-d296-4b0a-abba-77e5bfcefea8", "comment": "Malware payload (Neshta)", "value": "911f2727f35464d826cb3ad55fff244474a3d3e38e6f5a5fe9830d70a3c8936fa2cdd385b569bd28ebcff1f15b86196a", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504445, "uuid": "b9208450-490d-456c-ac0d-d8d3834a589f", "value": "T17A834B56F6D0D831D2260EBCCD2ABA68943F7E303D65B6A1FAE52D4DC87D2C1691C809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504445, "uuid": "2666377a-b408-4010-bce6-b6b0d38e29ac", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbNCyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPe:32xqjQ+P04wsm1VxqjQ+P04wsmJCcBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504445, "uuid": "5159edf8-0725-4af4-80ac-14504517090b", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504445, "uuid": "7e2d5b2c-7ac9-4bcc-bac4-d4b575a414c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504445, "uuid": "aef622eb-3ee5-4e7f-ae7f-c9f3e54893de", "value": "a42a20c7975dddff5c6327b81a610f585cad701afa07a074e4d01ce423deff1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34119d33-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504447, "uuid": "66e9808a-5626-43ee-a648-d85551718848", "comment": "Malware payload (Neshta)", "value": "3bfabc8d1cebe7a866b7606d3c65844b", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504447, "uuid": "6a7d4311-04c3-48a5-b579-108cecc57aba", "comment": "Malware payload (Neshta)", "value": "a55264649f71ac355bcddf301354a8fe9f6e597c9f1c0d4bcd8ca925c8d9280b", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504447, "uuid": "6cb687b7-f2d5-42b7-9ddb-88d3f088d329", "comment": "Malware payload (Neshta)", "value": "b3ec0cd454be93ec1f1421c3fe6fef5baaf7d9f1", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504447, "uuid": "29f5123a-4e9f-4323-9146-fe04e366d359", "comment": "Malware payload (Neshta)", "value": "55dccafabd0f0ae6c13f280b5aa7ff496e3057943740e79c9995eb9ee0e9de527f2bb6adf96fe598402ebae5c107e523", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504447, "uuid": "a3b4f0af-784c-4468-9983-d3225051505b", "value": "T1D3836B96F6E1C871D0241EBC8C2A9268D43F7A317D292AB2BAF51D4DDC7D3D22D1C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504447, "uuid": "59d6831a-7c06-4c29-9907-a0dcb7a7573b", "value": "1536:32xqjQ+P04wsm1CxqjQ+P04wsmJCcB5X0:3Xr8ljr85CcB5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504447, "uuid": "cb2f9cf6-0e99-4014-9a10-ccdcb16c6309", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504447, "uuid": "2b85ab20-bdf6-4065-807f-612344e4fb26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504447, "uuid": "f8b5f137-5132-4c01-b81a-31c0d116356a", "value": "a55264649f71ac355bcddf301354a8fe9f6e597c9f1c0d4bcd8ca925c8d9280b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d1f424-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504448, "uuid": "6821ec2f-db02-4078-8430-a6e1cf13ecc7", "comment": "Malware payload (Neshta)", "value": "bd7985efa092f37e6fe83fde1c7d470d", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504448, "uuid": "95d3c542-250a-4cb4-af95-2abea1503780", "comment": "Malware payload (Neshta)", "value": "a57d130b2c16fec24c5f755c3b0dc953df374c85f8b436714666521d9d6b38f2", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504448, "uuid": "badc2ebf-84d1-4aee-8112-6e6d69f19961", "comment": "Malware payload (Neshta)", "value": "388633dfbded22bce156ab14553a35ed730f620e", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504448, "uuid": "e6fd8cf8-bb25-4130-b4b2-3353f6e576b1", "comment": "Malware payload (Neshta)", "value": "4dd9ab1d3c29a8d3d70a81b705edb46c85480499764a62cea6840ef67efb80441b742ee8d36b89b01cb56e135329431f", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504448, "uuid": "fc3c201c-2633-40e8-9cca-beee61b6d719", "value": "T1E3836C56FEA18871C1240EBC9C258328957B7E317D792AB27BE53D4DDC6E3C2291CC4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504448, "uuid": "7eb4ed26-aeb8-4718-9800-f02cf1cd104c", "value": "1536:32xqjQ+P04wsm1XxqjQ+P04wsmJCcB5WdGcY:3Xr8lOr85CcB5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504448, "uuid": "ce99fc8b-08c4-4b9d-bacd-7a83be6259d4", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504448, "uuid": "86931eb1-80ad-4dd9-a93a-73d981cad2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504448, "uuid": "53be72bf-57c2-4510-945f-ea47338b4dcf", "value": "a57d130b2c16fec24c5f755c3b0dc953df374c85f8b436714666521d9d6b38f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4d2f17-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506501, "uuid": "c09f0312-8c60-415a-8a65-2575d75e0d9d", "comment": "Malware payload (Mirai)", "value": "03533f722f30913fdefb9cc371c3e471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506501, "uuid": "39082530-060e-4d2d-bd6b-118a8f35def8", "comment": "Malware payload (Mirai)", "value": "a603490307d354ca596f646ddf96335f6b9fccaee53cf32e9c0bb2734bff7ad1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506501, "uuid": "c638f47d-3cd3-4fbe-8f39-1fa0e67ee0a7", "comment": "Malware payload (Mirai)", "value": "19648e03db0ae21d5175d36c161d89b378b78409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506501, "uuid": "581943cf-25b7-4059-a73c-7a4bd645f946", "comment": "Malware payload (Mirai)", "value": "63e6a9ccf2f5d5b94d9caeecdfe457e789312bbd5ed5f64271b6ce5944be9ae261c176f1259b1c9429dda9116aaaa795", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506501, "uuid": "b77ebc7e-4e4d-4932-a3da-d03bbf1adfd6", "value": "T131238D76C86E5D84C3085234A4398E781B13F104D7676EFB1A5E82A6944BDFCFA0E3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506501, "uuid": "c767fc02-7cdf-410d-ae49-81fb8009f939", "value": "768:9alYmj+072Veb+FczLEZEjlQpGPlblVPMCQ8o35TJvAAB1CDxvnUi2ZvB:9a+C72V3czGEplbz0H733AAB1CDxvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506501, "uuid": "8f64a756-d50e-4781-8259-eb510f200071", "value": 46392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506501, "uuid": "ae993e7d-0490-403f-9168-2c3c1ae73df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506501, "uuid": "999b964a-e862-45ad-8775-e9f591b88a89", "value": "03533f722f30913fdefb9cc371c3e471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480af6fe-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712474845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474845, "uuid": "421bdbda-dfde-4e19-a0e4-0fa47e972774", "comment": "Malware payload", "value": "1b3647e0b2cda1d258fd422da8494f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474845, "uuid": "6e4efc14-5fd5-40e6-87f1-fdccb4e23c66", "comment": "Malware payload", "value": "a68cf9b0e81a9bee5143a893e585aaa6d8c730e649ea8acc47c0f3d2f896d72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474845, "uuid": "ff9f134a-7eb0-4255-9416-69bd60c35a92", "comment": "Malware payload", "value": "5dacbad119e531d0496ee213a967e4773170694e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474845, "uuid": "c0f05ab8-d92d-49b6-beb9-cfd257f9d914", "comment": "Malware payload", "value": "bf2d1da1fcc743d2447f0e1d2d19c638fe64efbe7ce6d62cf4ecfc1ae4e0043c9ad8819c9f3234ed2508df0bcce293bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474845, "uuid": "67934d9d-9e2b-4906-a82a-0a59cc8cb40f", "value": "T1CF57AE2F70A4C17DC20AD235C1AF8B30E936F5992533C36B53A4D1A96F6A5A04E7E770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474845, "uuid": "6014f8f8-d884-4440-b035-fb786ecd3185", "value": "abf6e21e57f6eece0e799c572db55c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474845, "uuid": "0b7504b6-98c8-4f8f-ab90-aeab8b95465c", "value": "196608:+IjccbClhyC4g0BHrfDyBEryLgVP/x1AqfDj8Fn9aKv:+IQ/lUDPB/67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712474845, "uuid": "7ca45822-8657-4578-8e5c-5ce8e36cc833", "value": 28111240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712474845, "uuid": "6644fc3a-4c02-473f-8071-b013b68c104f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474845, "uuid": "6b99bd09-a548-4826-948a-c1f1e262db4b", "value": "SecuriteInfo.com.W32.PossibleThreat.28511.30670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83da66b-f4af-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712474711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474711, "uuid": "c0fc51df-2cb5-459c-90c0-a67fdf6473cc", "comment": "Malware payload (DCRat)", "value": "b18679a37c740ce6e14df3bea9a5946c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474711, "uuid": "7667bd53-b82e-41f0-8028-932eddf67a9e", "comment": "Malware payload (DCRat)", "value": "a6c91c67b0030b27e7008734fdef7595c6f0eef497b5948b5d9b7bacce2daca6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474711, "uuid": "24591170-1798-4fa2-8fc9-1b5064d781b5", "comment": "Malware payload (DCRat)", "value": "c491f891428c51da6fb1dadfdf7cc052418d3b58", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712474711, "uuid": "55901151-1df3-4e6a-95e8-a8f67b66feb7", "comment": "Malware payload (DCRat)", "value": "cea3c6742eb4903dd98aefdd6c334b2d6da164154d3a79d53b28a2c7e7476133c798457475183e56fcd6af3818c186d3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474711, "uuid": "0e3d2653-3d19-4a99-b3a6-6238e0ce998b", "value": "T17C06F10EA5526E73C3943F3185E7001D93F0C6667922EF5B3A1FA5D5A8822B18B536F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474711, "uuid": "f979431e-7b97-4ebb-9620-67dfa8ec05a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474711, "uuid": "afe4ec4b-9f43-4e5c-b901-ee2fae99077b", "value": "49152:JyxZLXOEx+OBBjnyLa2jTAUw6MBoHNUUlYJX+A7EJjZd/ngzkNidI57q52t1B6L:JySEFR70TAUwySU+JXXor/cW/Lt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712474711, "uuid": "53c8788e-03a9-4b8f-9811-b8dd5ee664df", "value": 3823104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712474711, "uuid": "fc32316c-e01f-41c2-8c55-94c33a3bac44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712474711, "uuid": "637d07d1-d184-4615-8791-ae9e133b3bdb", "value": "B18679A37C740CE6E14DF3BEA9A5946C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff35d2f9-f4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503929, "uuid": "ad8e9dd9-9e6a-4530-bc84-7e83a5de28b5", "comment": "Malware payload (Socks5Systemz)", "value": "4fe6208bef58f0811a01f17d1ea04f39", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503929, "uuid": "a14f94ab-cba6-4430-852b-de00f7db1f24", "comment": "Malware payload (Socks5Systemz)", "value": "a7b59e0338e44d40892bd359bbf26ccdf25976ec3c6f72bdb4b1f6c2f9d459e8", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503929, "uuid": "594a0af6-ce80-4870-9fa9-0e2d922a5856", "comment": "Malware payload (Socks5Systemz)", "value": "7ea147640d8adef0dd0983f647fb504893f4ac8f", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503929, "uuid": "3e9a4d03-ce59-4634-9349-5327203cbc77", "comment": "Malware payload (Socks5Systemz)", "value": "cc2cb73dd5eadf5aba8a1d45533cd66cd00fb549b21c007a7eeba0f855198281d4293964200071e4793524df2dcce144", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503929, "uuid": "f915c576-381b-470c-8d50-038ec7cd14b1", "value": "T13FE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503929, "uuid": "8c0a47fe-afa8-4669-a5a8-edeb44385375", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503929, "uuid": "4186f03a-5f03-4751-9fa1-2ea40f9d96c7", "value": "12288:HjsgiZdvAeRwp+a0HR50cC1dBqQpcvpWw1nmFRKLiTOkURpIHc+kxiIjcBDQg5E+:DsgwdvAgrx50cC1dBqQivpf1nmFR+iTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503929, "uuid": "5bb74962-5c85-4295-84b2-788473ac083a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503929, "uuid": "94786d41-86d4-4632-b625-e59f50aa740e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503929, "uuid": "be380b4f-b9f7-4615-b2fd-789b2fc0f912", "value": "a7b59e0338e44d40892bd359bbf26ccdf25976ec3c6f72bdb4b1f6c2f9d459e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0040f617-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503930, "uuid": "107e0484-9424-483c-a0cd-943077376ca9", "comment": "Malware payload (Socks5Systemz)", "value": "9cd6612ebf4e383c41f17a5bea8e56d7", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503930, "uuid": "737ff7fe-1857-49b0-bedc-71d8b29ece43", "comment": "Malware payload (Socks5Systemz)", "value": "a87039b8fa6de608e7de7dbcf0b3a0cbecb573cd739096d6d07948e22bb01982", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503930, "uuid": "1e60577e-27cc-4c87-bcb8-7d9870841052", "comment": "Malware payload (Socks5Systemz)", "value": "85e60f8f33c483ae4a587df2ef61616ec60f6ec9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503930, "uuid": "1234a8da-8060-4a3d-83da-205974bedef0", "comment": "Malware payload (Socks5Systemz)", "value": "822376c8e28381917859aea09e4e5c5f84061f40895313cbb47a62af056b329c98e737b94157b6e4f1cee726720e1f7c", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503930, "uuid": "7ff34549-4243-4818-afeb-077eb1fb5bab", "value": "T133E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503930, "uuid": "64ae3ef5-ea8e-4e97-a7fb-1fef462484cf", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503930, "uuid": "b2821f81-f8e1-4df8-9b3c-bd7bd87d4962", "value": "12288:O+XssgiZdvAeRwE+ahHHLEu9zO0tWWYNx04xW94OjjI1Y4hwfS9wgjEi657Rk2kp:KsgwdvApOnLEu9zO0tWWYNx04xW94Oj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503930, "uuid": "6cca9666-ef22-4772-899a-2f2ae27f9f7e", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503930, "uuid": "743cc013-2a08-4868-b711-95422d7856d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503930, "uuid": "6f3d02e9-33e5-4de2-af2d-1279490e56b0", "value": "a87039b8fa6de608e7de7dbcf0b3a0cbecb573cd739096d6d07948e22bb01982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b0afb9-f515-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712518131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518131, "uuid": "50a4a0c9-4044-4e8e-b3d5-8ea14f537ca9", "comment": "Malware payload", "value": "946e5c560a09cc0c98524254ee55b120", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518131, "uuid": "606c9ef3-5046-4103-a937-8d30fbadb287", "comment": "Malware payload", "value": "a8b596b0f027fd737af6d75fd32ad78002a83d700e0e7e08ad9f05f6038f0c96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518131, "uuid": "dec5d1c4-8d2a-41e6-ba59-4c02a6da33a7", "comment": "Malware payload", "value": "4958edf05fce2ca44a19976f3be9c2074bf853b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518131, "uuid": "4a8efdcb-8843-43c5-ba0c-d18b4d12ce7a", "comment": "Malware payload", "value": "a51487d0b273d98af4d76473591795ff123851d5dff2c859f35b5ab9f57b8c8956471504029b9c54f0a2ef8dce94aacb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518131, "uuid": "baafc899-128f-447b-9d49-1a6e9f0c9530", "value": "T171E3D92B22232F13C4E505BA01E28634BCFDCDAD35E64FD3AA897E691E315D436913D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518131, "uuid": "42ee303f-0afa-43c2-aa16-ff4b89d9a35e", "value": "3072:gTDdK1HtlydmQVioNPwxIiW9Zp1j/70cEIxcHgyps:gTA1HilQIhbN/70cEIxcHgyps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518131, "uuid": "57720685-b762-4dc9-b1c0-dfde86f4ebc4", "value": 153676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518131, "uuid": "7f27e9fb-075e-4196-bd75-e04dc7aafa81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518131, "uuid": "63130138-42e4-4d2c-88ce-36dba76e0b1d", "value": "946e5c560a09cc0c98524254ee55b120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a38ffd-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712504454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504454, "uuid": "2cf62452-c355-4c4c-8e15-909923e4c75f", "comment": "Malware payload", "value": "f43803f1bccc3352edf3595df636112f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504454, "uuid": "93216b62-0234-46ba-810c-bd686e665db7", "comment": "Malware payload", "value": "a8bc0ded2733124535fab01fe0d3ba7a5bef7078aad81307ad7b81ebc38a1f43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504454, "uuid": "9aec1ac1-4358-464a-9fd8-d8711bc325c6", "comment": "Malware payload", "value": "33e41be8aa94ca7ee00f453d4c8a506ecd2fcd4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504454, "uuid": "4397d216-fb9a-4b56-85a5-abf1fa78e0f1", "comment": "Malware payload", "value": "e68cd9cde112e0bf0a29f221f43c20b34fbe056ff1c8514a437839e04b3e81a7b5943d0d36db51e8557033b183bddddf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504454, "uuid": "fd5cfdb2-de71-44ba-89d8-fc1de89e25ed", "value": "T1FC444BD275C18870D5290B341874F97C863AFCE02B60CAAB7F84775ECD376D0AA3569A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504454, "uuid": "67bab0e8-0249-45b3-9387-746459e058fc", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504454, "uuid": "d66dc4a9-8bdb-4f2c-9e77-3241b9630f2f", "value": "3072:sr85C8DPpTBuBDYQ1nvKy18T93fU5tD9llsbPD7f0dqAp:k9kpJ90tD9lqbOqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504454, "uuid": "7993c4a8-5a65-436e-a802-718563863c71", "value": 258184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504454, "uuid": "18492c1f-c632-413c-8920-5360df4faad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504454, "uuid": "1582eeb2-03de-4407-ba08-6f7a9d3a16f4", "value": "a8bc0ded2733124535fab01fe0d3ba7a5bef7078aad81307ad7b81ebc38a1f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0152bab8-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503932, "uuid": "58f5b26b-78cf-458d-9804-5831213a0aae", "comment": "Malware payload (Socks5Systemz)", "value": "8b1d0ee0db9e97682fed19c521521ce2", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503932, "uuid": "b8897c40-2982-4963-8848-9a2a7e4291ea", "comment": "Malware payload (Socks5Systemz)", "value": "a93bb212bbf8ac7496b700d4c2d54fa3ae50d94f3883a5cb400c2617d51ba45b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503932, "uuid": "1b03e2ef-6f88-48fe-92a1-1a4519da629e", "comment": "Malware payload (Socks5Systemz)", "value": "a2ff9a289ec0c19aac5e1658442e9a1fa45bc1df", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503932, "uuid": "d3e46257-67c5-4384-b0c4-734cdf44e2e0", "comment": "Malware payload (Socks5Systemz)", "value": "58779f081b6d0e9042e2f293f39a0e779d3039ee5a7303e4bcfd60ec596414310a7c9632301dbe7705e4d96f7f05f519", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503932, "uuid": "6cd9d200-fc26-4e3c-845d-0545cf7f7e53", "value": "T1E8E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503932, "uuid": "0708a1bf-1ba9-48f9-8aed-a389423b10db", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503932, "uuid": "c859df8e-1392-444c-96b5-54792c630340", "value": "12288:HjsgiZdvAeRwE+acHr50cCdkBqu4cvpWwnqmTRKLiTOkIRpjH14kIiIjcBDQg5Ee:DsgwdvApTL50cCdkBquJvpfnqmTR+iTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503932, "uuid": "707b0a70-d72f-4ffe-9799-552497b90dc8", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503932, "uuid": "e62c4632-cbf4-4166-bddb-7a1253fa4c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503932, "uuid": "963cee6b-4f9e-4fa7-8031-adfdbcbf5816", "value": "a93bb212bbf8ac7496b700d4c2d54fa3ae50d94f3883a5cb400c2617d51ba45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7fd014-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509484, "uuid": "58094800-fced-4352-bd77-ca2dd9bd24d9", "comment": "Malware payload (Mirai)", "value": "613568d6239682d83541283a6333b578", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509484, "uuid": "6ca8789c-4640-48d2-835e-bf3743bc6ad2", "comment": "Malware payload (Mirai)", "value": "a9a63c1c7f0331a9ed76875a760f013ec0243f1e9bc020c5f9075961417636ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509484, "uuid": "37417a4f-3e10-4371-9c81-e5deafe61c19", "comment": "Malware payload (Mirai)", "value": "42cfe37a80243a08a1a0fa9c654a97b954940567", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509484, "uuid": "574e1513-cb1e-433e-9864-e335be79857c", "comment": "Malware payload (Mirai)", "value": "23e1ecdc9257e465e853b91e0c8c9134607ae2260f758356717afb8a0e07a6399e6132abb7abdc9c16ba8b6a2a067d71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509484, "uuid": "cd9a34e9-d5e2-4b20-a124-00a7755df95a", "value": "T10A83D80D7E21DF7DFBAD823487B78E219A5833D626D1C581D1ACEA005E7064E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509484, "uuid": "af204369-99f3-4e43-88d9-4686b46bb0eb", "value": "1536:YJcFgZRC592Xogr5Ot05rVQWQPRDOBQjw8Q4EqJa10Wd:uc0CfEoe3QWQPRDuQjw8QTq4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509484, "uuid": "81461b3f-ed60-4eb8-bbe9-1025add980c3", "value": 85636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509484, "uuid": "05670d4d-3937-4505-8318-d12a02490c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509484, "uuid": "f31208a2-a6d5-4a2d-b32f-788d9a922801", "value": "613568d6239682d83541283a6333b578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381dcaa5-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506172, "uuid": "2438b26f-6214-4075-a26f-5afad0184fed", "comment": "Malware payload (Mirai)", "value": "07c20dfe0f7c3ab366cea71cf8723da8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506172, "uuid": "f29d1319-c209-42a5-8191-44609bf1b111", "comment": "Malware payload (Mirai)", "value": "a9e901e70a8d9a48adb4947cbde7c561585c817fe9c45ae69d113d6bdc2cc024", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506172, "uuid": "79075379-ab0d-4f16-9955-5d2a4a1d0a73", "comment": "Malware payload (Mirai)", "value": "9bc6d56223d2dd0e78475738a96a3c8778e6997d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506172, "uuid": "3a7540ea-4988-4d09-80d9-78df0c8ab8a7", "comment": "Malware payload (Mirai)", "value": "50308d8467713a2afe578e7ab825965c2b20a05ed8afdaf087b70d94bcdc5d59e91a701c7bd94f136d26517573d09e8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506172, "uuid": "198d0335-7b15-449c-b96a-f93509a56c3a", "value": "T17413F886FC919A2BC6E0137EA6AE458D3321B3E8D2CF761BCD111F10369951F1DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506172, "uuid": "09d0f64c-d631-43d9-b6e2-b16a6e65ce45", "value": "768:GGlXvpg7+U6NdDuRf78Uqi8odOiUyl0hs1zJrYDoZ+WqpNzUi2ZvB:127FC9uRf/8oxQkYhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506172, "uuid": "8904d536-0149-4690-8d97-e0e2add840d9", "value": 42216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506172, "uuid": "2afb1abe-f4f2-4416-b5a9-2031e691b07b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506172, "uuid": "a5dec34b-8c70-47dc-bb5e-21e9f4bb9c09", "value": "07c20dfe0f7c3ab366cea71cf8723da8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e2cc2b-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503436, "uuid": "b11a7380-077b-4d46-ad62-222edf907e78", "comment": "Malware payload (Gafgyt)", "value": "d31b8c36a673261070ea56c3942ee096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503436, "uuid": "ef1a91be-9fcf-44a6-8f7f-1165268170ab", "comment": "Malware payload (Gafgyt)", "value": "a9f86cda10a859ca5584a1ea133ea44d6c15f0d689785894f3a9ff24b97ce0f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503436, "uuid": "234fba4e-b05a-41df-bfc0-e7a4d8f8e65e", "comment": "Malware payload (Gafgyt)", "value": "8350fff78e201052d1e7a03c3b99c5e4095b7a7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503436, "uuid": "d9ae2cb8-107b-4f48-b236-0b4c3fc49602", "comment": "Malware payload (Gafgyt)", "value": "9e1538533b2bf99109b64d01bf1c2c15d2422f00589ffd9644f88208566cb6cedfec12878c1d7e31c0c982b70c215a2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503436, "uuid": "ae19b1ac-1185-4579-bad4-60154d151d02", "value": "T17204B63E7922AB7EE268827107F76F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503436, "uuid": "8f78b0ce-0902-4dc9-93e5-fd8274795c55", "value": "3072:UhZRj5n9EmzUyMh65hWTt5s1qAuhmv8uqx1BVnKoe:mjrYZ65hWJ5Lhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503436, "uuid": "67c7e705-0d1d-43f9-9372-0e56a85d6881", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503436, "uuid": "67bd737e-66f4-4a65-9077-46966f15c0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503436, "uuid": "da302535-e804-45ac-91ed-421f5036ed0c", "value": "d31b8c36a673261070ea56c3942ee096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca32f83b-f508-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712512859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712512859, "uuid": "25c84f36-5eda-412f-8c0e-e45a9dff5770", "comment": "Malware payload (Rhadamanthys)", "value": "762a5819cefb8e1289c32cfd9fa05acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712512859, "uuid": "6692d51f-9fbb-4df6-9d87-c817211b4403", "comment": "Malware payload (Rhadamanthys)", "value": "aa1b1384dbf123607f6f63132f355e7486ccd67a0e03d3af2db40a333b70797b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712512859, "uuid": "eb0d080a-5d20-4711-b36d-635b17c1eab1", "comment": "Malware payload (Rhadamanthys)", "value": "06ca2001496e9f370a8f3b7c093b7a73bb0b95fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712512859, "uuid": "e6871ffa-b68c-4416-b9d8-260378f4484a", "comment": "Malware payload (Rhadamanthys)", "value": "d2123135dcb31881368ac8dbaa2c6b00504dfc51ceaa8c3f27079f8b29d71402ffac23eb5b944313ea1866ca5078e442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712512859, "uuid": "d2d58229-7fda-4c15-a20f-80c36927e131", "value": "T17274BF1FE653B0FCC52FC2384AD766726672B85A02307E2F1144DB352FA5C946A6DF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712512859, "uuid": "19851f25-07ed-4993-b519-4448d601b806", "value": "18fd2ce1df00a7be26265a61ffab0f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712512859, "uuid": "d835f91d-a0af-40e7-b9bb-42ffa6713868", "value": "6144:uhuyfs/3++Xzk4Iof5dcK+VNMUWGgcZmOgBtIllmtUbXUpUbsIKiSlx7ti:u2fzpIgeHVmHtClgBeA0EpUbsIrSBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712512859, "uuid": "e17f47f6-bb0b-4bb7-92d8-4750b8f3fe61", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712512859, "uuid": "fcb66303-b544-42a4-a3c3-37cd1a013124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712512859, "uuid": "87b43cf9-c491-496d-8957-b2e8f62e9317", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d168c27b-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503422, "uuid": "94bd4914-0eb3-4809-b017-7b125d7370f7", "comment": "Malware payload (Gafgyt)", "value": "24a80fec81da20f5d3127674bb158f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503422, "uuid": "0d2a77ff-0a81-43b3-af7d-2f5c4f064814", "comment": "Malware payload (Gafgyt)", "value": "ab0cb531b5676082871f053851d975f922c4d097cf95381e087b91f5440c8462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503422, "uuid": "41fc4667-ca6f-4228-ace4-8d704c3dd2ce", "comment": "Malware payload (Gafgyt)", "value": "ddcda155cbfde3491e0404add275569f769170dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503422, "uuid": "96f64dc3-496f-4664-af65-c7552369b639", "comment": "Malware payload (Gafgyt)", "value": "065c6a1d643f4712c310cd6a34705519b92d7f3e3459e29ec9ca84518cd803a21b6e44c692116c8541a3847da4ce5b81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503422, "uuid": "eb2bb62b-ad79-48cb-aa9f-55e2ef7bc8dd", "value": "T160244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB43FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503422, "uuid": "3067608a-0f03-4951-8362-c58137adb080", "value": "6144:FZzyacCwXJ4DbpW0v45hbL6+uM/9Ocgym0wfB5RyAn:FZzyacCwXJ4gL5hbvf/dgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503422, "uuid": "f1f15042-6514-461f-a005-e519761004f9", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503422, "uuid": "cd02600c-ce1f-4b6a-91d4-34e5488fac77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503422, "uuid": "203a34ca-635c-4587-b36f-6dc4cb30c26c", "value": "24a80fec81da20f5d3127674bb158f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396cd252-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504456, "uuid": "db5db5d8-b0a8-4723-8453-4c6931851a38", "comment": "Malware payload (Neshta)", "value": "9d3f66528459b13075bfc24ab992d0f2", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504456, "uuid": "56acd28a-9db1-4812-8714-a1afa560d577", "comment": "Malware payload (Neshta)", "value": "abe4cfcd6d8473bc1651ea3b7ff307dfe5d1edf9a87ca2fc666e6ea5c5e9cf6f", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504456, "uuid": "33afc0d5-9625-4657-8727-b1cc2f1110b0", "comment": "Malware payload (Neshta)", "value": "7013794cc020aeead10167ee709dd31e196f77d5", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504456, "uuid": "3ba0b11b-3964-42dc-856f-9558d13497ae", "comment": "Malware payload (Neshta)", "value": "cc91e0fa5e31662a13ed63a6cdf518cb68d874f17be71adda37f9c6fc75c6e5a12c44be7687153917b882054c37dfa1c", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504456, "uuid": "929b9e01-248f-4c94-8130-0924de0490ff", "value": "T1A5836D96F6A18872D0340EFC8C268229D47B7E317D6526B2B6F92E4DDC7D3D22D0D44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504456, "uuid": "31c28a41-52d7-4819-80d0-c1c5cf099487", "value": "1536:32xqjQ+P04wsm1gxqjQ+P04wsmJCcBXPLg7:3Xr8l9r85CcBXPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504456, "uuid": "7de463d9-c174-411e-8b7d-91edcf231b2c", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504456, "uuid": "86a04c5a-44c2-4352-936d-f3dfa2bec7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504456, "uuid": "4559f19c-7080-4e56-9122-d7703500f066", "value": "abe4cfcd6d8473bc1651ea3b7ff307dfe5d1edf9a87ca2fc666e6ea5c5e9cf6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0341e784-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503935, "uuid": "3740e825-fca9-4780-a834-eaaa50b91fb0", "comment": "Malware payload (Socks5Systemz)", "value": "202f367aaf8bdb0e6a18f60caa2d2187", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503935, "uuid": "0995cb50-b3f1-4d7c-a014-fb92978ffab0", "comment": "Malware payload (Socks5Systemz)", "value": "ac54423e7e16be35ad642bb865cfdc425488d9693ae8ca012d799d248e299941", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503935, "uuid": "582c911b-e68a-4d9a-be1f-8492f3653a41", "comment": "Malware payload (Socks5Systemz)", "value": "c69069bf05d7bc1a8794999490753c1378a773a1", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503935, "uuid": "725de68c-c9b0-4a66-ab56-1bf4e08c51ab", "comment": "Malware payload (Socks5Systemz)", "value": "4e25539a124240943480130ee9fbcb7e96baf51736dfcf72e65b3e459bbea0952d00eca02ca6d800729c994bb5225b63", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503935, "uuid": "13cadf3a-3c07-4483-a096-ba8581e17bc5", "value": "T1AEE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503935, "uuid": "51315683-894a-4c2c-ad88-23677369ecd3", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503935, "uuid": "0a9a80c3-9333-4b4f-8f36-fe7cfa4a36f3", "value": "12288:HjsgiZdvAeRwe+aEH/50cC9yBqiicvpWwXsm3RKLiTOkkRp9H3ckiiIjcBDQg5Eq:DsgwdvAjHf50cC9yBqivvpfXsm3R+iTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503935, "uuid": "89ee63e4-0edb-435b-8126-4c63d8a7965d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503935, "uuid": "091a6da3-e1ec-40ea-8dbe-c5a22b664d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503935, "uuid": "9c538e28-8d20-4f86-8925-ec694c0274c2", "value": "ac54423e7e16be35ad642bb865cfdc425488d9693ae8ca012d799d248e299941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1401ff2c-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517707, "uuid": "2e34c4d9-107c-4f06-ad97-61ab9a66b0b4", "comment": "Malware payload", "value": "0ea3637281e1501d446c197cee35acca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517707, "uuid": "bf1fe35a-f376-43dd-8bbe-76ca4070a2b3", "comment": "Malware payload", "value": "ad246d31f700421c308c7b517b50b6422d0f8e81b0a4b5a0edcb7c4431d3874c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517707, "uuid": "e41d3124-388f-48c5-8672-09ba7e8bcca4", "comment": "Malware payload", "value": "4915e2f4127a6a07be6110633fbfe9b1a3237f4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517707, "uuid": "f2420a55-e6e6-4f2d-bdab-39c754cdee44", "comment": "Malware payload", "value": "0286c73774cecc1ab481e0826a19ff2f7c8b0d03e3e8d62aaf50a8d4fc738c2b24d6565119bb610198bebe7ea1e75cf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517707, "uuid": "24834940-c0ed-4d93-84b9-97308372d524", "value": "T1A3733A47AD618FB7C157AAB625A719300713B8215F0B2B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517707, "uuid": "7dfd7601-8149-44f4-b7f2-fa7738dbb416", "value": "1536:0A2LGx8fROKy15wRG29pyEF9oCsZqEHmn2mj9VqYLe8f26e:/2GafvywG2Fo7ZqEHQ2mj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517707, "uuid": "7a6501cd-fc83-4666-9028-c0049f421b66", "value": 77738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517707, "uuid": "ee43120b-c347-4255-9832-9cdb7eaba1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517707, "uuid": "833482dc-39d1-4221-99e1-d6d8c551ed9e", "value": "0ea3637281e1501d446c197cee35acca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b04da3-f511-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712516402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712516402, "uuid": "7e1fe534-c9ae-48c0-af96-a184037a3802", "comment": "Malware payload (AgentTesla)", "value": "55f8831a8b5bb5868462b91fadf8f2c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712516402, "uuid": "b7063a88-e848-4c87-bf15-3b5c15f8723f", "comment": "Malware payload (AgentTesla)", "value": "ad6e0e24c2791245c085cb50b3722dbad5fc6bc40129e74780dc996d2984317c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712516402, "uuid": "113dcd4b-815f-40ed-9c70-e1bb17a29e74", "comment": "Malware payload (AgentTesla)", "value": "dfa43f0d6ea531d99268635bbb14307464bfdf00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712516402, "uuid": "9b523ccb-5f02-4e43-b669-32b75298e7be", "comment": "Malware payload (AgentTesla)", "value": "e98a4b3a09bda536d5e15a20c9b153f286478a86abf99fa327a1aa178265f024db0bf5ef8229eda628b48cc6c817011a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712516402, "uuid": "70c972fb-e3ca-4f13-90eb-b018913bc54c", "value": "T160A54D86B7A44F11E17E3B7904B65C362770AC12CB43DB0E4BD5B8542A337418F6AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712516402, "uuid": "eb549e60-25d5-47e8-8bdc-fc82c9921a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712516402, "uuid": "f4636504-c1cb-401a-867d-aac2ad8eaf9f", "value": "3072:ax7eBNaqU17pYkH+wWtai4GlIQZboLRi9ua/aHyvF3d2itMOwwwwsVqWAEaqE9qn:ax6SqUDr75GlVbANOwwwwswWYqEoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712516402, "uuid": "1515ae4e-4752-4729-8a39-8f5b8630612d", "value": 2184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712516402, "uuid": "56bcd444-0e74-42d3-932b-a37de73ea6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712516402, "uuid": "c428d147-8769-4b40-95e8-0e717da3ecc5", "value": "VI3 Operation Guide_tech Info version\u202efdp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6680285-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509470, "uuid": "d839b101-e9b6-43ec-a9ff-07bace9d0db3", "comment": "Malware payload (Mirai)", "value": "8cc0cdf62fc99a47b520924c39b869ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509470, "uuid": "d055b061-bcc7-40a2-9e69-def2032abc76", "comment": "Malware payload (Mirai)", "value": "adefd6b37ee3dc189916368a6070f1e6cc1480b4564c8ffcbc23d714cfeabc54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509470, "uuid": "df63db74-177f-442c-8163-f6ffa1b6b116", "comment": "Malware payload (Mirai)", "value": "f822213efb7a389ccff9e24d5120eb9555693c54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509470, "uuid": "64f93bfb-e915-476e-8b01-e04a0c68fc5c", "comment": "Malware payload (Mirai)", "value": "fb95da1e2346f1ba25b6e6115b643e17634b849a7e72b2194207b0da0ded5b5fb7465fffb460d1df67d8e155955182e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509470, "uuid": "a6325ebc-1424-4a83-b396-f805f762c077", "value": "T1EFB35BC4F683D4FAFC2255791027F3368B33E43A502ADA83D769AE32DC126519B1A31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509470, "uuid": "aa2e2b9b-bbef-4f18-b298-6762d5a648ec", "value": "1536:MDT1HnGuT9ZplJsQd6T1kRezWxNTnMGAZPHIFbsSPrg7x83zR:MDMC9Zj5i1aPxhnMNZfIJg63zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509470, "uuid": "b3a9d52d-6150-47d0-8161-328773f1ac59", "value": 112556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509470, "uuid": "458a6171-f751-45e3-8239-eac3991b3441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509470, "uuid": "5e70c519-fa36-4359-b2d4-2d27a0782efa", "value": "8cc0cdf62fc99a47b520924c39b869ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527f6a1d-f4e6-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712498055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498055, "uuid": "3eb977ee-41d2-488c-83fc-1e4798370ba6", "comment": "Malware payload (Formbook)", "value": "0912ee2e08bfbbe2527e14883b0de4dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498055, "uuid": "4297b071-1a7e-4d3c-8aba-2f4cd77a76af", "comment": "Malware payload (Formbook)", "value": "ae928336d75efb8288f9a6c3fa2d079f4ac8aa7aa73ae259ae41a6d25c842a4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498055, "uuid": "9515d0be-dfc9-43d4-b79d-a4d65ce61fd8", "comment": "Malware payload (Formbook)", "value": "e243c141f412fdebbd8aa3233106c7220bd9aca6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712498055, "uuid": "ea4afc39-23f6-4d31-9ca0-5465091c7c9a", "comment": "Malware payload (Formbook)", "value": "73ef3945f9a26f55573eedae6473cf9b732f5a5cf92019b4c3b696bc2dd51457964cfb91c6e30ade2b1cafbb61626574", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498055, "uuid": "6c9c23b9-b982-412d-9d2b-a58930977506", "value": "T17BC51203B65787B1C288177AC6D7150413B1E98EB6A3E70B798BA3E50E637BB7C41613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498055, "uuid": "3fcbe05c-6574-45be-9942-ec141b77dd35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498055, "uuid": "68304de0-8c5a-420b-9219-e03b45ab00b9", "value": "49152:cFTivkP8dDnQ8b9/F45WV/cHriZzjwQ7JweQcpnD+4ulR:8Ti3dDnRbT45WVyuZzjDJFQctD72R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712498055, "uuid": "92b166d9-df6e-49b6-a7c3-9ceeab891522", "value": 2521600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712498055, "uuid": "8e73cf8c-b258-48a5-853d-a303066d3f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712498055, "uuid": "ab319b35-1fb1-44bb-a0d7-31f56358a823", "value": "inlawBtyja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e38cf54-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504464, "uuid": "09bfa705-bf54-4c42-83d9-c989e59969ce", "comment": "Malware payload (Neshta)", "value": "055bfdb3fce32f98c360cc4f76c294b2", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504464, "uuid": "7e5bee35-bd44-4f79-b0bc-39d54296cfa2", "comment": "Malware payload (Neshta)", "value": "af6966d933f4dd1bb8bce9de2ecd41c627f867f1010bcc36f9e1a88a2ae95cf7", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504464, "uuid": "dadd21de-13ee-4e28-9682-120308e6d44c", "comment": "Malware payload (Neshta)", "value": "74140685a367283de3e4382b830e45e938bc515f", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504464, "uuid": "bde4db33-36f9-4618-8a31-5c605bc0f6cd", "comment": "Malware payload (Neshta)", "value": "2e967982b2e8f5d9d9acef3eb18532028cd2c6deb93af3d52b215916859fa914265e053881ea4bf46eb73857c946e749", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504464, "uuid": "3c286c6a-0820-4bdf-aa17-497a6a058ad9", "value": "T171245A41B6C15533F2210D784092F9649226BF658F296BD7C7A4BB12BBF11D2BC3236E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504464, "uuid": "5f46c9db-da93-45b6-ae03-7f96a23c7956", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504464, "uuid": "71081cde-1ef3-404c-9215-ddd6c3885fa6", "value": "3072:sr85C4y0kf1Y011IOtRrM4e8jSsTPSDyTIntMHcold:k94Gf1Y01OOt1CoSsrSDkIntXoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504464, "uuid": "7ee436a4-b726-4b1f-b005-14e01499d9e0", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504464, "uuid": "d99071c3-f407-4f07-8218-57df25b8a2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504464, "uuid": "e7ebe8ef-cb71-41d1-a4fb-15e78480ca20", "value": "af6966d933f4dd1bb8bce9de2ecd41c627f867f1010bcc36f9e1a88a2ae95cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e2fcf9-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712506576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506576, "uuid": "08c27d88-7712-4f9d-968a-df18e325698e", "comment": "Malware payload", "value": "81c79ba1dc66c3925e2e4e63a702b171", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506576, "uuid": "ceaf111e-535d-412b-a52b-210cef85c60d", "comment": "Malware payload", "value": "b06cbb2a8d46c63ee9546939f6dae9b1817a31fe36f12c18e24cbbfe20b9ac5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506576, "uuid": "8b9c2238-afa7-422b-ba4f-52cbdf520688", "comment": "Malware payload", "value": "efce509c18a83a9145a721b5e50c9a1038b9a864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506576, "uuid": "4ec3e0ad-70fd-40c3-b0a9-dcbe9c2b78c1", "comment": "Malware payload", "value": "33ff0f677c5e2b3e4a50684e7ffd571daea684b0c4ddc90fa8a32aff5634b7909734f2f11dce9664b00b9fd1e18f0a17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506576, "uuid": "5b46607b-f17b-4736-b7ec-453787a3466e", "value": "T143A38D8FB24B54A0C46247F00BD74FDE3E2762019E63D8FB6C0D567929762DB5D0AB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506576, "uuid": "33c82e53-7294-4499-9a55-f23a0f771e88", "value": "1536:42YN/NTueppyH2munVFEfOS2UGdZnkXkjfFmAhwqgqT3/LWK:42YNVp27yjE2S7knBjtmGwqgeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506576, "uuid": "b514b9f2-9e4f-4648-b558-218495a66d75", "value": 99716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506576, "uuid": "35a8f267-a152-4164-8aa6-a2f8abed9138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506576, "uuid": "5cf88af6-81d0-46ed-a2ee-e09e59dfd78d", "value": "81c79ba1dc66c3925e2e4e63a702b171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c28ea81-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712517721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517721, "uuid": "9d6452d8-2230-450c-8c3e-57195bc85854", "comment": "Malware payload (Gafgyt)", "value": "d5dd017c0348644965cfc7fbd8503543", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517721, "uuid": "a63568a1-6557-4ddd-b881-dafbbada7acf", "comment": "Malware payload (Gafgyt)", "value": "b0d330fb8d12ee1ac398f6ca66b6b1d7a38c18da5199d19f965d25d4cc4cbf12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517721, "uuid": "98b142c3-63f1-4c6f-8ab2-a6ea18b741a2", "comment": "Malware payload (Gafgyt)", "value": "7e64052660eb3a66a5d4ca061ff13720aec0c667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517721, "uuid": "a26240a5-1ce8-4f40-8716-e9ef9af59781", "comment": "Malware payload (Gafgyt)", "value": "9294a17eb3c8389714c8531199be5aff138a97bba446d5da3ed5a79fbe1122f24e887e8d3477639897498b667972acfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517721, "uuid": "51576b7a-8c8d-46bc-bec9-ea976ca58edb", "value": "T120C3F849A141C2F6D4830BBA135BF83B00FAAE6D551B5B6AB317FDF4C67B58132113A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517721, "uuid": "8ae467f4-e8f0-4f21-a748-fe52092dbfc5", "value": "3072:KiDxplJdXvP5KqDUP3UsqiCsFAMLln3p8rg+Z0Ua3hgp6W:FDxp5v5PiCePx3mrg+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517721, "uuid": "9c3a67bc-db83-4200-8839-4a3c58b072ef", "value": 120594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517721, "uuid": "db6cb3d7-821e-473a-80bb-c10eba235de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517721, "uuid": "a1f510b2-72da-4105-bfe9-bf0928bd4475", "value": "d5dd017c0348644965cfc7fbd8503543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0048df-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504465, "uuid": "4280e333-8a4c-4f7f-a3c4-0b4431dde0e7", "comment": "Malware payload (Neshta)", "value": "36c6fed909d66f0730d50e67d24503ff", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504465, "uuid": "8bdccd75-4c5f-47af-8b9a-ddcd3f7a7b84", "comment": "Malware payload (Neshta)", "value": "b1022de156b8a5459275c327276c702a3bbd381bb896bcf4be73316807af47fe", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504465, "uuid": "00ef4dd1-666b-4db1-a15e-da7547044c18", "comment": "Malware payload (Neshta)", "value": "33f53e54bb9ecbed563ba0af7f5a25941893136c", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504465, "uuid": "f217373d-63e2-4e2b-b286-4aac0b360041", "comment": "Malware payload (Neshta)", "value": "20ea83b60f2c2a778b060d5afbf64bb2ec2cde59c091af7957ef7c451314e3284796dab92d29deec13c6185300448938", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504465, "uuid": "e08a4752-c8a3-4d6d-8721-1fac9a9b6dfe", "value": "T141836C52FAD19871D0251EBCCC29C228C57FBE317D291AB27AE53E8DDC7D2D12A0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504465, "uuid": "9f21a551-0ca9-4441-8b9d-3b373c6538b0", "value": "1536:32xqjQ+P04wsm1RxqjQ+P04wsmJCcBJ0:3Xr8lkr85CcBJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504465, "uuid": "082d6a70-1a3a-41a5-81fc-5b407907b2e8", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504465, "uuid": "ba4131e1-081a-441c-ae5b-33aabd066e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504465, "uuid": "a16163c7-0070-42ca-a17d-3ce1ac4b7366", "value": "b1022de156b8a5459275c327276c702a3bbd381bb896bcf4be73316807af47fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d90573-f534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531483, "uuid": "9a090bc4-0ff5-43a2-b328-56d6873588e4", "comment": "Malware payload", "value": "16408417d89c6804a59879ea1f76aa5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531483, "uuid": "2c3508b2-9f27-4e6d-be32-961c1faf6ac5", "comment": "Malware payload", "value": "b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531483, "uuid": "93709da4-c24e-4de6-b8ba-1f06cef15dfc", "comment": "Malware payload", "value": "8deb90f11f3596dbbfadeaa05fd5b40567a6d60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531483, "uuid": "48e242da-d81d-440c-935b-c0d9aa7f1246", "comment": "Malware payload", "value": "3b3135dc3b6f3f885b78f8cfad8ff840886fd1a81f63c424d9c15bc4c603314994a4e1f69fed512dad3b88abba464cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531483, "uuid": "fb73699d-0197-4c18-84cb-c398670ee15a", "value": "T145B5293BB2F04828C49EC435E69BC1632E3574D8572035BF6A88A8743FB6D79267E711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531483, "uuid": "02535bcb-4933-47d6-ab90-cbe300a0c775", "value": "49152:bS/NynNpMzIRSbY/LZgveQ6HCPxJ1QPY3Ng4zBjI1X:bSZiLOzxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531483, "uuid": "d1aa35ed-c416-404d-a7c0-e7f92ed4a853", "value": 2287960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531483, "uuid": "8a49deef-85db-4e31-96ad-301f4374d779", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531483, "uuid": "f3c68035-7823-4ced-9087-9a8169784908", "value": "libsystemd-core-255.4-2.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e8346f-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503940, "uuid": "508edc4e-435c-4e4e-bb16-74dae2a50cac", "comment": "Malware payload (Socks5Systemz)", "value": "00173d500f75b4b90fd822245f154e95", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503940, "uuid": "519268f1-b904-4b3f-ba09-aaacc6edfbcd", "comment": "Malware payload (Socks5Systemz)", "value": "b1e5b6f34487ddb3d80d199344b17165acdf29134791731dc0b8752b63efcb2a", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503940, "uuid": "3490e716-3907-4593-96a9-ddecafa1a027", "comment": "Malware payload (Socks5Systemz)", "value": "450d77446e5619aafee96759df6342d60d682225", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503940, "uuid": "72d16ef8-0c24-4d8a-9433-c81c4de8377e", "comment": "Malware payload (Socks5Systemz)", "value": "db4a64530ca1ddaa0fe4e2a7038a7a542d20c351da4c2933808d2f9f1153e11ad8608664e37273b57e6d866bd8685eaa", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503940, "uuid": "0779b7fc-a757-4740-a388-65be6615382f", "value": "T122E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503940, "uuid": "5a095edb-7b09-4af1-992f-a87fbfcfadb1", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503940, "uuid": "89166e51-290e-437e-b83a-2716905d3d96", "value": "12288:v+XssgiZdvAeRwEc+a8HxsTu9zO0trWDNx04x090OjjI1Y4hwfS9wDjxC657Rk2Y:LsgwdvAkhzRsTu9zO0trWDNx04x090Oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503940, "uuid": "3f99e1b0-a3a3-444e-b5d1-e5cc0064d41a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503940, "uuid": "5a85a4cb-1623-409f-b837-229c9b7e9cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503940, "uuid": "a2bcfc99-5647-4e37-956a-25b29095410f", "value": "b1e5b6f34487ddb3d80d199344b17165acdf29134791731dc0b8752b63efcb2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7306572-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503432, "uuid": "6493a953-3577-4fb8-8018-376cb3db5a04", "comment": "Malware payload (Gafgyt)", "value": "5d0810c88e699b31174d86b38456e8d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503432, "uuid": "59a95eab-da85-4d78-ba3a-a52f56202895", "comment": "Malware payload (Gafgyt)", "value": "b20c599396456a7078c71ba8a3581e361c5f8f4868ca85111ca047bd7dafeaa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503432, "uuid": "a1b2e64f-ab1b-454c-88cd-ff98863cca05", "comment": "Malware payload (Gafgyt)", "value": "daf35e55616318b18e0fe5c0bda343447c56a760", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503432, "uuid": "7182e567-5383-4f2b-a89f-1fe92998afda", "comment": "Malware payload (Gafgyt)", "value": "42edc97ea43ab9e47b711e084930324bfcbc60508a9d5c4c83e21c7e16740dec101affb25540e63df5be3d11254051d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503432, "uuid": "595ecd47-f4d2-41a0-bdb9-7cf1bc29f2f1", "value": "T1EAE32A24F8404767C3D323FAA64D879E7F3517E623CB33116A389DB45FC2B992929960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503432, "uuid": "bf14ccb6-0203-4114-ac79-0fd24bc55c65", "value": "3072:6hlLp1zWvkO0PXs/DiW1VrdY5hn8eoadVjkmOMDQ4DtsL6Qse:O7J8/Di2RY5hn8eFkmOMDQ4DtsL6Qse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503432, "uuid": "205e56b6-585c-4aea-9c7a-a81e4ca7a400", "value": 149019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503432, "uuid": "a5f12f38-7640-4c05-82da-50491aacb747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503432, "uuid": "08272482-15fd-4598-b2dd-d926e5a629e7", "value": "5d0810c88e699b31174d86b38456e8d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33a6205-f4d9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712492688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492688, "uuid": "3b4da2b1-ec76-44fe-9fe7-b8a8329645d9", "comment": "Malware payload", "value": "e8aa9ae55183c580e876bafd7f0c9ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492688, "uuid": "4ec164d6-a3bf-430e-a6f7-360ff00ed1ef", "comment": "Malware payload", "value": "b27ea67210985f92b8e0ad76b5e9fd7d75eecacb5bdb80ec5a3fadccf5b264e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492688, "uuid": "323c8775-c6ea-4625-8c60-7da148bac9ef", "comment": "Malware payload", "value": "0568d08a789c068f2cbd87cff54c293639328356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712492688, "uuid": "f43b00a8-caa1-4e4a-b00d-14e004440970", "comment": "Malware payload", "value": "91bac47d975106854b7cebe427871bc64d9f5ecae2783687d2205f9927ce251f05c68df071def573f16041eb82ec3798", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492688, "uuid": "01f3db83-6934-4beb-b98e-09382b7f8564", "value": "T12FB633488F74B54CE58F4E72AAEE83E4623F36D44AD8B66B1F08457D73754C8A8076C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492688, "uuid": "496df52e-de60-486d-9036-4ccdc9e2acec", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492688, "uuid": "c7261f1d-853d-44e0-98cb-c7e4d71ba252", "value": "196608:IPIQYn1/tsrEWqzQS10EN+Ok0SqFTKxLGbBLEX+738KUSJ/bLLtSOXvil:IPE16raMqt+nIFTKsbBU+738itbLpil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712492688, "uuid": "8f76aa67-5574-4b5a-8b07-399c33c6c310", "value": 10795256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712492688, "uuid": "8c7fd7e3-eb9d-4c52-85d1-b3f15759490f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712492688, "uuid": "9686756e-cd56-45b3-8ee0-5c1b57af1932", "value": "SecuriteInfo.com.BScope.Trojan.Winlock.25680.23522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fec8e84-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712504467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504467, "uuid": "9e8ce5df-4696-4f5d-ac10-96ce256472a7", "comment": "Malware payload", "value": "b02e422f59ab51feabcb5e723abbbc35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504467, "uuid": "8945d924-10e2-4989-a690-7b4bfb6ec2a1", "comment": "Malware payload", "value": "b30f0a106212067537362c8262c7dea8bf2eea56688c0954660218e6a0961217", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504467, "uuid": "6b35732f-d40b-4b03-8fc0-6362d77f4302", "comment": "Malware payload", "value": "2669b2122ad2a8d7184d1f8cc63e4c485c7dd915", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504467, "uuid": "de33cf76-56a3-4fb6-938b-3f239d18cffa", "comment": "Malware payload", "value": "af8150354ebf4b48c0353f21145179b24daf5ab005352e0144035a7854dc1c4cb69905f6d1c36c0a8071e754adb32a49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504467, "uuid": "9eb610d1-3a50-49e4-ad92-dd27a7148902", "value": "T14B537E32F7F0C470D0314E78881141B2523EFD216AB95D6B67D81E1E5D3ABE05A3DAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504467, "uuid": "402e3139-d2f5-4c82-a2a9-7b5933a09316", "value": "768:Fzt5AQl/EMQt4Oei7RwsHxyP7nbxzOQdJPu0YiQxah28Iwuu9+hiWrQxR7oolsa:FztiQ+P04wsmJCck42G/9+Mz7vsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504467, "uuid": "d64fe5bd-ca6b-404a-9d6c-a3d6b26e16cc", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504467, "uuid": "8b8b6d73-3bc1-43b9-8bf1-52f422e9d81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504467, "uuid": "cd96186a-afeb-45f3-9094-36da072b6b4f", "value": "b30f0a106212067537362c8262c7dea8bf2eea56688c0954660218e6a0961217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa843687-f52e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712529261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712529261, "uuid": "97455720-0cf2-4aed-a4fa-0032be7ed33a", "comment": "Malware payload", "value": "406f5e63243a13ea32988862ef5cbbe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712529261, "uuid": "3cdbe80a-f4d7-4c23-bc5f-5842a745c88d", "comment": "Malware payload", "value": "b50a24fe7d0efd0f3463d8971633544475739bfcac06a79112739f03149f674d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712529261, "uuid": "0b5fd2b6-6e20-42e1-b7f9-759c363ccbb9", "comment": "Malware payload", "value": "6c548f7cfc7f65ed9a4fb1b33978fa6ee26b0167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712529261, "uuid": "6bb74806-6687-4d54-9367-5f8404a9a746", "comment": "Malware payload", "value": "c22124f4514dbb4a16d7c34a61acaa13ab478d91febdb0ceb4de570575517c3cacc6d6971af6194230f3cdc78ead6c86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712529261, "uuid": "5c3ee978-e31c-4c22-b551-4b0f94a9b2b5", "value": "T1A6D53324632C56A2CBFA99B4F050AC1497F4DEFE9592D79A3C54B0F94C73352039B22B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712529261, "uuid": "b2ecfa03-5dc0-48b9-887d-5bcd5fcc83f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712529261, "uuid": "0beff41a-6377-400c-8e48-bc845b15f526", "value": "49152:mSmU1mSr8th1CFa/ywP2/QLaLG2ewo+u2lIH55VlGPszxTy9xUbRUpBYY:9fru7X/v2/KF+Xl25DMPszxSUbSp6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712529261, "uuid": "fa9835fe-7c2d-4913-ac8b-a7d05bcac354", "value": 2836584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712529261, "uuid": "be348671-0795-4d92-99da-7ad6730d1f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712529261, "uuid": "1a193572-d855-4a47-a713-23b5912aab38", "value": "406f5e63243a13ea32988862ef5cbbe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0961d5ea-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503946, "uuid": "8a771231-2f48-42af-84e1-8cc611cbfd68", "comment": "Malware payload (Socks5Systemz)", "value": "cb80e2b6ddc9ac4f7cecafed37c4c05f", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503946, "uuid": "6909d353-89f7-4805-919d-e6917e219f61", "comment": "Malware payload (Socks5Systemz)", "value": "b64156d6e16de5a14f759b75ddb3c389de8d8ad7929379bd00de8cad13df39e2", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503946, "uuid": "18e22257-fbb4-4ce1-8d46-956ec2d1d013", "comment": "Malware payload (Socks5Systemz)", "value": "e10a3dc527ffc46b86cfe717a2271d15504e1881", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503946, "uuid": "de787031-612f-4486-8e6f-e8f112765342", "comment": "Malware payload (Socks5Systemz)", "value": "5c9d4849b97962843dfa1d833ed2add0ab46fed6d2095bd2b369bb923a9e0fe464fe5b916ea2ff5e153364b23708e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503946, "uuid": "7bff7ab6-7253-46fe-9fc5-debed06c1470", "value": "T13BE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503946, "uuid": "ffdaef2d-ff02-4b7d-9184-56eddfc5fd2b", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503946, "uuid": "2557e890-4d32-4095-bf6f-0de631d318c8", "value": "12288:HjsgiZdvAeRwZ+auH350cC58Bqy0cvpWwX+mTRKLiTOkIRpvHdUkgiIjcBDQg5Em:DsgwdvAwtX50cC58BqyVvpfX+mTR+iT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503946, "uuid": "9282aa81-de86-40ae-b3f0-beed3867017c", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503946, "uuid": "f3ba718d-024c-4515-a6c6-7820cbca9b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503946, "uuid": "8ec5193d-8033-451e-a2fd-e81d8f16a7a5", "value": "b64156d6e16de5a14f759b75ddb3c389de8d8ad7929379bd00de8cad13df39e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1551a009-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506543, "uuid": "5e4e3764-573e-4bac-afb4-841e3b742055", "comment": "Malware payload (Mirai)", "value": "429df9fea445b9d4deaea4ad9155c390", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506543, "uuid": "ad365657-c07c-4516-86c8-d7be31e43f0d", "comment": "Malware payload (Mirai)", "value": "b6b47c6fc8cdcd0cd26afa13bf867e3eefb2715553d68f3828cf7bc053def6bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506543, "uuid": "b1c3b08d-2d8e-45dd-bfa9-0416ed4d6088", "comment": "Malware payload (Mirai)", "value": "347ef9686ef8bbf678d07bd6284db2862182a84d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506543, "uuid": "f3cddced-069b-4ec9-95bd-f7c802961710", "comment": "Malware payload (Mirai)", "value": "822e12047492f6f33c93b9e5fe7c1dcd4db8266e95d78743eb6e4272d93c09db375a8fba3f887dfd813f462b6eaf51c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506543, "uuid": "cdcedc01-3a9e-4e41-bf07-c3d250249802", "value": "T1CF432A86B9C18E12C5D4137AFA6E028D33136768E3EFB3179D106F20378696B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506543, "uuid": "d611552b-56d5-48bf-9b77-5ca828224e88", "value": "1536:fwundLSQrdMAWiUmH+Fj8K8tW7gV+uz7IoixcN4a4K9:fSWzWzjUtROcN4a4K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506543, "uuid": "b22e9d6b-3b52-40bc-8654-57ac89cfdd06", "value": 60144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506543, "uuid": "5ceeb33f-fd84-41df-ba8c-58e872e4f427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506543, "uuid": "1fec6f2f-5675-4feb-9d75-951a25523fca", "value": "429df9fea445b9d4deaea4ad9155c390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418bd96e-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504469, "uuid": "3531eda6-287e-440d-ad1e-f75d7aee686a", "comment": "Malware payload (Neshta)", "value": "0839ac768540ef1307b9e623a818737f", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504469, "uuid": "928b378f-4ca9-4068-9a63-c68343212dee", "comment": "Malware payload (Neshta)", "value": "b72b5c2e565abb02a8f0d05df2ede98bffff9748dc52731933da812f9900a9d5", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504469, "uuid": "0778354e-5bc5-4750-977a-0c79195f232b", "comment": "Malware payload (Neshta)", "value": "d813ad2cfedb6d7197fdc4ad92ea383fb5db55db", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504469, "uuid": "5e33a691-d656-4485-98c5-f606fb5da35c", "comment": "Malware payload (Neshta)", "value": "991a98fe45c77285c280a9ec590f861cdb61fb5dba7aff20301973d3a735d0a971c4417de992ed0b71e26216df38063d", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504469, "uuid": "be010b3d-9913-4f0b-bf2e-f6eafbdc8cd3", "value": "T19785AD0166A5D03AC6C75A74A80D322FF67513488B758CCFBFD50EBA8D61EA05F3E261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504469, "uuid": "0fac7ad7-b664-408b-9d5c-61a19bb6f6a7", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504469, "uuid": "d08176bc-6ef4-4485-9a55-6a92f5fcacd2", "value": "24576:t0OVyk+cwx7gqWRni845RaZiZOCv3b5iYma7/ZJ1YcL4CJXpOoCnW1YDHoDr8PkS:me5idDCvDZwNp0NZ+j3yu49dcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504469, "uuid": "75bfdf2b-610b-4079-b507-a787a19f6327", "value": 1790464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504469, "uuid": "bddba57b-7838-4952-b8b4-ae72d652af5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504469, "uuid": "83cc6a72-87e7-4f8e-8016-464a57f3cee3", "value": "b72b5c2e565abb02a8f0d05df2ede98bffff9748dc52731933da812f9900a9d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a6bbed-f4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMoon)", "timestamp": 1712505178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505178, "uuid": "daa2b22c-cf76-4b47-a21c-b81602be10f9", "comment": "Malware payload (BlackMoon)", "value": "b08ea51a6e03d69be9c15c7f841719dc", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505178, "uuid": "9901d2b0-db15-40b0-9935-e406dc514b7f", "comment": "Malware payload (BlackMoon)", "value": "b796e5c5174e6aeaa5592c8fdb2bf57102415b0afca189b37f5836f27feaaad6", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505178, "uuid": "a935cda7-df03-42ad-ac8d-ae9b2c141e7a", "comment": "Malware payload (BlackMoon)", "value": "fbbe7547a95b4f656abce6ff6a4738d2925d249d", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505178, "uuid": "a96df07d-1082-4cc8-bda9-99ae2bb6d524", "comment": "Malware payload (BlackMoon)", "value": "ef5f580befd6c0c69aa2305a748f834280d353ac1494ae4a5f7a053b332f49c671cb74636cbeb6e3be6fae2db1fee45d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505178, "uuid": "03862036-ae5e-472a-a092-4933064f641c", "value": "T193A4D913B622A495E11457F66BFA073869B8832438B1CD13EFF0CDB2BD71671875A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505178, "uuid": "cc76fff6-e0cc-4865-a5fe-36e6db444f8b", "value": "dca55ab828881de2079e4e62880ac2fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505178, "uuid": "82bd4f84-3afa-4f6f-8ca5-eb2c7980a8fd", "value": "6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAx:xgXQKSLpOCtV0R8xMSaAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712505178, "uuid": "38f840fc-bcca-4e22-b26b-b55e181dca42", "value": 451198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712505178, "uuid": "ca939538-6503-4382-8e71-f3e465188f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505178, "uuid": "d56a5e4f-07b3-4b16-80cd-1dcbabb4f6f9", "value": "b796e5c5174e6aeaa5592c8fdb2bf57102415b0afca189b37f5836f27feaaad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42963fd5-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504471, "uuid": "c35ba160-eac4-4e8c-9939-165603a911a3", "comment": "Malware payload (Neshta)", "value": "ab2b37d75b61a76cf411323c9881f4b9", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504471, "uuid": "475803ba-03b2-4af7-ba75-e734e8b7f44e", "comment": "Malware payload (Neshta)", "value": "b7cf106c7e3aa701d363bd96b4d32e7e0c9d795c571a8d1267dd58e568022c1a", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504471, "uuid": "479e6e43-2a94-4d46-9ce9-b87016c3c92a", "comment": "Malware payload (Neshta)", "value": "51c8b0e275400851ace0141a7e519fd3f91dd480", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504471, "uuid": "e8ef165f-ae48-4789-bdca-ca785560f279", "comment": "Malware payload (Neshta)", "value": "559145f6fe197aa3be1b9f68a10837c6f27ff7360bc4055f9db021376803b5a850d88d22b58e9e42a2fe55f3a7343977", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504471, "uuid": "4df74220-7b2d-4c41-8c12-1d1e6ecc9921", "value": "T1DCC35A13F2A284B1D6211A30887BA7F48937BD265B30879763A4FE5E7C752D12D3931B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504471, "uuid": "5d4575f1-87e3-42e4-8df2-debe68e1bbbc", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504471, "uuid": "f9fabd86-8fef-4b71-a8fa-a983a1718e3a", "value": "3072:sr85CzZjAwkpMwLJHZeveV8kQPu4lI5w2HgaH12m4029ZY:k9VjAwCMwxZesg212m402S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504471, "uuid": "382ee401-bbac-4b29-b888-346b005e51df", "value": 128904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504471, "uuid": "ef5b6d8e-6ada-40e7-ac9f-e2f320d68687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504471, "uuid": "7f8d5e74-7890-4295-933e-c7b262ad9352", "value": "b7cf106c7e3aa701d363bd96b4d32e7e0c9d795c571a8d1267dd58e568022c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb0be1c-f4a6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712470828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470828, "uuid": "5fa53789-96b5-4b31-bdbd-4bfe34938bfc", "comment": "Malware payload", "value": "d47a3d541e1cb2649eeb4368857a2528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470828, "uuid": "0bc801ad-c38d-458b-a86a-a16cbf8b88dc", "comment": "Malware payload", "value": "b863cbfc83155f0912ea4db876970e95cc759de06ce8280b26da3e5431d6b918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470828, "uuid": "1ca4f4c1-a1c0-487a-8382-3bf315cf356a", "comment": "Malware payload", "value": "0e1eeadd516c0eabd5c386965b9ec8adb43f58dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470828, "uuid": "cd3d9508-5fc7-4b2f-ab66-89deff84ab7b", "comment": "Malware payload", "value": "d78b7be7ffe824a2d6f9fb04f7cf2bf5d74b2699b37dc0b13da136cd72e516d7c1c70fbe0a93706fa178297c2faa2871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470828, "uuid": "e71679d6-1e6e-42d0-8a65-44d5388a0381", "value": "T172A30204B3538B71E5A28EB521A1710292F0E7DDF0146F3E6FA6C0ADA9257F4F4C6A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470828, "uuid": "4b7cd12e-5fc7-4b98-90ae-f8b2ce25b19c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470828, "uuid": "0ac3f338-25e7-4709-9c53-714eaf692768", "value": "1536:LLuM8UjfAtO0Nl/i6NKpGTg4h4rJTZVqf74AldVZOH1xoEWJ+GLFXNtdD8aDrCvp:GM8UjO/lxLh4rJs04d2xoEE+GV5qPdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712470828, "uuid": "d9d37f43-1de9-493f-b765-6ccc3e94bb0b", "value": 99338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712470828, "uuid": "b939baea-6cb8-40e3-82fb-4a0d0fd24e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470828, "uuid": "bc0257ce-aa13-46be-957e-ffffb271be30", "value": "Loader-trimmed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a70cf9-f514-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712517712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517712, "uuid": "6cb03f11-486d-47e1-9dda-aab4e7bf52e3", "comment": "Malware payload", "value": "e46870e81106540f51572f03f9952101", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517712, "uuid": "1b3cab03-6d14-452b-99e2-9b45ef3a2134", "comment": "Malware payload", "value": "b8c6a50617fdfe15c48c716f1d5a5e32830bdc51a10dea6fad5348970e9b6500", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517712, "uuid": "f825a5f1-920d-40af-b899-ec77f71971c1", "comment": "Malware payload", "value": "bfd6d797ef7258335beb7bcae6661d8e07317bd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517712, "uuid": "fdbb78eb-451c-4cba-9f3b-ee8be4b9f5b7", "comment": "Malware payload", "value": "5d8d87e1992bf34e249d438be1239f8f6374322544b23ffad137e1c1189d5c0dc0ddf5509d00b238e32d5952193b2c34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517712, "uuid": "e878aed7-5026-47a5-b0f1-64123f33fee7", "value": "T14904412A7770AEB7F94EDE3B02C95601108C9D890ADE6F6F7365E928E35A44F50E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517712, "uuid": "ded5ff86-b91b-4e5e-8b2a-ff1dd60eef38", "value": "3072:MSva4h5CmnLCa5/x3EM3WdyfiSDEoeuYcSDTyf+lsqDpyi88s:MSvaa5CqLCa9x3EM3WEfiSDEoedvyf+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517712, "uuid": "bc05b85d-e780-477a-9fb5-efe57695d8fd", "value": 181857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517712, "uuid": "c6465a85-e69c-4b74-b69e-e52645402c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517712, "uuid": "6db5879e-3bf7-44ad-af78-016b2253bd93", "value": "e46870e81106540f51572f03f9952101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437f572f-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504473, "uuid": "3c142622-3bbe-4d35-8bad-a9f3733b34dd", "comment": "Malware payload (Neshta)", "value": "00d44922e52b9c2cf93da2a1d845ecf4", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504473, "uuid": "3a02eefb-b821-4bd9-b60a-e8bbad8f04c3", "comment": "Malware payload (Neshta)", "value": "b8dc88b2155d66689519ab24ebf5f12f423fb218390753fe627454442de44f48", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504473, "uuid": "757de679-f81d-49a5-b3aa-41340e72ccdb", "comment": "Malware payload (Neshta)", "value": "33fdb9bfda5e10d44ed5e9424a4f6cabdab700d8", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504473, "uuid": "270347bf-712d-4bbc-be51-e2e1dae13f4b", "comment": "Malware payload (Neshta)", "value": "3a1f82b5383a633b741184acfc4bc8b50cc149f05ea1e78b2f9a6339e107e00f725ee9cfb1c8009e2cf8a363077b80ad", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504473, "uuid": "75afb7ae-a39e-4411-85eb-9b3e13d5b061", "value": "T1FE645B12FAA1C433D1728A7449F767BEF375ED20DB225AC363D42F2D1CB61905A39226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504473, "uuid": "656c964c-99b8-4e69-a6ce-d6af95426c41", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504473, "uuid": "894974f2-532b-4821-a476-f03117886895", "value": "3072:sr85CAMjJ6uHug5dtMIMSp+oZL41ArgecwRsqqxMdIvXnKNFWj7F43wGC1leTwwj:k9AFuuXoq1Argrpqe9oFWQWlqwWlqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504473, "uuid": "c73ca833-4494-4d1a-8e2d-3ec80c13ae19", "value": 308768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504473, "uuid": "30a036d6-f3d7-4eb2-b08a-fa77073a8d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504473, "uuid": "8e8cae7a-1605-4583-91ee-dc124dbdb609", "value": "b8dc88b2155d66689519ab24ebf5f12f423fb218390753fe627454442de44f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f072b1ad-f4a6-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712470833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470833, "uuid": "ce4a236b-32f9-49aa-84a5-36c7f0d54901", "comment": "Malware payload (CoinMiner)", "value": "32f964df5a996e71d13153ca4fcabf2d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470833, "uuid": "026a46f3-763b-498c-a29f-5b2ee617c05c", "comment": "Malware payload (CoinMiner)", "value": "b976fa8e93ac5ef246e37c38d398603f0f1c84195a7450cf133e141c383843be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470833, "uuid": "ffa7f7bc-a40e-4d19-94d2-41917cc41895", "comment": "Malware payload (CoinMiner)", "value": "feae27881fb84c176ebd8718ae58a848d2307509", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712470833, "uuid": "7c0294d9-a46a-4051-8acd-5c399862b92d", "comment": "Malware payload (CoinMiner)", "value": "4629b3e0eeedc30e57b05859ca4ccea3988c1e84fbecffb70ab3ef477bf438ce53dad93a628c965b3e7e72aea4b10ff7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470833, "uuid": "55394fbd-d549-455d-a7d4-1f73757c5c68", "value": "T148B63385E6B25CF0E0528078C4EA9464E13330B717B9C69B47B5A0EA1F93997B83DF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470833, "uuid": "d84bf2da-78df-4a3f-bff6-ab56550ae641", "value": "8cab86c0c05962691d7150b4577bcb22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470833, "uuid": "434e5192-4294-4e52-8c54-c795f3d9ae6f", "value": "196608:+R1pcBDzf4LBIP6k4FMIZETSejPePdrQJ/BFhnnPv0kRu:Afszf490RQETSevJLhnXvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712470833, "uuid": "6c51ed48-d437-4eff-ae4b-f81b5856d0b9", "value": 10629179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712470833, "uuid": "e20ded04-5bc6-4c7e-b8a2-b14cfb8017c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712470833, "uuid": "61b45203-5d7b-4491-bfc9-90d5c065fe43", "value": "Arceus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6a73cd-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503947, "uuid": "731df235-d030-4656-97e0-8ccb72717971", "comment": "Malware payload (Socks5Systemz)", "value": "706e2294790fca2414922af0384b2ced", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503947, "uuid": "7d25d2ed-cde3-45a8-99bd-a5489f8135e5", "comment": "Malware payload (Socks5Systemz)", "value": "b9ceaec0361ebc4035b87cdff0b57e4d73fe9b00e9aee0ca5f125d6538b85c4f", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503947, "uuid": "0b39d542-0e89-49a9-b637-15ae64dede7f", "comment": "Malware payload (Socks5Systemz)", "value": "70b058f56fc5f43e2ceb69406039b83d6540a405", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503947, "uuid": "2052ea3b-982d-4bd4-ab73-7d3d341530a2", "comment": "Malware payload (Socks5Systemz)", "value": "842a7b85c85d6ab603fd1db97fb0be7778e133d423a05838bbcadfabbf1ef672661f7ef1a05727139b105250c41435fe", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503947, "uuid": "85cda035-95ca-48c2-a6a1-08a7fc3a94fd", "value": "T1B3E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503947, "uuid": "45382347-89ea-41e9-b604-6f0dd15692ae", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503947, "uuid": "13a955a9-88a3-427d-8891-696f4c1e8cab", "value": "12288:O+XssgiZdvAeRwM+aKHPnYu9zO0tyWUNx04xO9QOjjI1Y4hwfS9w8j4S657Rk2kx:KsgwdvARVvnYu9zO0tyWUNx04xO9QOjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503947, "uuid": "3d6602ee-be95-4245-a561-535c6a29f937", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503947, "uuid": "40c622cc-0639-4ccb-9e1e-3596a74cf0cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503947, "uuid": "5fc8af26-0c84-4086-9529-3d722694bd77", "value": "b9ceaec0361ebc4035b87cdff0b57e4d73fe9b00e9aee0ca5f125d6538b85c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37b15c6-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509466, "uuid": "be926320-32f4-41a2-9dda-052f02ab04cd", "comment": "Malware payload (Mirai)", "value": "17093c48a228239ff92bab6559f68dfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509466, "uuid": "4aa82370-6394-4381-8420-01390f880c39", "comment": "Malware payload (Mirai)", "value": "b9ed5d08de9e1724f08d7eaa8b5b69b91f195bb75680f335e9bc77eba4198adc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509466, "uuid": "f8b470d9-713e-435e-a2da-b7a61a327f68", "comment": "Malware payload (Mirai)", "value": "b25d1f5cce0c6c6885a25b1e7caadf875b944797", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509466, "uuid": "b7af062c-3b63-4b75-80ac-defaeaa8e49b", "comment": "Malware payload (Mirai)", "value": "6a31d5760d6325834be19b0c47095a44799c1146bf147cf5eac61ae296e8cebacc681d777cd595e63d5afee52f0480ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509466, "uuid": "d02553ee-5c93-45fc-b929-9f059b887eac", "value": "T14AB3ADABF24B1451C85306F407CB0FCE6F6721D2AF5BC9E36D6A253B18350DB190AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509466, "uuid": "c78d18ac-7ddb-4364-ad15-d614d0036d4f", "value": "3072:kLcBxe66f7h7qyX6HTYwsSY+CrvgMW6q:k/QHT3tbilq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509466, "uuid": "d85e1015-c906-4475-82a0-be34d2e80c83", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509466, "uuid": "319e0660-8edc-4888-a6ff-33a9a6f41423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509466, "uuid": "f2c42d79-feec-4ff4-aaba-466632dffda0", "value": "17093c48a228239ff92bab6559f68dfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c93300d-f515-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712518124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518124, "uuid": "a17f330f-815d-478d-b492-22938dea6fae", "comment": "Malware payload (Mirai)", "value": "08e24a5b40c592416c3f263ef0c1c232", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518124, "uuid": "aa965e5f-e089-4228-81e7-d920b0e93916", "comment": "Malware payload (Mirai)", "value": "bb26a5354aec50495ad0653557090615085c6210241dd062e1afe642aacac397", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518124, "uuid": "932a695e-518c-48c7-8265-95d5722d2bf2", "comment": "Malware payload (Mirai)", "value": "ed0bc8c99a238eab360c4c5db760ce2db4e495ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518124, "uuid": "ed526863-0f67-434c-9e52-0a6ab43ba054", "comment": "Malware payload (Mirai)", "value": "420e9e8a2a87c41d0daa77499b95b7b87372bb06f8338f1f1e02ebbae6a86ef794d7d5025222c198cffe56af77a518df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518124, "uuid": "666082c3-f749-4de2-90fa-9b4aecc78060", "value": "T16FB34A77C8292FA8C259D5B4B0B09F792B63A58182471FBE54B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518124, "uuid": "2bc670da-1c24-4fc5-8878-023d37f31760", "value": "1536:2aVTHW/qIAmbqoZHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zP:2qWL2oZlDWMSBOlvC2sWqXxQrbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518124, "uuid": "8d9bfd2b-215d-471c-9397-d5ca6ec29a94", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518124, "uuid": "4caaa440-b46a-4a00-a195-6c224ee4d524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518124, "uuid": "ffaf6fc1-f56f-470d-91e0-9d3cfc861fc7", "value": "08e24a5b40c592416c3f263ef0c1c232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b8659e-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504475, "uuid": "a605a531-5a84-4c2c-a182-7b657139126b", "comment": "Malware payload (Neshta)", "value": "0686f968be8d16dab1e87a692fb6d9ed", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504475, "uuid": "3194703e-8e31-4396-a41d-07450cb99e38", "comment": "Malware payload (Neshta)", "value": "bc583e0ff2785988bbbeaadfc71c01482f77ef36f15a6bae46fb1051bfd5d34c", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504475, "uuid": "c6c9e184-9fb7-4458-90c2-681e4655947b", "comment": "Malware payload (Neshta)", "value": "7f8d137d5c8f1342a9e437ed2fc470be4dfd1927", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504475, "uuid": "6b0a34b4-e280-40b1-807c-77cedbec4d03", "comment": "Malware payload (Neshta)", "value": "6555200f7daccaabaa3cbf322d10cf97e4f24623ebf52da739a2d6a1c9f6bc0be271e24fbdd624182eb843d6e0a095bf", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504475, "uuid": "fedcb5ce-4838-485f-8111-f0191495c43a", "value": "T1D1257C12B3DDC371CA765172FE29B3F02E6B7C21D520B85B2E883D78B971161162DA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504475, "uuid": "38e4130e-f72d-4632-aa9f-facfbeb09622", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504475, "uuid": "c4d76356-f04d-41a8-9ec7-0853d5615a71", "value": "12288:Cy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaMuK2G1x2y2QM:Vte/80jYLT3U1jfsWaMuK2G1x2y2QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504475, "uuid": "3c493ded-0cdc-46a7-ba13-9506ae9147a0", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504475, "uuid": "ba8fab32-8449-4876-b8f3-170f58307900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504475, "uuid": "77175aee-3ba4-48a7-b961-029dcd1229e1", "value": "bc583e0ff2785988bbbeaadfc71c01482f77ef36f15a6bae46fb1051bfd5d34c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e202e7c-f498-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712464520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464520, "uuid": "32041c61-0553-42da-b549-8c214a7eee5b", "comment": "Malware payload (Socks5Systemz)", "value": "e130665578ad155e034a0ab593d035a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464520, "uuid": "0761501c-e855-4ab6-8101-3ed89c004169", "comment": "Malware payload (Socks5Systemz)", "value": "bc654338c06d1306797230d0501e1aa5995811576520e531daa651df1b5f3f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464520, "uuid": "296d13f1-b620-4857-87d8-10baf465b722", "comment": "Malware payload (Socks5Systemz)", "value": "27a1d04af87d8ff883d2cb207c822fb2217593c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464520, "uuid": "56b53328-00ed-4407-9aff-477afc52c28b", "comment": "Malware payload (Socks5Systemz)", "value": "3a9f5754e58abd7c8824bfa75153fc9d77f566fae7696084f3c062032060143982df73337fe95124469d87f7f22356a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464520, "uuid": "92fd7f59-1e1a-4efc-a2e0-0f9dd412c2d7", "value": "T12816335723AAEEF1E611CA39CF17560FD91B3CBB2B25AA417D4D940B970F440C36B298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464520, "uuid": "f37bf199-5790-43ef-8a6c-e53ec33b68f0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464520, "uuid": "5e40246a-1bbb-4fbd-bd09-84f4aa90d7f9", "value": "98304:CkZAPRA1mey51wiG9jLl0k1R/Ips+ad69sgNwgQNaccrbg8maoQxc:iHF1lAjLR4K+LwgQ8lrXmDQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712464520, "uuid": "3d6216b9-c9df-4950-aaba-622a7d2940ae", "value": 4393531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712464520, "uuid": "83140d4a-8758-48a2-a784-e0319d910ab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464520, "uuid": "b1c13a18-c3c9-4589-b34a-e5bff0021638", "value": "e130665578ad155e034a0ab593d035a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45db119b-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504477, "uuid": "c8bed13d-1f68-4a59-8260-22b0300e6187", "comment": "Malware payload (Neshta)", "value": "03008a932f60bbe939787d0c2aff1f87", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504477, "uuid": "4041f614-6da5-4bda-b85c-8489492b9f67", "comment": "Malware payload (Neshta)", "value": "bd263bd0d93f9f5b8b533345d1a786b4f583d78da511f4650d9c3b38fe7b9b66", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504477, "uuid": "48984670-15cd-403a-8bcc-a6c1c94894f8", "comment": "Malware payload (Neshta)", "value": "750d68becbb2468e7f6894dd15f90995e2f0d28b", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504477, "uuid": "0fd06087-ebb5-4c83-b248-1767389a2d4f", "comment": "Malware payload (Neshta)", "value": "555be089a5199380447ada2c251c134afe6be914e08cb228859ec8588913ccbe5e8f5976579a966502af246f674560bb", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504477, "uuid": "a5890a7e-6065-4ba6-98b8-760d020b2bae", "value": "T178D3AE01F7E0C832D5B20F746C3A92695EB5FA712D358BA763400A4DBDB63C1AE2D356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504477, "uuid": "6262db75-4627-44e8-a3e0-645a9ec4a8bb", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504477, "uuid": "fec6f52a-3b63-49e9-8e78-d854258f580a", "value": "1536:JxqjQ+P04wsmJCngQLeAyNsW+BG4TNPxJ5p7wb3pTIvjzcfpcp0DVJ4u6g:sr85Cn9eA2qx3p7Y50jwhDVJ4u6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504477, "uuid": "073bc328-e461-40ca-a33b-d90bd2d31717", "value": 134528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504477, "uuid": "12afb570-a3e1-4c4f-a41f-47ad61c8d17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504477, "uuid": "aa2b8836-6e06-4e87-a27d-5b5634fbb3c1", "value": "bd263bd0d93f9f5b8b533345d1a786b4f583d78da511f4650d9c3b38fe7b9b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d2fc9f-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504478, "uuid": "8c27c7d7-c335-4902-890a-ef332a7f42f1", "comment": "Malware payload (Neshta)", "value": "84b03259908e80eade34f97068a1165f", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504478, "uuid": "6d553054-9144-4aac-8329-aa4de6729f8e", "comment": "Malware payload (Neshta)", "value": "bd80dcf47aef3610a6d3097aa4566d391c779f18773ddba568eb3c7c5b42bb56", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504478, "uuid": "c9eb30b9-4459-492a-882d-bd11afbcab14", "comment": "Malware payload (Neshta)", "value": "00030ba966a3a38f7b642b2190d2a579d874decb", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504478, "uuid": "361c7014-701b-446b-a7e0-43311ce0e648", "comment": "Malware payload (Neshta)", "value": "d921832087e6b17c4791190c9ccba9de081dfe1a5ccd6dee5fd1f3e0ee032b95d54088a1a6089af5bf332b56cfca6f31", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504478, "uuid": "adeeae3f-12e6-47d5-b344-eee1d4ed97a7", "value": "T11D834A56F6A1C871D0241EBCDC2592F8943B7E31FD292AB3AAA53D4DFC793D1290C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504478, "uuid": "54044bd7-36b1-4741-9cca-43183f244687", "value": "1536:32xqjQ+P04wsm1ExqjQ+P04wsmJCcBUu:3Xr8lxr85CcBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504478, "uuid": "d88ea7c2-03bf-4889-afcf-e9229907b9ad", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504478, "uuid": "cdec5103-bc9f-4eae-928e-c8a8e0a97f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504478, "uuid": "2a2944ba-2c2e-4e28-9fbd-51fe61cad9d1", "value": "bd80dcf47aef3610a6d3097aa4566d391c779f18773ddba568eb3c7c5b42bb56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3a6df0-f533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531307, "uuid": "e03def02-caab-435b-a167-50cf19d3948c", "comment": "Malware payload", "value": "58dae280987e0124fd1885cd43aad352", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531307, "uuid": "ac3fe4a3-a21c-4cc8-a42e-85b1574b7627", "comment": "Malware payload", "value": "bdc73d1f74653e965f9fe6047de1cbc989280017858375eba5fa253d41497c77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531307, "uuid": "b0b3e255-87d0-4a09-ad6b-1b3c92329006", "comment": "Malware payload", "value": "3f5317669255b7023f6452c440598cbac507c999", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531307, "uuid": "09e4e0d2-0b6b-44ec-8edc-8ea12116eb0e", "comment": "Malware payload", "value": "4bf8fbbbd32960d986b5616cca82793ae712b8afc60cc15183d7ac0896fe0fb4aa4aafab039300d05394af457f0d0401", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531307, "uuid": "c81a517d-cdf3-454e-b722-3c3cdeb87d4d", "value": "T1D7643E85BAD3DA7BF866F37A80122617F379C4F4A310CB13156AC03A6FA67646C950DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531307, "uuid": "f818e0f6-e076-4b40-9264-825bc813503a", "value": "6144:g55cfN0zPSwnAX49zlpRP4A2/iqPiQJp643PhvrwcmBNneKwMz6fC9e:g5DzPJD4tiQ76Avrwz6fCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531307, "uuid": "9102f6f8-12c9-410d-a9cd-1545db671fb6", "value": 317153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531307, "uuid": "83706c47-c26b-4b49-9731-6ab644b645ad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531307, "uuid": "3fd68877-ec9e-4778-aaa9-c9f874937993", "value": "test_function_base.cpython-311.opt-1.pyc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ddb8ed-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504480, "uuid": "567369a7-9dcc-41e6-8aa2-6849c5824012", "comment": "Malware payload (Neshta)", "value": "1d82bcca9736632dfba6aa35a1ca492a", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504480, "uuid": "9dc800c6-35d3-4cda-9d5b-1e10fdd2438b", "comment": "Malware payload (Neshta)", "value": "bef62caa5e70da8df54ed38ce5774dc6e3322d5d0f27db1114f54f4d1e77e6af", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504480, "uuid": "18de01f2-610c-4965-9f77-cd9d7f22c634", "comment": "Malware payload (Neshta)", "value": "2dafeb28b1c297246921f6a84987669004ce6dfa", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504480, "uuid": "2a913780-97e8-4ada-9787-582a44c718a8", "comment": "Malware payload (Neshta)", "value": "d12cd7f78b54550acc924b6266bbb27d345e5e2e8844b7947a56537ab72f54823371e05ff5695ae5d7b27dba7030526e", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504480, "uuid": "10af98b2-d1f8-450f-b19d-d9d4e70232b5", "value": "T156837C56F6E1C872D1340EFC9C298268D53B7A317D2A1AB2BAE51E4DDC7D3D22D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504480, "uuid": "ef727a04-146e-45b0-8520-41ec69c3c81a", "value": "1536:32xqjQ+P04wsm1xxqjQ+P04wsmJCcBA3H:3Xr8lEr85CcBeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504480, "uuid": "98bb3aba-ef36-4eb0-9007-ed371150a3f6", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504480, "uuid": "15248477-3ca0-4335-a475-9125e34c2056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504480, "uuid": "88529bb7-fde7-40db-9eed-d62dd15327cb", "value": "bef62caa5e70da8df54ed38ce5774dc6e3322d5d0f27db1114f54f4d1e77e6af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d198841-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503952, "uuid": "bd8a3800-ce4b-4a67-b0f7-3ba353b60229", "comment": "Malware payload (Socks5Systemz)", "value": "e1170f3d47ce49c91e07c4000fa593c9", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503952, "uuid": "44ff6829-9c1d-46eb-bf81-3709abd66c1f", "comment": "Malware payload (Socks5Systemz)", "value": "c00426e525eed247e8c04c3ba2019f6db552e7d0d26e5bb9463e5bcdbcdf3aed", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503952, "uuid": "e8af6578-26df-4b9c-866c-051e4e2bc36b", "comment": "Malware payload (Socks5Systemz)", "value": "0eb8bb1d0c2fec43013033164891c0587a5d3d9f", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503952, "uuid": "f0aaa65c-d8dd-49c7-a264-3bddc83344bc", "comment": "Malware payload (Socks5Systemz)", "value": "32886713588ac024656cf5def409579f5b9506ad1d7398e69a4d2f33d1e0462d76067a30931c85dc44336006670acaa4", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503952, "uuid": "b197f78e-a384-43c6-a106-f0e0a5ebce69", "value": "T105E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503952, "uuid": "ca603835-e7dc-4784-8df5-645e123d810d", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503952, "uuid": "62810e9e-d659-4f26-a257-7ab90cae04c9", "value": "12288:v+XssgiZdvAeRwi+aTH3Hsu9zO0tyWQNx04x+9sOjjI1Y4hwfS9w0jQG657Rk2kN:LsgwdvAX8XHsu9zO0tyWQNx04x+9sOji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503952, "uuid": "6bbc85ce-a3f9-474b-b494-7f85c0bcff0d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503952, "uuid": "85d368d8-e73b-4d49-8295-ccbbeca37d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503952, "uuid": "180349ab-2809-44d6-a9da-b8203e3bf2d3", "value": "c00426e525eed247e8c04c3ba2019f6db552e7d0d26e5bb9463e5bcdbcdf3aed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46312ae-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712506487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506487, "uuid": "a6719d7b-ef7f-4eed-b19b-384d5fa6deda", "comment": "Malware payload", "value": "204fed56b6de446df3529fa9e64947cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506487, "uuid": "3a50a430-e416-443b-b72b-130770148a1b", "comment": "Malware payload", "value": "c2a958e5ee64b796d197d63b71f5eb00172b8bf8ca6c83f9bd7c042c0207298c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506487, "uuid": "26343e61-f02f-47f0-b8d5-5138b0caee97", "comment": "Malware payload", "value": "8cfdfadc200fb8c4cd6e9b235b15623c09686db2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506487, "uuid": "e12800fd-60ca-4953-a118-8a0c0c1f941d", "comment": "Malware payload", "value": "3f739f19b52ac9feef9cccaefba5c85641034748de6ebb01f28ddbc174b1757d4f4a22331253f1cdb301375740da2e3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506487, "uuid": "3da6851b-81d8-4011-8af9-1b7ebfcedd9a", "value": "T13163A50ABF600FB7EC5BCD3749E95B0521CD681A22A97F3A7A34D818F61B54B05E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506487, "uuid": "3ed0e9bf-5f76-448d-b48d-054a8b5fee3c", "value": "768:aQ/BNtVjd/w0P4bn2XNYxd9ovRpTjT2enE1BOmseQeLeMpeDGnDJEBXiL0OLo2XR:aQFb40W2dE9/1B01uppY4mqLrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506487, "uuid": "49723c5a-8b69-4093-8ea7-c120f463eafa", "value": 71872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506487, "uuid": "69907a3c-32dc-40d8-92c0-f3eef270118d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506487, "uuid": "345963ea-f135-4936-b8a0-60c907c52881", "value": "204fed56b6de446df3529fa9e64947cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac5df5e-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504485, "uuid": "33d57aa3-05e0-4369-ab7f-08c41362b75f", "comment": "Malware payload (Neshta)", "value": "a9a730f35f022aae05c474e1cb1f3db9", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504485, "uuid": "7d40bb19-4199-404d-802f-1267fd3826b6", "comment": "Malware payload (Neshta)", "value": "c3841ebfd6f8b2d05dfcdb50576d648a8cf90693409d77aa0a1308a34802747e", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504485, "uuid": "20e75475-f46f-4de3-a7fa-a118af802d7e", "comment": "Malware payload (Neshta)", "value": "4e8d69ae88bf6fc2ee6b54b8a84b687ab9980614", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504485, "uuid": "92d33188-7a2f-47ee-afc8-87782e0daf29", "comment": "Malware payload (Neshta)", "value": "d5e5fa844d2e7b6c91428727fe2980d17ecc059d365fd83e8f59c074a266415c197dc650bb46d6bcd183fd48c25e6d13", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504485, "uuid": "499d29aa-c6cb-4d5a-a1ab-de55ac068357", "value": "T144E38D4673E054F9D0265678CCB68614D3B3BC364678974F37A43B5A9E733822D2EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504485, "uuid": "b378ab36-3b11-44f4-b192-9ec000e116b9", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504485, "uuid": "0ca24995-a6f0-47c4-9571-939ae8ebcc45", "value": "3072:sr85CkkbAYn2GgYlBYN2fHYTo+Cyt8wDSRUTT:k9xbAMpgY3gT58DRUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504485, "uuid": "2056528d-efb5-4852-8a86-203ffd7a3029", "value": 149916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504485, "uuid": "86de0025-4145-49b5-b5af-9cba31c1c35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504485, "uuid": "3dcccefc-f9b0-4666-aad2-29856e51c5db", "value": "c3841ebfd6f8b2d05dfcdb50576d648a8cf90693409d77aa0a1308a34802747e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b02634-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712533118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533118, "uuid": "03681c6f-aba6-4568-afc5-81e866cc638f", "comment": "Malware payload", "value": "c9380d8af061c9ce66061b2b7c451b05", "object_relation": "md5", "Tag": [ { "name": "maldoc_indirect_function_call_3", "colour": "#CB3188", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533118, "uuid": "209ab2b9-4967-409d-9bfa-3abe56ac27e8", "comment": "Malware payload", "value": "c389a2e119692e15be60bd260e91c2eed26c5184776a8903c89edca725957d83", "object_relation": "sha256", "Tag": [ { "name": "maldoc_indirect_function_call_3", "colour": "#CB3188", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533118, "uuid": "c00f80b6-5e4c-4326-a55b-9defd13610ee", "comment": "Malware payload", "value": "8d951c05531db67c55dc82b9fcf70391b8f314aa", "object_relation": "sha1", "Tag": [ { "name": "maldoc_indirect_function_call_3", "colour": "#CB3188", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533118, "uuid": "7fbec464-69a2-41d0-be6f-9c94f361c78c", "comment": "Malware payload", "value": "d3df5df77f79bfdb0872db04f9c1203ace75892d86fa40c742bb7d8193f67bcdc62dffebde36baf1f9249ca211723310", "object_relation": "sha3-384", "Tag": [ { "name": "maldoc_indirect_function_call_3", "colour": "#CB3188", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533118, "uuid": "5d600062-b6a4-43b1-974e-d3bf837aa78c", "value": "T102C42329D4DA0C79B53C382861B6E6A8DC94F696423DC43F41FA29F41DA05830CEE79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533118, "uuid": "afdce498-83ab-41c7-a9e8-c5db7dea849f", "value": "12288:44VAso2zVVIRkipUpu6/5MMLn6zsjmcXkSDz/u/Nsjznu:hVJVOkiCpuq5MML6QicUSX/u/mnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712533118, "uuid": "ba1fac5f-34d8-4258-b8b8-8e831df2d405", "value": 565704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712533118, "uuid": "682653e1-19d8-4a85-929e-e2cb81afbdb9", "value": "application/zstd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533118, "uuid": "723c5ecc-7479-4ce3-8784-50df8e78b708", "value": "cifs.ko.zst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8df7ac-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504486, "uuid": "2c628383-0dea-400f-a468-d6a90eacfb1b", "comment": "Malware payload (Neshta)", "value": "5005798d502269ec63a43e0b4a1c0267", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504486, "uuid": "4e02946f-1478-4c82-93f8-e9387b1cd904", "comment": "Malware payload (Neshta)", "value": "c41c325c8fa1ca3f133921122ab2e0377eddd3c6bf099c7067af275e851374f9", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504486, "uuid": "3a123d76-8af8-4918-999d-46988787eb0d", "comment": "Malware payload (Neshta)", "value": "9a910b27c0c607246dbbda481bea569c6d73a051", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504486, "uuid": "41f5c757-c1de-44b0-b14b-cd297ba2b802", "comment": "Malware payload (Neshta)", "value": "5d994b37816b0718cc1982c0b1939497ec3c98dadd81e1560434748f7767cb952bac9ba9bfb6036110206bfcc1fa85b8", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504486, "uuid": "647fde69-faa7-4f25-bacb-c32667b15bff", "value": "T175837D66FA918831C0260EBDDD258618D07B7E313D396AB2EAB62D4DDC7E3C1390D585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504486, "uuid": "a858c0dc-a53e-4e51-b7c8-f0a8662135aa", "value": "1536:32xqjQ+P04wsm1nxqjQ+P04wsmJCcBJnyEo:3Xr8l+r85CcBJny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504486, "uuid": "e4881d27-1266-40c1-9ce5-022830ca30b6", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504486, "uuid": "e07992e1-9568-43ea-a24f-c0f61ed84096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504486, "uuid": "f71943fe-c26d-4a48-94ee-2a877c6ce627", "value": "c41c325c8fa1ca3f133921122ab2e0377eddd3c6bf099c7067af275e851374f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091731da-f515-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712518119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518119, "uuid": "346c98d5-b5b2-4da6-a66a-28ae03b98c27", "comment": "Malware payload (Gafgyt)", "value": "c052c1d3b012e2d457b855051dc4a026", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518119, "uuid": "a73dd5c2-c250-4b75-ad9d-9d3c349a240d", "comment": "Malware payload (Gafgyt)", "value": "c46fb9fb01fc9af19a1e05a9e989c344acc38f234c619155c50c37a33d00bb43", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518119, "uuid": "f83d3eea-ab0e-457c-9ebe-5afbd26cee2a", "comment": "Malware payload (Gafgyt)", "value": "32970523f10a3ce4ec0a86d796449201f8e04ac8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518119, "uuid": "7df83fd0-4b1e-4bc1-a267-7622ec84a5e3", "comment": "Malware payload (Gafgyt)", "value": "e2d5205f2120e482bcd11fe6c5441793a71fc8d50c8d50b6690e2fc387d5e717cfbb002750e93678eaab848dddc28fcd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518119, "uuid": "56e4ee89-c950-4ba0-b1a8-2216d059d71f", "value": "T18C836B23A651C67BC0875BF91BDBD5615023B8B90B33720A73D8BDA92B36DC85D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518119, "uuid": "25c75ef6-eceb-47d9-a2d9-c9aacda782f0", "value": "1536:Ux7crF7Vev9qtZuEqdPUq0aJb9sqx3CjrM3XxUWABRPmoIYuOVje+ZNne:UBQVe1qO7dPr0oSwyjr4XxU7B5mrYuO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518119, "uuid": "3eee3126-e0b8-4c7a-b019-757b68e43567", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518119, "uuid": "baded07a-677c-40ff-b584-fe104ffaddd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518119, "uuid": "b26fed16-338a-4677-83cd-81c6ca7d6283", "value": "c052c1d3b012e2d457b855051dc4a026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d24f985-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504489, "uuid": "a76dca7b-6e62-4096-88c8-3025b2530ff4", "comment": "Malware payload (Neshta)", "value": "a606a7c189263020765a7ef8275360a3", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504489, "uuid": "1da830dc-55b8-475f-b07f-408e1e24d9de", "comment": "Malware payload (Neshta)", "value": "c58e1e953d9e77418014d1762000f86e83a1eb98e0f3f221628715a52715e466", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504489, "uuid": "abc94670-4602-4b73-a001-a6b9123ad8d5", "comment": "Malware payload (Neshta)", "value": "5c57d8404292c9479866882953edb485d3dbdd38", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504489, "uuid": "80d04266-052e-4c3f-9eb6-bc000f1f1834", "comment": "Malware payload (Neshta)", "value": "d0bd85df1b38b21897602ced0fc5b9ed2a1f0b805ad5723c0388b07f49a115bcf0e6948c9755a3d89f69d4a2e35ea089", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504489, "uuid": "5015f7b7-5ec3-4407-bdc0-6594a6c2e65e", "value": "T156834A17BBA2C8B1E4129574DC1782F18D767C60F9646AA3B7B53C0CBC35FA16C28D49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504489, "uuid": "45f13589-6a71-4684-9bb6-74c88ebcec29", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504489, "uuid": "dc99cc0d-7c6f-4961-9a6d-620c6db56b1f", "value": "1536:JxqjQ+P04wsmJC1kGkGRdSPO5y9a/pTg2:sr85C3Dbm/9a/pTg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504489, "uuid": "c520df25-f45f-4025-ac45-78b3ef2dd9b8", "value": 83848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504489, "uuid": "e6742a90-f0ac-4dd4-9ccf-5374e4d24366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504489, "uuid": "55be7e2b-e9c6-4898-b0a4-ce4b469e6e3f", "value": "c58e1e953d9e77418014d1762000f86e83a1eb98e0f3f221628715a52715e466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecc22bc-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509109, "uuid": "2b7e0d7e-5d52-42c9-989c-a351820833c2", "comment": "Malware payload (Mirai)", "value": "9407620f9f0b2784be15697d94f8064b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509109, "uuid": "4d32d79f-f242-4f9d-b9b8-cdeb6100aefe", "comment": "Malware payload (Mirai)", "value": "c596660ff4233c2d928956e43fa922022df91b39b2984475607998d1b50e8e6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509109, "uuid": "3a10d25d-bc5d-47e2-b54c-ba5bdeeb235a", "comment": "Malware payload (Mirai)", "value": "84fad09bed877165851877b2502d4878235b5d4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509109, "uuid": "0f35daab-6464-4419-a135-1a87fa0c9351", "comment": "Malware payload (Mirai)", "value": "cd2182af115ee4a0e282c4addad9d7c0f47055de6b9005a988ad90fc881e145d02db7e7f560bc4ccd42d661ab097dc55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509109, "uuid": "0f370f50-0c26-4ba6-96cb-2558034e0a7d", "value": "T112635C53B2280D17D0A30A70293F4BE18BBEDFD121F0B686695FAB568536D331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509109, "uuid": "3e70b637-1a37-4508-a916-e4e374acd7cc", "value": "1536:HtDk+zX0QboUK99VB1twraXb/E1WbIRVcxJa10L:qkE6pKPVB1t6aX41WbIRVo4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509109, "uuid": "8dcb88ed-05e9-47b9-a31c-8755ab33734e", "value": 67956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509109, "uuid": "1c8bbf7c-4e2f-403f-975a-8f59379b000c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509109, "uuid": "e858ddb6-307b-43af-b303-e51ef8c90ee7", "value": "9407620f9f0b2784be15697d94f8064b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd1cadb-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712475046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475046, "uuid": "2ef7ea4b-b8cc-4c6a-8af5-8418f411c33a", "comment": "Malware payload (LummaStealer)", "value": "f7165a52a041844db0b95da4a7f75d03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475046, "uuid": "f6a2dedd-427f-43bb-badb-ad52408850b7", "comment": "Malware payload (LummaStealer)", "value": "c6030db29ca90d68093244ee0e1f77e6d0366630913f1fc651f599b16360451d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475046, "uuid": "2d36b562-1b6c-429a-b741-54b75d82fa32", "comment": "Malware payload (LummaStealer)", "value": "10600ae13ebdadc4fac423edef8d59d9dfd58e4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475046, "uuid": "29a2568d-1f1d-4f40-a1d2-295c896868a6", "comment": "Malware payload (LummaStealer)", "value": "b374a6567244e4c4aa8c527ec58bc4eab26afddfe63730794151714ae74a1f6799712224a74de10de0f36356911bf51e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475046, "uuid": "3c2c1e3c-23da-4156-9a30-c10f32e18966", "value": "T148542399DB7B73C6EA4F0339B84AE7A071E02BCB1E7E451F316075096B443F2917129A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475046, "uuid": "acdb5178-c357-4a7d-acf3-461336b89caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475046, "uuid": "6596f080-f710-4160-a5af-457de56ad5e2", "value": "6144:Lnb38rrCxKKNxbjGxTQm8lt9o1tpAh/7xY2mENDizSL3E9:zQyx/GJ8hotAh/7y2mWDquE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475046, "uuid": "6b34fc9d-8a82-4b30-b4c7-adcbe7971476", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475046, "uuid": "98773aab-b033-4e08-8f85-8f98d219da93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475046, "uuid": "c79cb043-d04a-4bcc-8c62-a9b15d6d4c3c", "value": "f7165a52a041844db0b95da4a7f75d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423eefd3-f498-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712464527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464527, "uuid": "77fa3b98-e34e-4a74-a274-7dc674d91bf5", "comment": "Malware payload (DCRat)", "value": "7c745407db6feebfefc77f335e6b8791", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464527, "uuid": "79f7b170-8094-416e-9a9b-a684eddacf18", "comment": "Malware payload (DCRat)", "value": "c66d3b14b2a23fe8dacb3f55bae138ed1bae4b55e1771acf63712e3d9b3d7227", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464527, "uuid": "5b8e7bda-f9e9-4ff9-b80c-7c01c3ced663", "comment": "Malware payload (DCRat)", "value": "f12b28798c4b43cef88872a4ed4017953ce05127", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712464527, "uuid": "8f2cbfda-513b-43f7-8c0d-ce2f43e07eb5", "comment": "Malware payload (DCRat)", "value": "e2d97ef75040eac2b0a6d0a8d5014c73862a9deca539150362db91ff03af6a22688a5dfac59ac8962f9b172b02364e7f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464527, "uuid": "2f1b71ec-4339-442e-9814-ffdeebfa1004", "value": "T10316F10EA592AA73C3A13F3185E7011D93F0DA613922EF5B361FA5D5A8521B18B137F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464527, "uuid": "c5de2aba-9b6c-4e9e-9568-6182d46dc074", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464527, "uuid": "b92583c3-a1a2-44c7-b285-689c511fb54e", "value": "49152:IBJDyxZLXOEx+OBBjnyLa2jTAUw6MBoHNUUlYJX+A7EJjZd/ngzkNidI57q52t1D:ypySEFR70TAUwySU+JXXor/cW/Lt+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712464527, "uuid": "9a996600-0958-496d-8b96-d6af43069798", "value": 4144775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712464527, "uuid": "834bb12e-897c-4a09-a8b4-05e63865db50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712464527, "uuid": "3772552c-7c3c-43ef-a599-1a7a10f2e5f2", "value": "7C745407DB6FEEBFEFC77F335E6B8791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28b64ca-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712533059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533059, "uuid": "2353f18e-c81c-414a-a60d-973ba95fc73a", "comment": "Malware payload", "value": "084596bf0bc9c32d89077ef02f924f0d", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533059, "uuid": "7f70a15c-1691-4f88-bae0-5a9704a130b3", "comment": "Malware payload", "value": "c6f211fe31092ce08b8f43a53a3639c8137b6e4b07a27cc07025f7a46f81ad9e", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533059, "uuid": "efab29a8-b46a-43f4-9f11-d3f28510092a", "comment": "Malware payload", "value": "9915be16f23226f9a5331eedcb918b8e10c5f071", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533059, "uuid": "258bd3b6-50e7-4911-a221-357d5f1c77a8", "comment": "Malware payload", "value": "986dfda8584f4f151a2317a1fab4f325d4d27d1ad142413a01f00084fa504e9ff37d8b048cb634c46ed782e25fa1c941", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533059, "uuid": "5c7c05ea-0f49-4340-8ec1-cc5db39deec7", "value": "T1DD52D3C3B525406D7EC6E298AE084E02BF3D45F1F25B62634BDE8ACC5AD471F50F2489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533059, "uuid": "797a9e5c-bbeb-4803-b653-df57e0e08664", "value": "192:PCZQBeZYST1dp3ffHnyVmGX80ZW2c7Gc7OJBitxd4kc8bO+/khm+4:PCxl3TOGEGPpbO+cr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712533059, "uuid": "20adf79c-86bb-4d31-95ce-3dae89d29181", "value": 13714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712533059, "uuid": "dc13a039-24c4-4f09-b04c-cc920c5ea437", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533059, "uuid": "789dd6fb-b88a-4665-af42-285277661482", "value": "syscalls_64.h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecb8673-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712517725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517725, "uuid": "6000e19d-8a80-4e10-963e-20c06ace94d0", "comment": "Malware payload (Gafgyt)", "value": "74eb1b58f03a522e7f2803c8e38fbc57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517725, "uuid": "362a4e88-7485-4909-9ef8-f361842a0e66", "comment": "Malware payload (Gafgyt)", "value": "caa50ef0019fe6e308dd9b52c9ad9b8ddb45cc25f3d79c134c516c0c5beb6d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517725, "uuid": "45b5da8a-3522-4995-bde4-7ce208fd10ab", "comment": "Malware payload (Gafgyt)", "value": "488c89d6eeb136ccb6f6a307dc7aea3e654afb1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517725, "uuid": "b5dc812d-0c0a-4848-b515-73f8f7606355", "comment": "Malware payload (Gafgyt)", "value": "6174d343983a4e9c863eb866df40d815229d3e8dbbc6532e913e9d840b1aefda0aa58681e714e6d687e6db483a0aca0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517725, "uuid": "99bac3bc-a27c-414d-8169-80b45cb6cbca", "value": "T19CD3E701F9104B6BC7D2ABBEF745A2CE77719D982F833306D71979B027D06A96E39204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517725, "uuid": "594080be-fbb5-428b-b2af-bd65f483e97d", "value": "3072:Mlb9bGtcG7jLq+rO6I3+G3ci0QWBap+0ysz7o0sSZd9L8C8MZuEHvtmSXVHDLd/3:Mlb9Bo0sELfjZucXVHDLd/kQcHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517725, "uuid": "e2b6876b-c5e3-4100-9e12-5222ca834d2d", "value": 141625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517725, "uuid": "97accd4d-3a42-4f24-80b1-aad4a941cba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517725, "uuid": "4e796bff-317f-424f-ad5d-4ea4c196f8fe", "value": "74eb1b58f03a522e7f2803c8e38fbc57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135b7dfe-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506969, "uuid": "eb890e05-4be4-4fa1-83e6-374c48f7aa3a", "comment": "Malware payload (Mirai)", "value": "1c63352af9a4b8155819be4251fb139c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506969, "uuid": "24a1dad4-d7e4-4f89-af88-9d475f983ac1", "comment": "Malware payload (Mirai)", "value": "cba85ccef67caef4ec78cf055098876dbee8cdfa7febfe5674821d5a9856947a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506969, "uuid": "f9c01891-7ef8-4dba-9686-959b1d7f73fa", "comment": "Malware payload (Mirai)", "value": "8a5752771163f51ced3bcd3cd09084d436315f7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506969, "uuid": "6400ea3a-259a-4032-87bf-8493a7659ef3", "comment": "Malware payload (Mirai)", "value": "175bd78ff40204b4ea5ae2ae1f5a0eebba5affacdceb0d632d4863c7dbfa0167c39b7ab18ecaa7df349efbe2d1000975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506969, "uuid": "9bc7ce63-7fbc-4676-b578-b4e27fa9558c", "value": "T15BE30A56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506969, "uuid": "3f6d72b9-5307-4b1e-b662-c2bc80866f58", "value": "3072:ZUIK7uQUPMNrbAXx0Kfw0aHI5yjwDCO32ZRpY:ZUr1UuAX2KfFa8nH32ZRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506969, "uuid": "fad523c0-ba89-4711-b158-454251aa5ca7", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506969, "uuid": "0e79fdfe-4fec-4b0e-a45e-630caf6d0a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506969, "uuid": "45754771-abee-4198-9039-70451d693a71", "value": "1c63352af9a4b8155819be4251fb139c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e22a719-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503954, "uuid": "ebb6bac9-5eb1-4322-bd50-2a2bb0763b4e", "comment": "Malware payload (Socks5Systemz)", "value": "f354ce0de2b9abfee4250d64965124ac", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503954, "uuid": "aa4b0fa0-d03a-4bb2-b37d-572ab40dc5f9", "comment": "Malware payload (Socks5Systemz)", "value": "ccdc4f77149c60aa0ac9b5dd8e2ca0d7146308a0981541201ef9113fca2eced6", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503954, "uuid": "78ba41a3-2976-4e5a-af8d-9232e681a423", "comment": "Malware payload (Socks5Systemz)", "value": "f26bbe0a29d03b6e51f32d9844001d90dcab686d", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503954, "uuid": "f257e553-82e9-47a6-83ef-26e6502e6a2f", "comment": "Malware payload (Socks5Systemz)", "value": "1045bfeadfdcf213a08b8140918386c7edc2c98382d65950a290a21d96f0b19aee7c78a0538d95f5af462b69b5f483e0", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503954, "uuid": "09b57b00-1efe-454e-86d5-cd6e031f1d41", "value": "T1C4E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503954, "uuid": "2a19c67d-8d0f-44f2-bdc2-58e9eb1fd01b", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503954, "uuid": "2cc40db9-96a2-4271-9e6e-89e82ea2860a", "value": "12288:HjsgiZdvAeRwn+aWHh50cCNRBq49cvpWwVbmtRKLiTOksRpkHwGkNiIjcBDQg5EO:DsgwdvAehB50cCNRBq4mvpfVbmtR+iT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503954, "uuid": "5ba65c35-141d-4ca3-af7a-aeda905adcc1", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503954, "uuid": "33ad0a94-1220-422e-87c2-ac990b064669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503954, "uuid": "6b12f2b5-0c6d-4d7f-969b-1f20ee50e943", "value": "ccdc4f77149c60aa0ac9b5dd8e2ca0d7146308a0981541201ef9113fca2eced6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9a2228-f4d7-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712491848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712491848, "uuid": "d5f00426-0dc2-43d9-a816-472b78203fcc", "comment": "Malware payload (njrat)", "value": "761900700a2dd93bf347e10fa9c14fb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712491848, "uuid": "080e23ce-1e8a-4a9d-80a7-89a10efad964", "comment": "Malware payload (njrat)", "value": "cd21730a2de2f182773c6b9ef50d34ed9f3d55a94b7e20a987e91843f14a057b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712491848, "uuid": "d880c9fa-304d-4c60-95e9-edb6a98755f0", "comment": "Malware payload (njrat)", "value": "db4904470793b785fd6b06c17312be4111da02e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712491848, "uuid": "920c3cb4-2973-4b6b-ab48-455323337951", "comment": "Malware payload (njrat)", "value": "3d405b048367740d1a204c287ab5c220af1baf7f5bea2b85ccaafbd705b0dd0f0a0d501c7267e485051791bfe5b71ab4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712491848, "uuid": "2c58dcd9-298f-4435-bcf2-712fc0164e4c", "value": "T1F9E22AADFBE644A5D2BD1AB60571950113B4E003D522EB7E4DCA24E62B3F3D84B48DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712491848, "uuid": "cde1967d-b794-420e-8108-0f2fa55e7675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712491848, "uuid": "dcdf5066-2691-41e0-a5a0-8944d1e1a1a8", "value": "768:sBSB69DdxkzxP6bg0aG3NQNvC7QmIDUu0tiwBj:RqqG7i8QVkNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712491848, "uuid": "752875e0-064d-45ce-baad-8b7337a9fd01", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712491848, "uuid": "0ee23e34-bb41-40d5-88e1-99902e013560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712491848, "uuid": "68a9c645-d7a7-4474-b9dd-6d58cbaa7c9c", "value": "761900700a2dd93bf347e10fa9c14fb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093137ce-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506522, "uuid": "dc645332-f7aa-4e3b-a911-f02ab9dcf000", "comment": "Malware payload (Mirai)", "value": "43aadab7c176a002843c49defe19510e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506522, "uuid": "b3f4701f-f541-44c1-b853-7556413ad852", "comment": "Malware payload (Mirai)", "value": "cd8a31288331e802dbc40fe98dc80400fa71c085ca5d836872cc8cc954dcf50d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506522, "uuid": "02876760-fb7e-4a24-92b0-978e0dd280bc", "comment": "Malware payload (Mirai)", "value": "9ca4845663feb0455cb8fc3e50a6b10004248392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506522, "uuid": "0d5bf3aa-5d5d-4f07-9e8f-14ed48eccfb4", "comment": "Malware payload (Mirai)", "value": "502e8e47aa9ca426d4ab3ec98460b7585b123753fa66374d7dba970271c7554b7f527bd429a9a8b4fdd44214627471f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506522, "uuid": "454ac09e-3020-47cf-973d-feb4c873fe86", "value": "T1C0D32906B30C0947D2632EF43A3F67E193EFAAC121E4F644251F9A8991B1E375586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506522, "uuid": "78347496-92fe-4dfe-ab95-013a9085f427", "value": "1536:PxOgCSseWha1xpwva2LMDO9IlhVWP12jvAtPdcuJP4Eq1U678dLi:Qa1x2S1y9iVa1HtG4dLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506522, "uuid": "087e8011-232d-4234-b2ec-28e1f9f64548", "value": 137912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506522, "uuid": "5a4ee373-1bc6-48a0-a2e3-4ad432d2df20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506522, "uuid": "db414c7f-dde6-4fe6-8e04-c025f55b45f0", "value": "43aadab7c176a002843c49defe19510e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e183e68-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504490, "uuid": "4b392380-3691-4f80-9f05-caee03883deb", "comment": "Malware payload (Neshta)", "value": "14a2b545774ab9b73e0efbf720f28af5", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504490, "uuid": "a6c66068-fe34-40bf-bbd4-48010f59bad9", "comment": "Malware payload (Neshta)", "value": "cdf27a3a510b9349a8525fdb1a06001375283b850cfd184f588a0bf5a9752042", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504490, "uuid": "895670fa-3a6c-490b-b817-c91259d660ec", "comment": "Malware payload (Neshta)", "value": "d04a3dc0f68d3aaa246bb800f258b35d7041a1a3", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504490, "uuid": "013ece33-b40b-4ecc-8edf-5a1ef0e2104e", "comment": "Malware payload (Neshta)", "value": "8d991fbfa351ebb7fdfb0ab242866064c6813d1bd32d62b8a3c92fc5cb8947d122d3fc12083114965141d26761c681b4", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504490, "uuid": "1d603026-f394-4e15-b824-fb7b32088229", "value": "T187A46C02B780DF31E26F0535996996B45A6F7C309F248BDB63943E2DBE306C1A935B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504490, "uuid": "416c14f8-b8ea-4a7e-a6e5-4e2d500df0d1", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504490, "uuid": "e3f97837-20ac-406c-8e94-775de8e279a0", "value": "6144:k9hvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMqvpBVOaqahLSjAGBjAGT:LbgvuFuQdj+zRTJkX8yMxBPjhkAmAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504490, "uuid": "f247d346-6ccb-4b1a-833c-93140cc37c38", "value": 451080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504490, "uuid": "09503e8a-f840-4616-a3a8-40dba145c2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504490, "uuid": "76562bcf-f83e-4c88-a0b7-4e45e85e81f9", "value": "cdf27a3a510b9349a8525fdb1a06001375283b850cfd184f588a0bf5a9752042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee1cdfd-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504492, "uuid": "db0c5ab4-1291-4eb8-90b6-2ec59a6a1119", "comment": "Malware payload (Neshta)", "value": "892e7c1f4be265ab6261c76aec1c0ef2", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504492, "uuid": "a2a71632-5f77-4283-a128-c5105a2cc760", "comment": "Malware payload (Neshta)", "value": "cf4d54686eb2d6afbbb4107de4a42c02e6f0a6a4394264c156202c1e2bf01468", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504492, "uuid": "b57cf696-5737-44c1-b75c-edf189d7ea92", "comment": "Malware payload (Neshta)", "value": "2411e925481e1f23980cf33a844dfc88734b8608", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504492, "uuid": "2b50f120-c8e9-472b-9532-9e68cebe31d4", "comment": "Malware payload (Neshta)", "value": "52b5f0dc228311d411ddf433b7910a51ba76f42947fa92b6d2c45a8bf25b2fd3f113c710604fe5d67621a91369fde66b", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504492, "uuid": "ba6cca1d-0643-4f8d-ad67-ed6bc517a5ee", "value": "T162836C56F6E1C872D0341EFC9C259268D43B7A317D2A2AB2BAF51E4DDC6D3D12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504492, "uuid": "c9498c77-8f8d-45e0-b2f7-fc0b720b2a87", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbNpyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPU:32xqjQ+P04wsm1gxqjQ+P04wsmJCcBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504492, "uuid": "078c37f6-46e3-42b8-a097-87870c12dc29", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504492, "uuid": "c0b54517-fdcb-42a5-b491-f38ee739fc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504492, "uuid": "5ae4f5f6-e69a-4609-9397-104279737049", "value": "cf4d54686eb2d6afbbb4107de4a42c02e6f0a6a4394264c156202c1e2bf01468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3597ee2-f481-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712454919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454919, "uuid": "52ba98f7-424e-4dc2-bef8-3838e84fbbd1", "comment": "Malware payload (njrat)", "value": "2fb6ca89c92a5179573603b1eabb68f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454919, "uuid": "9d03986a-0ee1-46ec-8b93-7fcc26e3b9e3", "comment": "Malware payload (njrat)", "value": "d07cacdbd76d1b83a61506b8da96f9e5ea7238ffaefe8d715c64d3e1f325c01b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454919, "uuid": "fbb4e022-7ac1-49d1-881d-31b2e6fdcc62", "comment": "Malware payload (njrat)", "value": "502ebc6a9cdc45a64a5c9ec9ab08aea656454402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712454919, "uuid": "028cd679-b88d-4e3c-9ba8-93edd1b08f99", "comment": "Malware payload (njrat)", "value": "40252701b3be3f4289c42d12250c722f616adf87a69580d47d5be42ebe462b56b9a4aa1578a85a5f1518ce95e90c0187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454919, "uuid": "a945f94d-abc1-42b2-85ac-3e74a68bc4cb", "value": "T1E1B30D387D952133C67AC1F689E50A8BEB69223F3191E8ED4CA752C418B2F156EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454919, "uuid": "708e76d5-4679-43aa-8afd-db31fb85a5da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454919, "uuid": "e06b0b7f-03e6-4317-83b0-3b3643dad461", "value": "1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMI:P5eznsjsguGDFqGZ2rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712454919, "uuid": "3de1c11e-01bd-41c6-9af8-4c8ce0b69325", "value": 115808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712454919, "uuid": "22e38055-ace0-4860-97c6-2c5795e02bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712454919, "uuid": "4c7cb7dd-398f-4c90-bbac-0b6c7e74c0a8", "value": "2FB6CA89C92A5179573603B1EABB68F3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa67279-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504493, "uuid": "c88d0a8a-4e6e-48fe-ac11-211f556a1696", "comment": "Malware payload (Neshta)", "value": "0e29434ee703bbc909e089b89d63335e", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504493, "uuid": "168abbd7-dd4f-4e2d-99e1-041ce2709545", "comment": "Malware payload (Neshta)", "value": "d0b999d1ccc53e9b5bb0b9fdcbc63be0de541061184ae0045fe5945d5baaecbe", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504493, "uuid": "f50bfd70-1d56-4add-a885-c5c077cf0f30", "comment": "Malware payload (Neshta)", "value": "92f48156241a4f5b69fb7d92922b6d0112a9a0d2", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504493, "uuid": "84e37073-8a9f-4b2e-94ea-c408413e0797", "comment": "Malware payload (Neshta)", "value": "6ba042c7fbaead66c3a563bca45fea1a5d98873ef12cf749ab4b7871f7a3dcd05a93abee319db221841830f2689291bf", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504493, "uuid": "d456a2e9-35d3-4523-88a6-b45845ba50c0", "value": "T1C2837C56F6E18872D0340EFC8C2AC268D57B7A317D2A1AB2BAF51E4DDC6D3D12D0C54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504493, "uuid": "7353b6a6-801e-40d6-a1a9-7d06183535e6", "value": "1536:32xqjQ+P04wsm16xqjQ+P04wsmJCcBHng:3Xr8lLr85CcBHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504493, "uuid": "44049b83-9ce2-4b45-97be-6f42ca91ef44", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504493, "uuid": "5730dd1c-9bd4-4c90-b123-b59c68daf490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504493, "uuid": "ce1e67d7-582c-47d9-a381-a90e63e5a360", "value": "d0b999d1ccc53e9b5bb0b9fdcbc63be0de541061184ae0045fe5945d5baaecbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa78afcf-f520-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712523248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712523248, "uuid": "1ec147d9-afb9-4be0-ada3-c8507d85bee5", "comment": "Malware payload (RedLineStealer)", "value": "b1284512da39510cfad55c9d000c6973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712523248, "uuid": "f22d532e-8c3c-4bef-9fb8-1595a443af2d", "comment": "Malware payload (RedLineStealer)", "value": "d120ced38346298e6050d82c112c10fabbbd240b759212b545658c0e9289165b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712523248, "uuid": "9c0058b1-21f6-4544-9b72-e2c2a25e319f", "comment": "Malware payload (RedLineStealer)", "value": "3fd55ac23698711601535781153a1047b4f9a65b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712523248, "uuid": "028735a6-e7ab-4b60-b9c7-b5b36b6f93f0", "comment": "Malware payload (RedLineStealer)", "value": "036773153558c28a9d49b8904cc98f57d2f04b71574be0a27e1bd729927265624f107a77a2a1aeb83337e78b3f997a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712523248, "uuid": "51cfe30e-5f3e-4c20-a64f-e5ac127bd6ea", "value": "T151642322963DADA5DCDC4D3C4FA1304218D36F2D7E15E19E0759202B5F8A3C7BA6A3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712523248, "uuid": "dca51fd4-e56c-4303-9d3c-1f9ec39c73bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712523248, "uuid": "9824cce1-5c47-485d-b42d-53b91bd1eeb2", "value": "6144:jB3dEsS3I3j8RMQ+RILLh/AYOOifna9WaKYtcfVByVxckHOT6I6Fqb:jJdEA4V+Ro5OGW5IO/y4kuTwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712523248, "uuid": "06d73a1d-cf79-431d-9c0d-13236b330129", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712523248, "uuid": "b3ad383f-461c-43d6-a0d8-a07f85c99875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712523248, "uuid": "a7b44a59-bd21-48bf-ad2e-193b7fe5fc90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2b45ff-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503955, "uuid": "4295f4a8-3544-4c72-9740-9f373532efe7", "comment": "Malware payload (Socks5Systemz)", "value": "0abe52ca622a255dabc888c173108e3a", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503955, "uuid": "a8c04485-5879-4535-b941-45100d77131a", "comment": "Malware payload (Socks5Systemz)", "value": "d3cb9e3e99e888b396695746fc4b73b03c792b98c920ccafaab0d14e47746f28", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503955, "uuid": "eac0bf28-4f77-4571-97c9-21b3db694190", "comment": "Malware payload (Socks5Systemz)", "value": "e932340a7089a2e6622a77601f72ebe30b207fd5", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503955, "uuid": "d24ec396-6d1f-4590-9f71-4ce61210b584", "comment": "Malware payload (Socks5Systemz)", "value": "e22c28940a664d1c4b7d96fb6c0fb326d0858b2eb500603524e758a51e8b38f76383e953a6dc2396b9a8d6cabeed2721", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503955, "uuid": "ab9131cd-0c7e-44cf-99a4-188816af5553", "value": "T1D4E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503955, "uuid": "4d3c54e5-696c-4c86-97a8-e1c9296a9868", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503955, "uuid": "b575656b-165b-40c7-87e7-c2689d73b9fe", "value": "12288:O+XssgiZdvAeRw3+axHNwju9zO0tHWbNx04xI9gOjjI1Y4hwfS9wHjpK657Rk2kl:KsgwdvAOitwju9zO0tHWbNx04xI9gOjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503955, "uuid": "ecf38ade-ad1e-4037-9389-8420c9897f1d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503955, "uuid": "4d1e5df4-4716-45b2-bd52-ee70d99afa7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503955, "uuid": "f3957498-bc7b-4be7-a988-fc8cd5ad11de", "value": "d3cb9e3e99e888b396695746fc4b73b03c792b98c920ccafaab0d14e47746f28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d58643-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504495, "uuid": "30e679a4-6b5b-4485-a5ab-83484c1926bc", "comment": "Malware payload (Neshta)", "value": "05b4f7d89232e933f5d6053544ea7dc6", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504495, "uuid": "90aff955-29e7-42e3-8015-742ce2e7c5ad", "comment": "Malware payload (Neshta)", "value": "d4f84f11de8ded3ffe7af89be3f436790ee8a6f78c779bf901ae268d187d6119", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504495, "uuid": "ff60a87a-579a-4177-8d5f-f7e6e2a6c30a", "comment": "Malware payload (Neshta)", "value": "cf7d7a6fd80f54051ca7897d1fa0cc0036f8e1e7", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504495, "uuid": "e7f7e69c-f121-4f6a-bd83-0387ade57860", "comment": "Malware payload (Neshta)", "value": "39fa43377c2308b2e2664ae0e59340f745cda1b8ab83f21eb27f5d767d6f5c298c0018bbfff651a33f1c98a1132ee5fd", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504495, "uuid": "e21a0a03-a376-47a2-bd65-37629c80e267", "value": "T120159E59F6E444F9C47BE57ACE46C22BE2F1B408537597DF02A04E6A1F23BD0693A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504495, "uuid": "d9221f9a-ef96-4fce-9d88-cc9f3ef57033", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504495, "uuid": "2438448c-a464-4551-9e55-78e89799ead1", "value": "24576:UDW/xbWX2YIb3Qsu3/PNL3Q7HybtTpAA+gU:UEaXSQsW/PNjQLY9ARgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504495, "uuid": "2d715a9d-c952-4b0c-944d-b1c4252d52ab", "value": 935488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504495, "uuid": "e907af92-431f-4cf5-8c09-1e97c34ebb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504495, "uuid": "9cb2a8df-3ca0-4964-8b01-f8e24e77915c", "value": "d4f84f11de8ded3ffe7af89be3f436790ee8a6f78c779bf901ae268d187d6119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529e6940-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504498, "uuid": "44c3bf78-5814-4b9f-b8a8-8dfc7f2da052", "comment": "Malware payload (Neshta)", "value": "a237fb71c1fed4d15f5dda13e3ca0587", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504498, "uuid": "664c68a0-c5d7-4cc4-bd63-b0426d9550b6", "comment": "Malware payload (Neshta)", "value": "d5476028063b7ffed68851f06769d3b13be10d892fed9d8c6851fa609eb48c17", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504498, "uuid": "d9893110-201a-4038-94fc-14ec5a864bd4", "comment": "Malware payload (Neshta)", "value": "18c790f99f2b1b8787d8461b060b9ea45899da29", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504498, "uuid": "28d4953f-84f9-4873-bcff-9ca42b63e4f6", "comment": "Malware payload (Neshta)", "value": "e18c8dfccaa16020d5f895929cbc40fb555878a07bfef5636fc571fc8c87389bd1d73e02f87d9be64adb300e096bd629", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504498, "uuid": "c5b1f8cc-9808-49be-8946-15b172de38ca", "value": "T166548D1133E0C4B2E0A3257A8D25C7B95ABB7C315965958FBBD81B7D8E307C1EA2434E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504498, "uuid": "066d161a-5499-4ef9-82ff-4d27e701c661", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504498, "uuid": "6ee910dd-4322-43ed-89f0-1c0025b610d4", "value": "6144:k9UMo6MHFqL7Uv1GJbA2Tl62iUESI7JgXfr:VMNMHYqEJbzTl6lUEvQfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504498, "uuid": "227b2921-db0c-476a-815e-60b0d02ee0e3", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504498, "uuid": "20471a2d-b9ff-4d5d-b63a-e541322fa45d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504498, "uuid": "8f2019d1-d9cd-4807-8f88-f55fe601d982", "value": "d5476028063b7ffed68851f06769d3b13be10d892fed9d8c6851fa609eb48c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b489f45-f535-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531866, "uuid": "5c0bc343-e241-41ab-a930-4d7ff3f745c5", "comment": "Malware payload", "value": "5a9a7eb3ae570ba2827f9b43f0ca8d8d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531866, "uuid": "bc208ef3-3566-4d39-8c11-3f5fd706bc1c", "comment": "Malware payload", "value": "d5adb611966a10b056fc53bec138ad1dfd319c9d631eeebfcbdb13f101afc8ff", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531866, "uuid": "05e7ebce-49ae-428f-acaa-98bfc5fdac35", "comment": "Malware payload", "value": "ff206f36fb8117bc112b915e6c523047e3ef0c8a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531866, "uuid": "eba09d17-4fcf-4483-a40c-b386c86a2996", "comment": "Malware payload", "value": "5aee150c8b3b3dae8931efd8b7d505eeb68ab28624e3a64fdcae3de41c83545fa9d4e19b4d519552f99d4d855b834c5b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531866, "uuid": "9b510843-888c-45de-8d45-c11127d0752e", "value": "T16256E4243AFA5019F133AF755FE47996DA6FBE723B03645A10503B462A33A81DDC243E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531866, "uuid": "2731a819-68cf-4812-bb67-6bc1e4c5bf2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531866, "uuid": "d0967999-e0b9-401b-bac6-e7ef461c65b4", "value": "12288:s6umEODqMBbbtP7MjII99YeeF5NM6r0N:E6pdXeem4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531866, "uuid": "39b6554a-f18a-4ca2-be7f-56b578611e20", "value": 6212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531866, "uuid": "780f5400-6bad-4cb8-93b2-579cc83b9c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531866, "uuid": "9a9d1f97-ddb7-432d-9e2b-c793a8ebd868", "value": "AIDA64-5.97.4605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103295c3-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503957, "uuid": "4fa94afb-5e32-4a45-9cfe-86e03ee855c8", "comment": "Malware payload (Socks5Systemz)", "value": "cba2ba02ece2a4c1b06467f423abb216", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503957, "uuid": "eaf59802-1e86-4a25-bf11-1e74ee89b6c4", "comment": "Malware payload (Socks5Systemz)", "value": "d63c26be41e22bc47e0091eb0a4d6cf7ad208fc21fde4b76423d51dbc5b4a028", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503957, "uuid": "06f7fa70-7174-4c85-9d0a-3fba98d027d0", "comment": "Malware payload (Socks5Systemz)", "value": "939862c15711bb3d1ae92940efde213dbf2f4024", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503957, "uuid": "8a5624f4-82a0-47dd-89e3-98ab3e9a7d4d", "comment": "Malware payload (Socks5Systemz)", "value": "1bfb731fa08269fe0b8ab7765e5c2f436520ab4ad961ebac64c3cb50cb5266d425cdca8d97f368edb8192badf2a9e802", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503957, "uuid": "0682b618-8c87-451e-b9ea-f7c42135cd9a", "value": "T177E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503957, "uuid": "804b48e0-d454-4be2-980e-5c2a4b2569ce", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503957, "uuid": "827e79f9-ceec-4ec1-bc54-37ec879fb0f7", "value": "12288:v+XssgiZdvAeRw3+a1H1qtu9zO0thW1Nx04x49kOjjI1Y4hwfS9whjLy657Rk2kJ:LsgwdvAOGVqtu9zO0thW1Nx04x49kOjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503957, "uuid": "f9039d2e-db3e-4e3e-8bac-90fcf4e10279", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503957, "uuid": "a0781a3a-d778-44d6-9db7-ac1347f7a8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503957, "uuid": "52ecbdfa-c6f0-43b4-b264-1838cfa9cd6a", "value": "d63c26be41e22bc47e0091eb0a4d6cf7ad208fc21fde4b76423d51dbc5b4a028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113c4d7e-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503959, "uuid": "fea6c884-1c22-4cc2-862b-11adbd3ca5ee", "comment": "Malware payload (Socks5Systemz)", "value": "40e1d68ffa8a231781fdae228c3126d1", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503959, "uuid": "a49162cc-ea73-4560-9537-fbad49f3cdda", "comment": "Malware payload (Socks5Systemz)", "value": "d641ea86d1af245cd22769d2cc17bf2e281bb003d416c2a5ae2e22c2ee6410ac", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503959, "uuid": "5e9ee4e4-6ed7-4e6b-b9e5-5487f44e3f01", "comment": "Malware payload (Socks5Systemz)", "value": "bcf3f259946cb49ab194f90190705de69c3e1147", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503959, "uuid": "741f3cd4-a1f2-45d6-a2a9-16668dc51a20", "comment": "Malware payload (Socks5Systemz)", "value": "e12c2307102ad14b7d3aaa95db7adc0b61f3b51a686c6df7e345023a3854c68da5a1cccb27109e11b111c0db1d4c2a85", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503959, "uuid": "3c2385cc-3cf8-4041-93db-9508f6c805b9", "value": "T18DE49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503959, "uuid": "359ee931-a613-4f97-8390-a870cd879a46", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503959, "uuid": "2bdf7102-4d63-478f-9b16-f1bc5214a96d", "value": "12288:v+XssgiZdvAeRw3+ayHB6pu9zO0txWhNx04x89gOjjI1Y4hwfS9wBjPC657Rk2kR:LsgwdvAO5h6pu9zO0txWhNx04x89gOjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503959, "uuid": "e7e7a2ea-1a0f-47ac-8809-9723bfa3369d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503959, "uuid": "e15764c4-0bed-49d1-a654-d27fdeaaf2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503959, "uuid": "5fb26f06-f80d-43d1-933d-30cfb01ac1e2", "value": "d641ea86d1af245cd22769d2cc17bf2e281bb003d416c2a5ae2e22c2ee6410ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bf93b9-f534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531689, "uuid": "9fe4429d-5bb8-4a93-8de6-de282aca21e7", "comment": "Malware payload", "value": "dae5d49730ef35741792b75338b2de34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531689, "uuid": "5dbece7b-a13f-4f1c-8095-d9bd649390c2", "comment": "Malware payload", "value": "d6803074155f1cd40ea6c5591be2c1b99e96cc05aa61dfe5b4bfd74118f0a761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531689, "uuid": "7c27ace5-f18c-4445-abd2-1f77740ac432", "comment": "Malware payload", "value": "ea52258984c3b364da815c2c6b01167f9e21f89f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531689, "uuid": "b72433e6-d64d-41c3-a209-e9253952c4dc", "comment": "Malware payload", "value": "91567cdc53e68fb95c2498acb60427b696757bfad7a0addca86d64b4efacab6f99ae1dc83edb9c09d6bf285e74fa839d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531689, "uuid": "8715a5ca-505a-45d1-ad91-c77e43a88283", "value": "T194956C0B72F244BEC0C9C830866FD2569D31B0C40636797B3E9499711EE6E786F6EE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531689, "uuid": "d2ab287c-f72b-4dd4-be72-c4c6c1dd8e2d", "value": "24576:tiL1IaEe2hU7Q9BSB3shhLFjLBtLwlHv8jEwGlswN82eWqJJc1x:tiLSaEK7QP8sXFjrLwlEhG6CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531689, "uuid": "a3de1429-a33a-42fc-bf8f-1d69ddd89382", "value": 1996624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531689, "uuid": "90e2de6d-e3bd-4dbf-8385-7e2264151fc2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531689, "uuid": "5a5e0ce0-ddf4-438d-a989-8348e6df6be5", "value": "qemu-or1k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536b9f03-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504499, "uuid": "f971d7b8-212a-4cbe-ad2c-201af1960191", "comment": "Malware payload (Neshta)", "value": "b5360ceaa1163d9e9ca9653aad38aa55", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504499, "uuid": "3c0e478c-6cef-4aea-bc4f-76906d6c0fde", "comment": "Malware payload (Neshta)", "value": "d8965d00d38ef6a4a30a637ae2e7038dc249fc951a4bb619821e48cf96c1d9ed", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504499, "uuid": "9519a9c8-2407-4447-993d-5a755d8947bc", "comment": "Malware payload (Neshta)", "value": "f781fce904c6745d4c751ff62be1391ca038a505", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504499, "uuid": "8c2c411c-7567-4dfe-83bc-94594643b197", "comment": "Malware payload (Neshta)", "value": "21806b8b1345a52df9a4a910137c471f207228c1049bce639fb343a04fcd9d90c77a50cac99b6d889b7f3c7e4c6ea7ed", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504499, "uuid": "61f68bfc-354d-44ff-8bdb-67bd4afb6a84", "value": "T196835C56F6A18871D3241EBC8C25B264C53B7AF03D2D1EB2BAA53D4DFC693D1290C74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504499, "uuid": "028da4f0-42d3-4959-a82f-33cfcd6b7125", "value": "1536:32xqjQ+P04wsm17xqjQ+P04wsmJCcBJG:3Xr8lCr85CcBJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504499, "uuid": "0832edee-1a2a-48f7-8b38-c8580b749ed6", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504499, "uuid": "42ecd053-bf5a-45ed-925c-935ca45eb05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504499, "uuid": "fd0a01ce-886e-40df-b980-18e99c66b489", "value": "d8965d00d38ef6a4a30a637ae2e7038dc249fc951a4bb619821e48cf96c1d9ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544d9184-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504501, "uuid": "189924cb-2066-4a04-8674-3d6ba735a800", "comment": "Malware payload (Neshta)", "value": "b45bdd86a4586837f7ffe8052942a765", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504501, "uuid": "04af9cee-27ae-44e2-a5b0-409ac1e592aa", "comment": "Malware payload (Neshta)", "value": "d9927671fa0f099e3f1dfc998b9b847252d76e0ec19f032d4e73842a24e87230", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504501, "uuid": "f23f8158-74df-43e9-b7ae-792f644812a9", "comment": "Malware payload (Neshta)", "value": "00a930c187de487329de2dd6ad8beb601d3c30dc", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504501, "uuid": "2fde9a4c-419b-4cd6-b09c-4f165da11b27", "comment": "Malware payload (Neshta)", "value": "035129c729db5112a3e0709b6b0a29dcaded8867c51dfd08bb307dd4b24cf0c28f3368467b80ecde042c5fa2717614ee", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504501, "uuid": "408f9ed0-e5cd-41c1-b311-d1da353cd4a8", "value": "T131E38D0673E054F9D0265678CCB69614D3B3BC364A78938F37A43B5A5E733822D2E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504501, "uuid": "926489ca-50bf-4624-9178-b5a323a858a9", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504501, "uuid": "d49a3563-d126-4011-86e0-5d1019bfe0b7", "value": "3072:sr85CkkbAYn2GgYlBYN2fHYTo+0Ht8wDSRUTT:k9xbAMpgY3gTw8DRUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504501, "uuid": "0c112aef-9f89-4fcd-9c0d-d23f52958064", "value": 149898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504501, "uuid": "31f4ff81-0738-469c-80d3-e79abdb0f32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504501, "uuid": "58c9cf33-c662-4f62-b88e-aba2552ac5ed", "value": "d9927671fa0f099e3f1dfc998b9b847252d76e0ec19f032d4e73842a24e87230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c8d192-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504505, "uuid": "f5b8634c-7b81-44b1-b928-d8d87f390c68", "comment": "Malware payload (Neshta)", "value": "00d4f4dd975bbe5d5e396bfd354c34b6", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504505, "uuid": "cc4a0837-dc5f-49a0-92d0-7a171d102894", "comment": "Malware payload (Neshta)", "value": "d9f8dc199c8edeed9c75e3e753f529f990dc77d59a08b0f0e64ba840f51cf9a3", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504505, "uuid": "6973bdad-fd17-4029-87fe-71cf42efef58", "comment": "Malware payload (Neshta)", "value": "02636cee8177f2ebcc6ac1b2aed361d681ad689f", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504505, "uuid": "95c27829-0e5c-4549-8daa-493be87feccd", "comment": "Malware payload (Neshta)", "value": "2450c44c51a29b30eb2016795d5e93c2a3b08ecb838dfcff8cd0d402a77df1442c6b2de6810ac3a158be46984c824a15", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504505, "uuid": "fbdbd178-be3d-4697-9c6d-bf3c69d70b63", "value": "T1EBA47C01B790CF31D16F053A9D6996B85A6F7D209F248BDB23943E1DBE302C1AA35B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504505, "uuid": "4e35508a-551d-4bc7-8920-512b04d24a05", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504505, "uuid": "33af8658-e5f9-45dc-8ec0-654d372eea84", "value": "6144:k9QjzhZ2opkGe6vyuTHfx/J+kvuuHcLBuiyt1M/VvoQ3mvwBVO/GuSkkN9:d+66uTHJ/J+kvvcLIb1M/Bo0lBM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504505, "uuid": "5f8aeed7-d714-4a07-b612-375aec987d6e", "value": 451544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504505, "uuid": "3032df54-2d81-461d-8eae-6b83d56b9ecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504505, "uuid": "19ef7630-985e-42c6-ae76-ea724ca3877a", "value": "d9f8dc199c8edeed9c75e3e753f529f990dc77d59a08b0f0e64ba840f51cf9a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969adc4c-f535-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532100, "uuid": "efa6e136-b1d5-46a0-93bb-9ff51e2453d9", "comment": "Malware payload", "value": "5c113739b83351782aaab34dce9adf8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532100, "uuid": "fec8628b-790b-4cb4-a50d-1bbf3cc00c8f", "comment": "Malware payload", "value": "da0767c24ed7b02eab64293e8f2f25c514245adbf9b5733a13e326a5152c9bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532100, "uuid": "2c7f0de3-8ecb-4c6a-bead-702394586de3", "comment": "Malware payload", "value": "96ce2a7ba09e32e519f16d806b95113702a8fd07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532100, "uuid": "c370fc51-2e8b-4ebd-b1f2-c8fbad23dc2c", "comment": "Malware payload", "value": "84c3891a56a450c74b51fc99201a292c0edf28b84ae8f03aeb7e72ff8b4ce91bc16d891c3a9702f83bd253187ec79319", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "rooter", "colour": "#5DC73C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532100, "uuid": "f64a6382-5e85-4d16-ac81-1f81528c4531", "value": "T12CE728C36081C9ABC1AA8134DE9EDA363630B45793916BDB3248DB35DF70AD4533BDA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532100, "uuid": "17361089-1beb-4db3-931b-af90c133fa4a", "value": "786432:ntUR7VFa8J9Ap5HOd6FKP4jgPJSSKL6sg31A/Caia0aLQaLt4VFLEsFay780psSo:t+TOWQqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532100, "uuid": "d21c05db-9630-4c97-bcd4-71afcbeb5671", "value": 65359456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532100, "uuid": "bddf4503-42ea-49d7-836a-bd80dcb9992d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532100, "uuid": "72f42399-4f62-4616-a306-51ef01a7fa91", "value": "vmlinux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1259c998-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503961, "uuid": "ff197aa7-0c8b-41c0-bd59-29302d1b6507", "comment": "Malware payload (Socks5Systemz)", "value": "2252969799a977ec7ce561f2e19d6bfb", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503961, "uuid": "f260e338-55c4-4820-884d-ef8d29f9715b", "comment": "Malware payload (Socks5Systemz)", "value": "db306b964c054c8e60b15dfd3fbbca6260ada01f681714e79639789b63f7852e", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503961, "uuid": "10502e18-14f1-495f-8f1d-159f913a9c2d", "comment": "Malware payload (Socks5Systemz)", "value": "b8089383c8d19ab1b5314064404a7889fbc33ef9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503961, "uuid": "99b5446e-79cd-4b7b-b41e-7d9583c112d5", "comment": "Malware payload (Socks5Systemz)", "value": "c64783a4151daecbf1ca885ec6934b639965a572c75fe83b203a3671922d6861fa78b933121327b2f587822927642751", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503961, "uuid": "98cdbe41-5232-44a9-9034-c9bb3bb0a187", "value": "T167E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503961, "uuid": "5c7cfcac-839a-42fd-a7ab-25f73845111b", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503961, "uuid": "ac3420de-efe3-4ab8-8128-4b821fb416ac", "value": "12288:O+XssgiZdvAeRwZ+aaHPvwu9zO0tKWsNx04x+9QOjjI1Y4hwfS9w0jQi657Rk2kB:KsgwdvAwBvvwu9zO0tKWsNx04x+9QOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503961, "uuid": "f86c2c14-47ff-4842-946a-f9bdbd8933de", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503961, "uuid": "2bd7f005-dd38-415a-bf73-53ca7ec14314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503961, "uuid": "269d9904-3985-433e-a23f-bc44735844fa", "value": "db306b964c054c8e60b15dfd3fbbca6260ada01f681714e79639789b63f7852e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a3af0b-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506538, "uuid": "707a4e29-4714-44aa-b735-f18bfb1cb774", "comment": "Malware payload (Mirai)", "value": "719cffcb029a655bce1fcf3f0818f768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506538, "uuid": "550d52df-75ca-4d4f-a0c5-3da1609d4109", "comment": "Malware payload (Mirai)", "value": "dbe7ded97aa45178768c61af7a33b0a1c94af4d36dc217481f81ddefe628b443", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506538, "uuid": "93fb92cb-7388-4019-91cf-85a7ec2d028b", "comment": "Malware payload (Mirai)", "value": "b5caff854afb8bee7bbc2ec5159fd7f22f86a505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506538, "uuid": "bcf6a042-8cd3-4589-94ef-82f0dcdf88c6", "comment": "Malware payload (Mirai)", "value": "da6b9240d6a6dfa1ff81332e18501fe975eb71d2f3d9c5751bd5ce43a343a093b1ebca037dd9ce1fae8f1bed1c4fb23c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506538, "uuid": "0fc227b8-12eb-4b75-9289-3b8f387f1c01", "value": "T110042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506538, "uuid": "9866877f-3845-4663-afcb-24bd8f086c90", "value": "3072:HK/lcyNbBLbcBCkoajwdyqkk4/T/6EBpZu/hJjogM/RHWT+M:HK/bBLbEloajwdybkwRBzu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506538, "uuid": "8dedeea6-6b8f-4d55-a020-8d0fbd6adece", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506538, "uuid": "b43d8bf0-a4f5-4bdd-9cbf-1893b0410813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506538, "uuid": "f3f6115d-558c-4166-8521-5a6a0552e60c", "value": "719cffcb029a655bce1fcf3f0818f768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136a8351-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503963, "uuid": "04b5e00c-fe7b-40c9-aa94-0f8eecdd4c8e", "comment": "Malware payload (Socks5Systemz)", "value": "6ec93a454de7657f31aeb6fddcfa4b98", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503963, "uuid": "3ac54189-e5fb-4525-9d72-b45772e5df03", "comment": "Malware payload (Socks5Systemz)", "value": "dc14059926015d792aa786c9188794c2cf4f9bc69f578134c8dd983e9e541c14", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503963, "uuid": "d2b5bb24-4087-4f48-a38a-c6e3ff4eaf92", "comment": "Malware payload (Socks5Systemz)", "value": "0c90cc8d26d578a6e3e204fc3ab989431e0e3bb2", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503963, "uuid": "566f3659-7e94-4c9d-b7eb-56a3573f3185", "comment": "Malware payload (Socks5Systemz)", "value": "36432975467adc7be6cf0da773f4140c727faa4a42ae16de6c3c38ab87f00f4cf2e513248ba5d50f3cfde98993992fa2", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503963, "uuid": "3138ca58-e606-475b-a2d9-1dfe2bb23ec3", "value": "T1C5E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503963, "uuid": "e782cbb8-5498-4f72-8cc2-81985d6555f7", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503963, "uuid": "6b56b1d6-3ff6-48a4-9aab-dceb05d58290", "value": "12288:O+XssgiZdvAeRw9+amH1sHu9zO0tbWHNx04xw94OjjI1Y4hwfS9wzj9C657Rk2kd:KsgwdvAExVsHu9zO0tbWHNx04xw94Oja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503963, "uuid": "3c550676-0b3c-4897-9c13-7c8ec4a86c40", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503963, "uuid": "01d02795-f765-4340-8e23-99946ce147d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503963, "uuid": "1d43a81e-581f-4577-bc91-fcff83b21ac1", "value": "dc14059926015d792aa786c9188794c2cf4f9bc69f578134c8dd983e9e541c14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14754272-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503964, "uuid": "101b839e-909b-42ba-8208-d97db9da1be5", "comment": "Malware payload (Socks5Systemz)", "value": "328bfee978762604f249222ea5ba43ad", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503964, "uuid": "5deb12e7-c6ff-45e1-bffa-93340e33cc9e", "comment": "Malware payload (Socks5Systemz)", "value": "dcb66b071920dc9e5761e9696851d29bc895a131e64e03f2e48f827bcdbe84c6", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503964, "uuid": "70f3f169-ced8-405b-b33c-eff3106215f8", "comment": "Malware payload (Socks5Systemz)", "value": "978f01616a0e179d12b0bda5af5d624c6dee6d79", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503964, "uuid": "95164717-834f-47db-a695-4845799ac788", "comment": "Malware payload (Socks5Systemz)", "value": "29f61501235a9dd83e46c1485e9dfb9ccb3acd3757cb3ca1a8e82d390b5b237116c933c4bbcb8ec5bb9c090fc691bb73", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503964, "uuid": "ba7e20a6-4bd2-42a4-a6c0-45fa08e70855", "value": "T1D5E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503964, "uuid": "c1252bf7-1b85-42ca-96f2-9085abb1fa65", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503964, "uuid": "13fb0c9a-f90a-4c32-8f68-85bf84e969db", "value": "12288:v+XssgiZdvAeRwm+aNHRGNu9zO0tFWtNx04x09IOjjI1Y4hwfS9wNjzS657Rk2kR:LsgwdvALaxGNu9zO0tFWtNx04x09IOje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503964, "uuid": "0c2430df-da9e-4c10-809c-7edc5b783822", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503964, "uuid": "9a42bc99-045f-4e28-adf7-6a89daaaa217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503964, "uuid": "bb206ce3-f2ea-49c1-a5a0-60a3eaeb0d4b", "value": "dcb66b071920dc9e5761e9696851d29bc895a131e64e03f2e48f827bcdbe84c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157a7766-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503966, "uuid": "6ce4ce61-3676-4ce7-bab3-664d80ae8f02", "comment": "Malware payload (Socks5Systemz)", "value": "fcffdcbfe19c2bb4e70db8e23ca9d814", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503966, "uuid": "df2bbf07-7f7f-47ea-973d-81e8296ca5d6", "comment": "Malware payload (Socks5Systemz)", "value": "dcc886ce5295291e9b560567896a1182335909e5befd3fab6c7897ce8e7abf1b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503966, "uuid": "5b14cf33-0f8d-4b61-8073-97113489d886", "comment": "Malware payload (Socks5Systemz)", "value": "2e6307da8022496209abfb28b693a6f5324920b8", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503966, "uuid": "64353f2c-dffc-45a4-a298-d9b528487399", "comment": "Malware payload (Socks5Systemz)", "value": "3c8630d4282d21bbe01a184dfc672fff02018a8d39fc2679f098bcec26b98008545bb8688e1b7793eb50383fd3e367f0", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503966, "uuid": "8cb9b6d0-cb49-402f-a3dd-ba8105336556", "value": "T168E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503966, "uuid": "1dfd8643-d690-4015-8570-03382f1478ac", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503966, "uuid": "6fe7e7d2-33b8-4604-9abd-bd0fabf59ce1", "value": "12288:O+XssgiZdvAeRw/+acHzR+u9zO0t0WiNx04xy9QOjjI1Y4hwfS9wuj6m657Rk2kZ:KsgwdvAWXTR+u9zO0t0WiNx04xy9QOjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503966, "uuid": "56cbb7be-feb3-48d8-9e12-3340030eb563", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503966, "uuid": "8b4a7a67-bb72-4b3f-8801-139301ac0f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503966, "uuid": "5ee8f90c-2bbe-49a2-96c3-d60602d908c9", "value": "dcc886ce5295291e9b560567896a1182335909e5befd3fab6c7897ce8e7abf1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e873bf3a-f4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMoon)", "timestamp": 1712505179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505179, "uuid": "d5f3425d-02a1-43ca-8b81-b3948f85f17a", "comment": "Malware payload (BlackMoon)", "value": "ac26e4b85238a1b0548476bdf007147d", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505179, "uuid": "805b6897-1ce0-41a3-bad7-f7d418dc683b", "comment": "Malware payload (BlackMoon)", "value": "dd1d9696233e7e8de39d4224dac008e429f37da3c4696d8e13a6acba943be8d6", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505179, "uuid": "7ee8af42-c580-40b6-a137-d235c1faef6e", "comment": "Malware payload (BlackMoon)", "value": "0489f684b5470f45420606bc0ddf5a565e2b2ce8", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505179, "uuid": "6d3d3c8c-e068-48e1-ad6c-3628301adfd0", "comment": "Malware payload (BlackMoon)", "value": "67f49f5d61c1b04eb6dd6d91da0718499b1742e4072462a749ac3b549739d57bb879c5807a7ead35439333cf204d5167", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505179, "uuid": "6656206c-d506-49d3-8c6b-42f855eb53a4", "value": "T1A2F30822E51388F6E02D05F557F2073C9979876368B24AAFCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505179, "uuid": "c90011b5-3547-4f6b-b393-d00df825e6f4", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505179, "uuid": "9fa10b4d-855a-4c96-956e-ec919f729ac3", "value": "1536:ej+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy88:eqSe5OmiEoAcCbZ6FNoutbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712505179, "uuid": "03d87a14-999e-41b7-a6f7-f0216e835283", "value": 159790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712505179, "uuid": "6848c440-9f0b-4951-a8f4-b8953094aea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505179, "uuid": "95adb114-13b0-4cdd-abc1-d99d9ba8451f", "value": "dd1d9696233e7e8de39d4224dac008e429f37da3c4696d8e13a6acba943be8d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa847467-f48b-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712459119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459119, "uuid": "85d491a8-4526-4cbb-8c7f-86d5c9df011e", "comment": "Malware payload (Socks5Systemz)", "value": "ab4d2c457f184189e42cb91fc0177bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459119, "uuid": "b45d74d4-270e-4f23-8876-b7250b58799b", "comment": "Malware payload (Socks5Systemz)", "value": "dd882143f9c146b917ded748edb3931c07fe03169735a6eb2473eaa643c1313b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459119, "uuid": "9f224987-cb58-42d9-8550-6d55cf27e177", "comment": "Malware payload (Socks5Systemz)", "value": "daaaa2c14ceb7ecf8130a184f15ffd6cb4b4923b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712459119, "uuid": "72598e8e-d672-4e21-bb1c-f075f6f707d1", "comment": "Malware payload (Socks5Systemz)", "value": "92d8217def11cb6266f50160d3e367c3caa15e3b52f9c1f2090fa5b58807ded441ac3cf1caf071ec15e3e5b0c3c22850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459119, "uuid": "5b8fbbfc-b74c-44b5-b9c3-9275a37397ce", "value": "T10B16333143A76D36C962CF32A09C85050BA775EF2476314E759EBAC47EB30B198A731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459119, "uuid": "3f9e258d-7b21-47af-acd6-0a38f5f034d9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459119, "uuid": "b09d7041-2ba8-403e-bcd3-edf4620ec302", "value": "98304:CRy9ReM3ZmFQRrPXeFlXOGNx2AvFAeuTSfQx6E:jeM3ZmqRryleS5HQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712459119, "uuid": "5a2dfd26-6f0d-4108-8a17-50995b11fb4f", "value": 4296997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712459119, "uuid": "fffe58d1-b554-4500-9190-84a2022af2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712459119, "uuid": "9df6a881-c480-4466-a7b1-942d9935ba50", "value": "ab4d2c457f184189e42cb91fc0177bae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1750db2e-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503969, "uuid": "88a3b2af-b2cc-4021-b6f3-a4e2678cf141", "comment": "Malware payload (Socks5Systemz)", "value": "2e37f9fc67931d14dd45453025d57487", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503969, "uuid": "fc7f4093-2143-410e-9e90-4f63aa88cb35", "comment": "Malware payload (Socks5Systemz)", "value": "de86fbc29cbe1cca222a69c0554071e5b8a678f53f1a03d76d246c211f5184ec", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503969, "uuid": "1b9f17ca-8408-493a-b3a1-8b514a956c63", "comment": "Malware payload (Socks5Systemz)", "value": "63cc22d9826b5a7042104ab5441a6b059536f238", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503969, "uuid": "6ecd7c36-1e98-47fe-a366-22c2da580965", "comment": "Malware payload (Socks5Systemz)", "value": "362cb15d98b90b78a595084fe473440db72e8808272a73b6d299e3cf6911c81299d1aa4d895aa0bec92f8dd4f9bee129", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503969, "uuid": "5e99ab1e-58f3-40f5-a90f-f4dbb1c826dc", "value": "T161E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503969, "uuid": "720abdea-6e6b-4f97-9066-2cf336239d52", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503969, "uuid": "6b32da2b-a9b2-4976-96ce-c25278db12f0", "value": "12288:O+XssgiZdvAeRwEc+a2HHLEu9zO0tWWYNx04xW94OjjI1Y4hwfS9wgjEi657Rk2M:KsgwdvAkh5nLEu9zO0tWWYNx04xW94OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503969, "uuid": "51a156f6-6a9c-4fad-987e-7ffbe7d9aedd", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503969, "uuid": "3b5fd996-7c05-478f-bc72-1ad8ba917ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503969, "uuid": "7040f18e-b49a-4e62-b7aa-3c5b2a514d05", "value": "de86fbc29cbe1cca222a69c0554071e5b8a678f53f1a03d76d246c211f5184ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60fc352-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712533038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533038, "uuid": "165d3a60-b163-4193-829a-4e22f21098c7", "comment": "Malware payload", "value": "c1946b25d18ea03d01d695f9b554b215", "object_relation": "md5", "Tag": [ { "name": "big_numbers2", "colour": "#49582A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533038, "uuid": "26f0f305-2c73-4816-a072-4c250bafd182", "comment": "Malware payload", "value": "de98110ff434aec19ed57e07409e4edaa3241eb7ec5c7394cdfddf03133e8694", "object_relation": "sha256", "Tag": [ { "name": "big_numbers2", "colour": "#49582A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533038, "uuid": "f54da286-8ec8-4a29-b6d1-6c2adaf164e9", "comment": "Malware payload", "value": "dc9f5888b0d8b3f59a999c7ed8438ed407d41489", "object_relation": "sha1", "Tag": [ { "name": "big_numbers2", "colour": "#49582A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712533038, "uuid": "7935efe7-c527-42d5-a1af-8950b42dd8de", "comment": "Malware payload", "value": "b9206209750d6dfaa7545adf7f75d182a2b5d5d9062878b09786b57d3c2bb689e2c12bd8cc68a70cfcf06107d861c238", "object_relation": "sha3-384", "Tag": [ { "name": "big_numbers2", "colour": "#49582A", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533038, "uuid": "e318690b-bd4e-46af-941f-95396876caa9", "value": "T178255C47A6F214ACC5A6C470869BD5B37D72B45502346EBB3694CA303F53E701B2EBB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533038, "uuid": "ade376d4-d4f2-416f-aacd-d3a5d1851d15", "value": "12288:ZlDfcMR9pzXdu0I6Q6zeCRathhzkJzmqH8TdDejY5/Gw5kf:vDbBXdu077ggmqchDejEF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712533038, "uuid": "6911630f-9d46-4a37-85ea-d3433a2000ba", "value": 1026032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712533038, "uuid": "ca4ca330-8e88-4846-a3eb-61bb4e4d8c2a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712533038, "uuid": "7ec94317-31b1-4659-ac38-4077c0a758f2", "value": "strip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf93a747-f519-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712520143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712520143, "uuid": "89699fa2-a555-4343-94b7-77dc4cabbaad", "comment": "Malware payload", "value": "6ffddfaa28979ea075045cd5a8d69cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712520143, "uuid": "fba62074-040c-486e-9473-83929e154831", "comment": "Malware payload", "value": "df85d61e9523c0f3012f47049bec8c388f7bc8cf5e4daf4ead1f1f1ed0a60c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712520143, "uuid": "d41f093e-0f42-404a-85fb-d527530bc852", "comment": "Malware payload", "value": "f69ed91bbcfa5061b7261fb11935c19a9ae52aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712520143, "uuid": "2c0ffbf1-12ec-4349-836d-079eff39f770", "comment": "Malware payload", "value": "c558f880b553f94a94840f078878453c19b9e1df709cd8239dddd1cf57494cc99a11730d71936ef7787b8d73b1252922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712520143, "uuid": "cc5ad662-fda8-4064-8be2-6fd7dc9efbf6", "value": "T1AF24234AEF38ADA0EAA4B230866DD656C7FC4AD75D07510A4CDE56CB87F838D40097CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712520143, "uuid": "22a590c3-07d9-42f9-90c3-aa990c61b1a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712520143, "uuid": "952687f2-0cb7-4dc6-b5ee-3872667b9b05", "value": "6144:bJINz3fZmYbDhiX9wLWLKfzNv75mHrk/NOBRLyA:ex3hmYbI9SJh6rkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712520143, "uuid": "bac3516c-dae0-42d5-88eb-77660ba0a685", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712520143, "uuid": "02a916e0-2f8e-4d47-bb23-96ffe6b3fce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712520143, "uuid": "daa379eb-24e0-4d7f-b236-c513c4680e51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0abcd38-f496-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712463880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463880, "uuid": "291556eb-e6d4-41b1-a18c-c68dd3d68a96", "comment": "Malware payload (DCRat)", "value": "b1c1d5a5a79f7dcc878b3648a0bcb0c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463880, "uuid": "8b1da394-1f47-485e-8fe8-d3f938fd57a6", "comment": "Malware payload (DCRat)", "value": "e0abb4fa147097a4fb1758ed20b7d1a54f020d0de2d8144a2beaec404acb4d4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463880, "uuid": "eefce354-a1a4-4700-b7cb-598ee61f8477", "comment": "Malware payload (DCRat)", "value": "595a5c2d50e0675fb2a35f8f01aec12c3bb03b3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712463880, "uuid": "d99d3a96-8f04-4fe4-a302-85288add7d69", "comment": "Malware payload (DCRat)", "value": "2420889a7e56efddab698c60a9eae5e9797a3db2bdc3e2664f93530985f81ca202704315012161d793c1c82a63d4e8de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463880, "uuid": "e654248b-8924-4803-b610-c1242c4e642d", "value": "T12CA53353DA547077CD4A427280E2BBE57781BB2F9D03C43465D3A8614A1CBABCAD373A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463880, "uuid": "b4eed656-2e04-4149-bc18-05da33b4bede", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463880, "uuid": "abf67d2f-7660-45d4-8ad1-82ddf8a5791a", "value": "49152:lS5Y0dPfBBpa1O/VZjTfcy2tyEGc0ng/5nH+VO7O0G:lSJBqU/HDctyJc0gZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712463880, "uuid": "cd3b06c6-83ab-4e9e-9e07-0ef2a1f7d5d2", "value": 2179584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712463880, "uuid": "d78e469d-e842-447c-a40e-e6c312d5aa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712463880, "uuid": "e5afa821-bb48-42cf-a728-aa6be6cfe58f", "value": "b1c1d5a5a79f7dcc878b3648a0bcb0c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066e0272-f515-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712518114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518114, "uuid": "1c6f166b-738a-400e-bab1-6336a0d515b4", "comment": "Malware payload", "value": "f84709bd3f4c368aabed075829a01d78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518114, "uuid": "9121de88-f1d3-47c9-9f98-c04a0c4baff9", "comment": "Malware payload", "value": "e0fd9bf32a7a23616a127328d98061f06fc2f0222c1abe11ef8fa877f42eebd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518114, "uuid": "cb322798-ba2f-423f-b102-96100b984962", "comment": "Malware payload", "value": "8a946717084e014acfb692feb1a13f2b0c6a7a2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518114, "uuid": "53033eea-731f-472a-b2bb-8049729317b6", "comment": "Malware payload", "value": "effbff31b0b1b6d065ec54aaa096c0247d91cbb88c6214cf5fe2c88b7343fda234803821381ace0f607b303bd21aa70f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518114, "uuid": "4e5e9e31-8612-4bd2-a2ea-02328e49a32e", "value": "T146B318825600D573E1033BF802AFE6220072FDFE1A57C566E3897DFC86764963791B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518114, "uuid": "a4e28042-a97b-4f39-8afe-d069bcd2e8dc", "value": "3072:QB/la/zS8QUGzXXaxntk/TBqFpA1t+Z0Ua3hgp6W:d/zS8dg6jGTBkpst+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518114, "uuid": "d689abdd-0213-40b2-9dbb-04c52f85ece1", "value": 116498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518114, "uuid": "05c6560b-8639-47fc-9bb2-1771e24e9d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518114, "uuid": "dc62bbb5-7151-4abe-b0b2-56f6572b9c31", "value": "f84709bd3f4c368aabed075829a01d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fc2132-f47f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712453717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712453717, "uuid": "7b9a06a7-478e-4219-a500-36e44ad3112b", "comment": "Malware payload (Socks5Systemz)", "value": "385657f2194d5884edca69034a98ee33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712453717, "uuid": "2679748e-8ee3-472b-a85c-5f37aa1af58e", "comment": "Malware payload (Socks5Systemz)", "value": "e18d2e1a39b828e4c5783c6dc047da9271b36c171aec5171683ecf76c11b5a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712453717, "uuid": "125ef8a7-7de5-476a-8826-7759a7cd566f", "comment": "Malware payload (Socks5Systemz)", "value": "5bbcf544247decce8bb812e53ac628d78af4539a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712453717, "uuid": "8ca3f6ca-7709-4581-93fa-b4dd7c8e3a23", "comment": "Malware payload (Socks5Systemz)", "value": "896b16b6297e476753cd88a0dcb1bff9db790ea702dd9142323341291d2bfa1b1e2904bb5b15a39550d60eb56454fb1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712453717, "uuid": "1f5550b7-bdf1-419b-8fc0-9f393bd33eab", "value": "T1C0263310F8A7367AD6B81C3548051AC9569B3EA9752E28FD39ECD4DB773A3E06C10327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712453717, "uuid": "2f6b31ef-6496-4bac-a12d-c9ffe6197ca2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712453717, "uuid": "12913ba4-1158-4116-b3a0-88f1037824ce", "value": "98304:C3ZPzeUr4kiRbHc5iEv613LNVYcmqNrIDgncYRQx6E:gPzF4k2b8XS1bzYardcyQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712453717, "uuid": "2f607aca-2694-47d5-8c0e-7b5566f72afc", "value": 4526265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712453717, "uuid": "5182551c-66d3-4e2a-810b-fac5bade1fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712453717, "uuid": "aadda526-2448-40d2-be93-abd4c1102ac2", "value": "385657f2194d5884edca69034a98ee33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df548d42-f488-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712457919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457919, "uuid": "de951d25-30a0-466b-b108-2e8c8bae9c29", "comment": "Malware payload (Socks5Systemz)", "value": "705b763e664ccfe2f796a52eeab54651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457919, "uuid": "0407ff8b-9bbb-4aeb-97a9-4d3bb6c57eca", "comment": "Malware payload (Socks5Systemz)", "value": "e1e932c3d4e0c5f7384a6e6d54eb3f911d4ac0c5371a06b587d45167b7d139cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457919, "uuid": "9f1e59c2-0d7e-4afe-9b98-b28a945e72e7", "comment": "Malware payload (Socks5Systemz)", "value": "bd5a6b8bbdaac24dc4285a6b5682a2e4f4f341e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712457919, "uuid": "1f4a9a06-9e44-4308-ad16-a8fbc09dd035", "comment": "Malware payload (Socks5Systemz)", "value": "6f3884505240ba03aac6bd85e2f233902fa4c720cd98efcd3b99a6bc2344ab4b73394d0533857e723e441adc1c54c984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457919, "uuid": "704472bb-b6bf-401b-9371-e4a803d3cd38", "value": "T1CF163313B497483AE0614D777A13D26D9AB33F6E1574E549AC0C0FDAA989F70B82B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457919, "uuid": "19c4227f-319c-4679-8151-a515fddb132f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457919, "uuid": "f87a5c65-2c6f-48e0-84c6-fedafd8e3623", "value": "98304:C/xk5pb0X26gF5KMGYc1aa8kreilqjvEKMPD1WkGRTbMf0oNjudQx6E:Rm2iP8lvKPDQrWf0oNjKQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712457919, "uuid": "71696043-1f66-48ba-aaef-0abb585504a5", "value": 4344729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712457919, "uuid": "c1099ad1-eb2a-4a6d-a2bc-463617180f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712457919, "uuid": "44a28e34-74b0-4579-81d3-7441a5ab9506", "value": "705b763e664ccfe2f796a52eeab54651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca1c8f9-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503441, "uuid": "04606d3d-aff7-472f-aa6a-ad2bab2750e6", "comment": "Malware payload (Gafgyt)", "value": "e5e785a1950904fa89b817cb0db70f87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503441, "uuid": "487f922b-a78a-4cd9-8ed0-cc6c46188048", "comment": "Malware payload (Gafgyt)", "value": "e20dc3af252fb5f068f5867244743e3132b8afbd1df6be98fec297c310a85ae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503441, "uuid": "3ca7e934-5116-42f8-bca4-570148ee1574", "comment": "Malware payload (Gafgyt)", "value": "5fa4c129db237312d716f084a3281706181f21a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503441, "uuid": "69d6c35f-f71d-40d4-9f1d-04eceb28e852", "comment": "Malware payload (Gafgyt)", "value": "b60d932a18b405323848ddbe2d0deefd6ac4bb441f872a17af781204005129158480f2dc474e43e83e6d0b22501c13db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503441, "uuid": "8413f09a-42a4-4114-ac9c-c71ce3978acb", "value": "T15EF33B24E4404767C2D313BAB69E866E3F321BF653CB33115A349EB41FC2B992D69874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503441, "uuid": "72e46ff5-1415-42c7-b9ba-7d479015ce90", "value": "3072:cyd1BPL8Z60aMnGjuog68Fi5L45hM1D1/6JrTRxmfQOYbr5Wn:Lz060auGjJ5L45he/6XxmfQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503441, "uuid": "43e75bde-d7b9-4698-85e8-a211a17415ff", "value": 170949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503441, "uuid": "9d707091-5058-488a-9845-96c3a8bfcc2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503441, "uuid": "f61e9322-e97b-49e5-856c-c26e65f15098", "value": "e5e785a1950904fa89b817cb0db70f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ecc603-f525-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712525388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525388, "uuid": "9852f47a-8ef1-4436-b128-7cafab5a14f5", "comment": "Malware payload", "value": "1119622fcd5fd351e81e955e5fbdb321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525388, "uuid": "3fe51880-a325-4a11-95a8-2db4cd865155", "comment": "Malware payload", "value": "e21f59f0c44bd8f4144a7238757df29005698871bcd071921da62e7fc7cfb5b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525388, "uuid": "2a742e7d-3227-4fc7-ab41-c19e3ce2791a", "comment": "Malware payload", "value": "5a9a4fed38a7b670a6c6c2531179448a28ce60ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712525388, "uuid": "1ede20a6-9417-4a53-94db-38f5662ea835", "comment": "Malware payload", "value": "e99e9b4ca5cdc3af7611e136b8a388de9a049d54954d114db0ccb71814848b714cac5546ea31126b17154dfa2e252c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525388, "uuid": "b25f1474-ae88-475d-bd6c-fe13afd4ae32", "value": "T190263377A5CAEA33C09F8E719E6A058E6FB23D0A17790C92F436195FD742508A44F770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525388, "uuid": "6835bd4d-0b8f-4faf-ac17-1018ce09f244", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525388, "uuid": "3234038c-8425-41f0-b987-1e2c8112a011", "value": "98304:9PPgSR4zjhFYpuq0y9dIrzyLONRQr1mG1G/CgKx6Ftkz:9PPgSR4DYB9ynyiNRGG/l0mtkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712525388, "uuid": "9666ced4-01ac-40ff-9dd2-e76eb2615140", "value": 4464528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712525388, "uuid": "5fc72b67-0883-4623-8dc3-cf52bd0b15e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712525388, "uuid": "38321cf5-b8aa-4304-b6e0-9ff9cd9e2903", "value": "SecuriteInfo.com.FileRepMalware.9294.28999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ae460b-f51d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712521785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712521785, "uuid": "8579fc87-6f7f-4352-b735-60a73aad62c5", "comment": "Malware payload", "value": "5f72ea2204240929e80b46ea2f696675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712521785, "uuid": "2ba3ba79-3aac-4c65-b572-c6ac54cde3f6", "comment": "Malware payload", "value": "e44770bbd7faac67d7879024bf5c024a7d0d34c46de518997f73cd34fffe27a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712521785, "uuid": "56af2ad4-7a5f-4a25-ade2-b095c338c29b", "comment": "Malware payload", "value": "d93b4eea1ad9d66f328717f1b3ea16b0d5738242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712521785, "uuid": "fb3c6f0b-b63f-4de2-8172-4e08aa91cf82", "comment": "Malware payload", "value": "6ea2c33d2ab05e19a3313432755bed4f591dd30ca6b45431668b3a65f5fed73b79b872c6bdc0b58a28b1d8cea1875107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712521785, "uuid": "4fe551e0-b7b6-4473-b908-1146e7bc4b83", "value": "T1D2B64ACBF8A444A4C0ADD775866692A67A707C484F3023D32B50FF682F77BE0AA75354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712521785, "uuid": "c81c0728-1a00-4f8e-b154-bc8607b5a48e", "value": "98304:fP0lTDlvD/XoTdj51lQEqXvw6EPix6nmetIf:UlTDlUl51rnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712521785, "uuid": "fe13db39-d4cd-4042-9535-c6910d678040", "value": 10548736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712521785, "uuid": "de192e7f-4991-44f6-9f5f-16ab099d216b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712521785, "uuid": "96e39c1b-86e0-4ae7-a2a7-2835f0af1a79", "value": "zone.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c662a1-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515650, "uuid": "54a74daa-1b52-4745-95ec-230d0489e0c9", "comment": "Malware payload (Mirai)", "value": "67b71c9350722339319ec38ebfb8ed02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515650, "uuid": "94b8bf65-eb27-4ffd-8b5b-ba9aac0d9bf9", "comment": "Malware payload (Mirai)", "value": "e53a364200298542086235928f8f0384e8658083b62cdf5ab8b40e74f72659b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515650, "uuid": "4c6d600b-c358-470c-a83b-8cf619541f65", "comment": "Malware payload (Mirai)", "value": "0c906e43a27d6ba79a39dd0fd9a156833ecbef7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515650, "uuid": "e77f287f-f5fe-489e-bf81-a6ce7d7a4839", "comment": "Malware payload (Mirai)", "value": "ff43c235629ad7b6f2358be4de9d4cc5948dc3ed86b1570075886bb468adba70f9ce8ce37e2717c73faadff4f68523c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515650, "uuid": "39a8e45e-e5b0-4268-8a4c-15ee2a6fbb3a", "value": "T139C31945FC415B23C6D212B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515650, "uuid": "cabbb098-d661-4e9f-8749-43a5f9683b8f", "value": "1536:JkvvsE3G5qB/RoZ8QYY1XANIK4V02RTV5ZrxyHexCjpChWDMlc6wyw8FLRX141Gh:SvvTQ7Z7Z1X44DRR5ZrxyicpCUxpbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515650, "uuid": "8ebe14f2-d905-455a-a972-d2519a9b8d10", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515650, "uuid": "76e517f5-d709-4663-84ba-da66af80f9c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515650, "uuid": "189e7e18-fe6e-4491-be35-b1b164ae73e2", "value": "top1hbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95fb311-f4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMoon)", "timestamp": 1712505180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505180, "uuid": "f90c6610-8177-451a-90c1-6da6a4549cc1", "comment": "Malware payload (BlackMoon)", "value": "a875edef30acd52803b3ec4b0d749232", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505180, "uuid": "39353096-95af-4f0c-8d65-9683f05be1c7", "comment": "Malware payload (BlackMoon)", "value": "e5477021fd1482ad591a2f6df17e0b9f9704bec9a44c6d0309de1fc0e3c29784", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505180, "uuid": "74ea3bb5-a472-4462-bab0-8d4d396ead48", "comment": "Malware payload (BlackMoon)", "value": "c166d18176bbc5820474a395ae6c0f5bfb8840a1", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505180, "uuid": "9d1f9822-ff65-443a-aba3-45f3bde0bfa4", "comment": "Malware payload (BlackMoon)", "value": "24b0a6152763733a630eda792c77d69c8d36ffed93aa26490cc26592a60c696be231e77e77efd08c67c6f8a9cce888ff", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505180, "uuid": "1c3cb5bb-7031-4718-90b1-de273130f420", "value": "T1E484960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505180, "uuid": "b3bffaf8-04b5-4cd5-8489-79f5357060f3", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505180, "uuid": "6d88bff0-af3f-4ccd-a9cb-528a70048f39", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22V:7vqWQub2lrE0B55FpekPdb/22V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712505180, "uuid": "f599cf5e-ab59-4ab1-8fbd-2b9d41503966", "value": 406152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712505180, "uuid": "9a57b67a-e597-454e-87ff-dfda27ee6c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505180, "uuid": "d88b70fc-1302-4e41-9cc2-0ce062a1cdf6", "value": "e5477021fd1482ad591a2f6df17e0b9f9704bec9a44c6d0309de1fc0e3c29784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7357415-f4e4-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712497392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497392, "uuid": "b7a32cd7-2921-4b1e-8a5e-1200a2ae7ca1", "comment": "Malware payload (RedLineStealer)", "value": "7187c7b219c1ff599f42127a6d81faa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497392, "uuid": "e05aefab-9e0d-4973-87e8-2bd89b2989f6", "comment": "Malware payload (RedLineStealer)", "value": "e59d68eb85836c929b3a7d5363236be9c7769cea3a027422ef3647f036123bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497392, "uuid": "013f01d5-d9a7-4f7a-a158-9f71ba1f0a96", "comment": "Malware payload (RedLineStealer)", "value": "db1632de9e2b9f0061eabe369d24428efd568990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497392, "uuid": "c7e43259-2b6c-4e6b-8325-fa53c0f9636e", "comment": "Malware payload (RedLineStealer)", "value": "2b5a92983032b80cdf35f5aaa95ac1638edae87b1e05bd0d327a5ed90a908632c97aeb16eb16371afccbbb872d2d5976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497392, "uuid": "5c45b3bd-fbe8-414e-9977-704ab3c14b90", "value": "T1E864226102A4C4CCF119B577F063B459B6F0694104D7ED6ADA2E689A3E43FE3C6A2F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497392, "uuid": "b48a7a1d-0664-4c41-aaba-3173315d7e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497392, "uuid": "546ec258-d237-43bf-815c-dec45886564d", "value": "6144:OrKlraWQB+m2TqmKgYp61QEDEHUhEyj4Wsi8z8/y+D0CbwRZsEE/5VPXJ:R72jmKgYprEDSUCy89Uqm0CSZsLXPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712497392, "uuid": "ce203393-ec0d-41d4-aa18-4095855df901", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712497392, "uuid": "2617d8ef-3ac8-470c-a736-249b7aedd083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497392, "uuid": "b3f11edd-9e2a-47df-9d4d-fcee150246a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53be6cb-f533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531265, "uuid": "99a14048-8fb6-406c-b0fa-4acb55871248", "comment": "Malware payload", "value": "57dbd606cfa1e8e755be391e8ca035f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531265, "uuid": "ae066cb3-01cf-427c-a47b-b0f4911b8e28", "comment": "Malware payload", "value": "e5b17606b51b8d3bdedde2ca01f7ea4a6b29065dd6582443a6df3f7f36497842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531265, "uuid": "77618faa-cb1c-48f1-93f0-53f3da22327a", "comment": "Malware payload", "value": "7a0058601211e1038c9a59cf6837755fcc8eb016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531265, "uuid": "3b4535c3-3128-43e3-9ed5-9244eb425cac", "comment": "Malware payload", "value": "ba13819c48dda856917b8929abb6ce8a9406d66087a58af6bbc13a465d593b7491cd43b54204db74a4f3581c846090c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531265, "uuid": "03773cf8-1199-4ba2-856c-129c7cb7cfdd", "value": "T10C363953F8A545A8C0AAD631C6668253BB71BC894B3133D76F90F7382F72BD0A979704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531265, "uuid": "18a8c5d6-e0bd-4b83-9dcf-94af2e297901", "value": "49152:NSc9vYn7h+91tZOzZyCeliVvu/ZeXDTCseArQ+CqI8NcHsB2Igg+4BpVFvFTwxcM:YJ7h2kzZyCxvuhKTC96I8NMAXvN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531265, "uuid": "e8da6e89-9352-4451-9539-0b416c0c3c43", "value": 4981024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531265, "uuid": "75cfa2ae-a7ee-4071-baf1-ed802a01f1ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531265, "uuid": "987bb8c2-b8bb-49e4-aecc-2ed21775b7c7", "value": "link", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b725fdd9-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712475031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475031, "uuid": "0054424c-d14e-4c3a-b4a3-5cfdcbcb5193", "comment": "Malware payload", "value": "cb4c21ab082d4acc4712089f4cd517b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475031, "uuid": "8be87b9f-8f61-4697-b4e0-69fd8094bedc", "comment": "Malware payload", "value": "e72f17d6111a1a7b814f0b10a708b7e5edadb990f19b6dc95014b65a8dd2d144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475031, "uuid": "70acfde1-1111-4028-bb5d-294ab6535520", "comment": "Malware payload", "value": "7d46bc7ad10c7fba5c9fa982eb19b96f9278d5d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475031, "uuid": "8e91c6ac-93c7-4e94-84d2-73147ed1d52a", "comment": "Malware payload", "value": "e7d8ef23e90bc1279a2286259b69f6c93744475ceb6e827a43d8e2cfba068204c606681ae3dc600860e43cbe5f45accd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475031, "uuid": "bbd96e59-7979-4bdd-a60c-5a3a91f6ca27", "value": "T184457B2136D58036F2B32730697992545A3AF8B2993A854FB3CC676D5F30A81CE35B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475031, "uuid": "db8a222f-b184-49f3-83b0-f592282c521c", "value": "6df9e06e9a8e140f6b6b79c215bc7dae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475031, "uuid": "ce87ebda-88b2-405b-9d74-dd1ff00244fd", "value": "24576:KoWOmrrT7ucP6L5o9+mGJZQLd5Ea2ceJ/sphUQeMD/7:SzgaNGJ2d5EceJE/UQeA/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475031, "uuid": "7439b88a-0e9e-49a5-89b5-807b28e8f3cb", "value": 1188392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475031, "uuid": "bdbf02f2-a4e5-409b-8bae-f4e80f8cf9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475031, "uuid": "425adef7-cb6d-42f8-b8c8-b670c12a2796", "value": "cb4c21ab082d4acc4712089f4cd517b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c230b695-f4b0-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712475050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475050, "uuid": "575f50f7-095f-41cb-b9f2-a627731aed86", "comment": "Malware payload (RiseProStealer)", "value": "ff9c5f93fbe58336452ab54c69ecf3e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475050, "uuid": "88cd6b11-002b-4120-b2c9-1ed3914e7438", "comment": "Malware payload (RiseProStealer)", "value": "e76d759bdaadbc63bb96100ad5617c4d2ec5af04a90534a9962814f26c691121", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475050, "uuid": "695f1264-8045-4665-95e6-8bce9c288fbb", "comment": "Malware payload (RiseProStealer)", "value": "0c4681e39f9d7e7c7aa176df03bf7356399993ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712475050, "uuid": "751969d4-eadc-4f3e-8cdc-61494ea4fe01", "comment": "Malware payload (RiseProStealer)", "value": "a7dbd7eb0e25a1dfb4684ff91ab6bb4b2d97205d2afcbb09a82d1aeb9d7c23764d42ef57a42eda86fbef103ff8b7015a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475050, "uuid": "c73574ac-4921-4807-b5cc-7f9310b7c1f8", "value": "T101E5337A66E57715EEB39F300E31D546AD413F131072622FA4CF3DABB11A00EA752AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475050, "uuid": "21d68847-307d-40e8-97d9-e79e1ef7d8f8", "value": "63814aaf116ba6abb6496ce4bcad24c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475050, "uuid": "ffe21e5a-6de5-45be-85d9-7013776120ae", "value": "49152:xyRgNxv83VV8fmSU/kFsXSsDcbC1u2ap9HQ/IxqhEzMaMWVaGCrpr/ddzFk7jwfh:xymSFZGWap9w/IxbWLHtbFfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712475050, "uuid": "d16707f9-200e-406f-ad8e-f12877701328", "value": 3142672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712475050, "uuid": "3dc50793-0966-4fb0-8c3b-51c8927f5694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712475050, "uuid": "d3087e31-7967-493d-852a-f6d632f29639", "value": "ff9c5f93fbe58336452ab54c69ecf3e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefc1a48-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503418, "uuid": "b4390d9c-5aa4-4bd9-9c6d-a00d8c9afd69", "comment": "Malware payload (Gafgyt)", "value": "e2c2f985f141546adbba24f7bdabe1c2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503418, "uuid": "05202bf5-8260-4aee-a0d2-df71ea38008b", "comment": "Malware payload (Gafgyt)", "value": "e9990e8fb51e14368215fb6601153b995057965aa389c1f5f4898727efc6b0c5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503418, "uuid": "8e169ade-1d82-445c-a476-c90cc973d1bf", "comment": "Malware payload (Gafgyt)", "value": "23457709259b5c06b28dbf8a4106f696bbb79255", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503418, "uuid": "b945062d-88ea-4a96-a398-59b900d1e4fe", "comment": "Malware payload (Gafgyt)", "value": "074039094986de9bddb0e220d70881ca3c32a464c5e423eb80618cec87c45b3548c6c3aa089d66ca9cf4c81faedbb067", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503418, "uuid": "860284de-98f3-4c58-b27b-c991e52ef314", "value": "T121E3D733B2E18DFAC14652B026EFDEB29C31F1FE0672312B23A41D605F2D9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503418, "uuid": "53bf3ca0-4c12-4d8b-9435-b80f4f86a052", "value": "3072:syUyaJ3LUQEWuZI3zKZPhJsphahZtwktUm+QVOXFNqOPPe:+3OI3m6phaDtwxm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503418, "uuid": "313d2eb2-9e57-439d-9d13-519d59eb5eb3", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503418, "uuid": "7634f6df-9f60-4746-a3ec-1d9e4b076404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503418, "uuid": "fd5664da-6cf2-4609-8e9a-b103b6bec80e", "value": "e2c2f985f141546adbba24f7bdabe1c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccc11aa-f537-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532835, "uuid": "1245a0e9-0ca3-4e23-9d41-822390d2f71f", "comment": "Malware payload", "value": "a27cfe64ca62b2e335b76c1fda53d4d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532835, "uuid": "30a5606c-a9ad-49cc-a989-4cc057b1a628", "comment": "Malware payload", "value": "e9a0c1ca9f0485f7aead8bb69a5ab4d38f8a5d77dc5699ab888ceb4e033cfd33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532835, "uuid": "526f082f-0e64-412c-88e5-e8f81ce50d24", "comment": "Malware payload", "value": "70eb8e9ea5a2b31d071ff308655f25dd66faa7f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532835, "uuid": "6d38653c-976d-4786-aa12-5f8d490f86e7", "comment": "Malware payload", "value": "f2c077e458e06b6c7ef99cbddfe75d72d593d5f005bc27f003b84698fcab55f5da6221b2dbcf3171b69cfdb7c5efaefd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ld_preload", "colour": "#E866AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532835, "uuid": "879c9369-3432-46a5-b756-3dcd9dafe7da", "value": "T1F4732ABAF60645DAFBE685B05246C35B80328D36DC67B5B3FE00B71A74A93803E5031E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532835, "uuid": "cfd33de7-366f-4db4-954a-c6879f9ed739", "value": "1536:jAmaD4aloimtfukl6VoFvtDL25mLY4fNj8JzfdJZ+5NnsGaW5dLXleI/1V:xTf2m8t8d7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532835, "uuid": "37f61eaa-c9f9-423c-89d6-e3df2a1ffbfc", "value": 75092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532835, "uuid": "3f9e096b-82da-4fdc-8419-b812847daa5e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532835, "uuid": "e5997767-bf96-419d-a528-ed9180eb529b", "value": "libcanberra.so.0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480fceba-f50f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712515647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515647, "uuid": "cff12b83-5812-4be7-9733-4c9832094090", "comment": "Malware payload (Mirai)", "value": "be2720afe76de95f91a8a1e5255ea3e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515647, "uuid": "ad016940-b231-490f-980e-51c740544917", "comment": "Malware payload (Mirai)", "value": "e9db5c1281d51043a8600e40b4bc31b83776a92b0373551c2eaa1439aceb486f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515647, "uuid": "094ec6c3-0564-44bc-927d-b1df8e55819e", "comment": "Malware payload (Mirai)", "value": "5b5264c2132a586009cbee35c39bc1f4b890de16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712515647, "uuid": "29500dbd-febe-49b6-90bd-3788f3b80da5", "comment": "Malware payload (Mirai)", "value": "6fb0cd0c3aa022238d3dd3799c9ca7cc63ad9fd830f8c8c97582c8ed328313519d81b0caa186708c356d84051747be3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515647, "uuid": "b7081588-ee57-4594-ac6c-ab6569e85a21", "value": "T1B904D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515647, "uuid": "acf32b1f-2e52-4359-93ab-03cea5210b37", "value": "3072:ueEksFM+wXJOfaVR8H3NaMZOTTMJxt9U+7fKbJE:ueEnO+wXrVWdaMATwJHy+ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712515647, "uuid": "3d904168-5800-4a08-abce-60b79bb1dd64", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712515647, "uuid": "c0d725da-e069-4784-84d1-1bfc7879db2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712515647, "uuid": "f05ceb68-6247-4d7c-9838-0448cd9504b4", "value": "top1hbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dfe7d3-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712506547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506547, "uuid": "42712398-9388-490d-b01c-c1bb2ae5ea0e", "comment": "Malware payload", "value": "6c4d4d34202a233d42e35a38fffd9eeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506547, "uuid": "c0a6abf3-df02-4a89-81c0-45a7d2ccf169", "comment": "Malware payload", "value": "ebea775a8b6b2997a51376251f43ee97855c66a287ab65230b5968dca2cfc880", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506547, "uuid": "d4cf3eac-dfa8-4808-980b-dcd8a11dab89", "comment": "Malware payload", "value": "639ded469708a866de394079fd95d43c0df95a23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506547, "uuid": "7c8534f3-86cc-44b3-b78f-fc28b586b24c", "comment": "Malware payload", "value": "1dd918fb8597f336e5d7c4f28cf96e29c2056301a608e7b46144da533aa88230d389a2e5e31654400785b569bbfeee70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506547, "uuid": "edbb759c-7aa6-48c8-930a-23ff976065a8", "value": "T1A0237EC6D852F0B2FC2501F42267EF919E75F0BB781AE9D7C7A62934E462890E60137D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506547, "uuid": "335381fb-b20a-4f97-91aa-4b74ad360f9d", "value": "768:MzemdECcNsmaSa4aWOmc2oI31WXgVHiIbyvfyCse5YCRvYYYYYYYYYYYYx+ZY/oz:Mymm+maSRLu2oS1WXCioGaCse5YCRvYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506547, "uuid": "ac5b738c-1be7-4f7a-b807-960b18128645", "value": 46020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506547, "uuid": "e0688c3a-4c91-497e-9ca4-55b787c00860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506547, "uuid": "b909bf35-799f-4f1f-b13a-e20a5cbea10e", "value": "6c4d4d34202a233d42e35a38fffd9eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1d5b9a-f4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMoon)", "timestamp": 1712505182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505182, "uuid": "406b7bcb-671c-44de-862b-9170df6211ec", "comment": "Malware payload (BlackMoon)", "value": "b3e1e26d391d36c89420a8bb85f253fc", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505182, "uuid": "c1360748-8f03-4bee-8346-1e8519c7e563", "comment": "Malware payload (BlackMoon)", "value": "eca2809c724b053b280b50eddf692d8969fa7cd8a6b027e56dff1a157fd1d490", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505182, "uuid": "33cea480-9932-4a24-916e-142f187075de", "comment": "Malware payload (BlackMoon)", "value": "a8f95d1dd5977007a551ca772b9cd8f06625a1c2", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712505182, "uuid": "67150965-4c41-4bc5-ad14-1c2d8df5efc8", "comment": "Malware payload (BlackMoon)", "value": "80215798d9e8692973cd14f30a3311fe9365f5d8e3c0dedcab9f336d6ac89902a87bea43688f54d90f3e4724f0a8fd8a", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505182, "uuid": "9b6ace27-a721-408f-b3b6-250e57f3caf9", "value": "T13E23AE03ADD249F1D825027639BA073DFF38C1856D31865BCBB1EEB02D73626B52658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505182, "uuid": "7d2b5ce6-489e-4c8e-8c9f-ec7e61339424", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505182, "uuid": "c2ac4ba9-fdf2-4910-9dd4-f3b66d8a749b", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+4Ja3:w0hAW1iqdWNzI5Pd4CSyDt+t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712505182, "uuid": "1bc7ba10-e566-4c8f-8575-cf948456f87a", "value": 49779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712505182, "uuid": "6b83ca1b-3d28-4ffe-840f-5bbd48308b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712505182, "uuid": "398ae449-26c0-4931-b8f1-b2064fe97d3a", "value": "eca2809c724b053b280b50eddf692d8969fa7cd8a6b027e56dff1a157fd1d490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe76c9ea-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712518101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518101, "uuid": "4336c4b4-3624-4044-92c9-25937e6a7588", "comment": "Malware payload (Mirai)", "value": "51a27aaa217f7ee3f7a47bf16e70c8d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518101, "uuid": "dd29c3b3-500e-41ce-aada-7abfe334fb17", "comment": "Malware payload (Mirai)", "value": "ed0e680fc2765f3aa5fa50944ddab0cd63adaf006c07d678d3626bfba83d9180", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518101, "uuid": "d7663ff8-34fc-4603-8992-a58a7a11f142", "comment": "Malware payload (Mirai)", "value": "322723f809aa10935a4d52955465c04bee860092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712518101, "uuid": "d8fb3106-2c6a-4af2-8b0e-7094e036d961", "comment": "Malware payload (Mirai)", "value": "c6f3e49f420a2d17a1b37c3376e2980cae0af1c42400831310b2f06a730dc0d22af9b4436dcf2289041261ff43f32a6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518101, "uuid": "6e752102-eaef-44ff-87f8-807d3c914d3e", "value": "T132D32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518101, "uuid": "4f15544d-10af-4696-a7f5-2492bc972277", "value": "1536:a0nwryWven/qZIcaSH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/zq:BWveWay8z+x57ndngpPMVtUpdbMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712518101, "uuid": "2220a66a-07ad-45e2-9336-cbe5e44b4a36", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712518101, "uuid": "20a0ee34-148e-44f2-9c75-ecf152cc6049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712518101, "uuid": "1e0ddc78-a438-494f-a9c9-1ddf39a872cf", "value": "51a27aaa217f7ee3f7a47bf16e70c8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb7e424-f534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531659, "uuid": "df19a78e-05ab-4b92-bf10-e7cd38f65e23", "comment": "Malware payload", "value": "45a4869f0e91b3f1c2f9b0104632e76f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531659, "uuid": "62aea119-4d88-4927-a7f4-a789cc9dc25e", "comment": "Malware payload", "value": "ef8be84912ed2df6dd7b8876bfb2a40f83835982fa3724bb85a2e03b000ef64f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531659, "uuid": "9413bca9-1c3e-4ca7-9a51-c241469bbe5b", "comment": "Malware payload", "value": "7a73461bfa04d83c5807a1648204dd18fa266a04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531659, "uuid": "b6e96f08-1ac2-4c2e-9771-f842f1a6f394", "comment": "Malware payload", "value": "38b3a6cc57b0fbf89866eeaa8cade8be8e44c99c803eadeaa0c48708021ee4c0d392fb9ea328c0d51595e06961255c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531659, "uuid": "c01fd78b-6508-4804-ab3f-1b65a2f36c24", "value": "T1CBF2D847B6FA446EC0D4C478882BC3336934B489D922713FBB84E6387F50BB91A5E795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531659, "uuid": "de399e41-bcbc-436f-b0e6-7ea06eb1c70d", "value": "384:NnpBQ0CtCSYvMuhx86Jcbr2gQbM0vTdiThk:NnpBQ0rSBuhx3Kyo0vRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531659, "uuid": "55038039-f316-4dee-9343-f1c9d24ae8f5", "value": 34992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531659, "uuid": "cf974021-5bd2-4e30-b478-5ae8b59e3804", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531659, "uuid": "de62c176-231f-4c27-8b21-207d49eed8f1", "value": "gvfsd-admin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a465a-f4e6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712497993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497993, "uuid": "71906c18-5797-44b3-a819-d07a10463a9d", "comment": "Malware payload (AgentTesla)", "value": "ab224e243064ee1fa8ab9a1ed1593dad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497993, "uuid": "a3920f09-9f1b-44d0-9ca7-9084a4949024", "comment": "Malware payload (AgentTesla)", "value": "efb67364fa543ceddc607094c10c4b71f3baac1f45de5c2c759c489f97a64ec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497993, "uuid": "89ea5da2-3d42-4e82-87e6-64021c1c816d", "comment": "Malware payload (AgentTesla)", "value": "c9c77bcbb56bff8b6c232697d00630a01958bc38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712497993, "uuid": "35948585-0917-4d20-8fd8-15b9b812e3ee", "comment": "Malware payload (AgentTesla)", "value": "d91febfcc6d32c70fefef3a7959cccd6ea9445bc6853cfaeedb59d2f3098f3020e91768742ad506b87f463db20053d3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497993, "uuid": "fff122e2-83f9-43d1-b975-02232dac6921", "value": "T1DBD41281372C4E1BD2AD02FB9CD510A083B5D1BEA591D3C4BCC251FB25D1FE85A53AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497993, "uuid": "19462fb5-099b-428b-96e9-046efc435245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497993, "uuid": "350f46e5-391b-4dec-a9e1-75d2270c62a2", "value": "12288:AqzUHd4+v1MProKwn3gB2cDcLqySKYpdzZcW/oD5jeCzl0Gf16434zv4so8:OHd4+v1MPkQB2Tqycp3eDpeCxElrh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712497993, "uuid": "71d60715-a00c-490a-b6a4-ca6f79487b9c", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712497993, "uuid": "13cb0d66-6846-4be3-b627-342caa468a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712497993, "uuid": "1be05932-7dc6-43aa-aa0e-810baf908018", "value": "0c63f71d49534939b251919788566a4b.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c668de-f500-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509461, "uuid": "7d224e0b-56eb-4927-8da6-0afa62af2b83", "comment": "Malware payload (Mirai)", "value": "9b2540cfe3c317542950e090c843aa0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509461, "uuid": "d7e8cd31-6164-47aa-a6c3-781b6be9ca62", "comment": "Malware payload (Mirai)", "value": "f04254aeb94748abac1469da694d73770456eaddcd20bae92297fcb08f8e0d6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509461, "uuid": "a7460c58-7844-44a0-9eab-a90c46cf0a26", "comment": "Malware payload (Mirai)", "value": "0855c8878b595e71b258714b81251dc32c73fa91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509461, "uuid": "577136a2-0945-4cdb-8899-bfe52b895b39", "comment": "Malware payload (Mirai)", "value": "ea6a3ab03b4c20eb6ba84f950498a5ae3450ed92b636fa52ab311de06facb51bf24cdcf5d2a73a4bf5ba7025afeec582", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509461, "uuid": "f032c5e7-4e8b-4d69-b9cf-686ef83c6e65", "value": "T1FF733B95B8818B12C5D5137AF92D118D371227F8E3DF7223AE205F647B8A82B0E37D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509461, "uuid": "235c401c-56ff-4f33-8410-277a96a1a867", "value": "1536:xgntMAN5qXZQKo9nCxkrON2MeWQ97QaMiiHwz1aIj+Ja10:WT5YZQKIn0krnbuwz1aIj+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509461, "uuid": "1219ca1f-b243-47ba-ac1c-b1475b3156b6", "value": 80456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509461, "uuid": "f09d04da-64f4-48af-9bab-a2057de851c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509461, "uuid": "9861b510-e134-42ea-afd9-50c2d7b48592", "value": "9b2540cfe3c317542950e090c843aa0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d12b239-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504516, "uuid": "0e3ba641-dfda-4b40-8377-8141d6d84d58", "comment": "Malware payload (Neshta)", "value": "aaa55c46c70d609fa8f95a1272046137", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504516, "uuid": "df5a301e-139e-44dc-ba77-f79f277aa627", "comment": "Malware payload (Neshta)", "value": "f04e1a1c769ea03973b773c3017a705432e13bad450f1055edea2e80cd42fb54", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504516, "uuid": "28a6e039-e25a-4227-bb5c-7e0929055da1", "comment": "Malware payload (Neshta)", "value": "b3617bf6c8e77b3ef452b7bde9c18f528b3eb780", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504516, "uuid": "779aa5a8-3d61-4917-be83-4881bf6cb175", "comment": "Malware payload (Neshta)", "value": "3254a6a5d1834432d599104d082ed1eb3fa6fa7cf115876d11d44d6978cee97ef6ca08a9953cad8aa89ce76d0bbc0d8f", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504516, "uuid": "31225312-e62b-4d0c-ac32-a80caa13e38c", "value": "T1A8136DA6FAE08831D0301FBCED19D224C47A76317D391AB2B6F60D5EDCAE6C12C1C546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504516, "uuid": "4e55905a-7092-4a1c-85a7-8bd7443cc5a8", "value": "768:j+5NQl/EMQt4Oei7RwsHxyP7nbxzOQdJP3Q:q5NQ+P04wsmJC43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504516, "uuid": "ed58e453-0a70-41d9-a068-15e30f53f2d7", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504516, "uuid": "a0485bc5-38a1-466c-a92e-0b2b757ee8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504516, "uuid": "70f242e8-08ab-4aa3-b34d-a94b597f0b7e", "value": "f04e1a1c769ea03973b773c3017a705432e13bad450f1055edea2e80cd42fb54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87583489-f49e-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712467220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467220, "uuid": "96ea256b-2ff4-49a7-93a5-db8970d9a8fd", "comment": "Malware payload (Socks5Systemz)", "value": "48d1a90a7a6de632f2c80a7f2c9e9c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467220, "uuid": "d95fe8bd-b04c-46e9-850c-ee3bb18159bc", "comment": "Malware payload (Socks5Systemz)", "value": "f0c1b22af6ef866294aae9904aa1df3a63670910569941635ab4004d3b535448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467220, "uuid": "5df16dbf-713a-4329-8b90-27f4d92a131d", "comment": "Malware payload (Socks5Systemz)", "value": "80816c165821fed3ff2fc088fd7a349123b82eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712467220, "uuid": "b4616f24-1710-42cb-8653-c09fe7fe675a", "comment": "Malware payload (Socks5Systemz)", "value": "e44bafac50d225167ae8f062e7b4bdc82c3f2b671de893de281a4df14886f25503cfd1e80e222107a18a89abcfeb6998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467220, "uuid": "b204eaf1-bae2-4f17-9ea4-9cfc60c74067", "value": "T1FE1633534540863BD4B0E8758B5684846B69B3E2687AC35FFF8C9ECC504AE6CDEF6306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467220, "uuid": "481a5981-01a8-48b4-9528-ba5bfb3403c1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467220, "uuid": "43d4d68d-c446-4d8a-a12e-579ec14185be", "value": "98304:CdVptFi9/lcb0HkeObnNXpT4crJNl9zU7CgWh/hU1I/IbQxc:Uzu6boktbnvFPl9QVC/hSQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712467220, "uuid": "9b242163-f61c-456b-a0b2-dba3fe2b9b77", "value": 4205836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712467220, "uuid": "cc68ae86-3b10-431d-b5b8-a0bcc5875848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712467220, "uuid": "41620b65-9167-4b89-9b59-67a1f0f6b7c5", "value": "48d1a90a7a6de632f2c80a7f2c9e9c36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cedbb8-f4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Xtrat)", "timestamp": 1712502428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502428, "uuid": "b22b37d1-52d7-497c-aa40-e10dcb0afbd7", "comment": "Malware payload (Xtrat)", "value": "2ff822548e9ddbe9cc2b1dbcf3569cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502428, "uuid": "4e411d34-375e-4bb8-9b87-3d50892eef57", "comment": "Malware payload (Xtrat)", "value": "f1a0d35539f48beaa4c7318d65e0d5ebd63ddbff5b4fe8fdd25f2d55546afe06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502428, "uuid": "3dadaaab-378c-48fb-843f-ab657a508b16", "comment": "Malware payload (Xtrat)", "value": "7d541bd109be85caed013ffe8022fd36ede57eeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712502428, "uuid": "a2b2ef3c-f6a9-48db-bee1-5f539815526f", "comment": "Malware payload (Xtrat)", "value": "57902a66f852562d54d6ae10da231f661d73ea9b1af3d89fcdd180261164a67bfcf2fd58b68f2adb573cb628dcb1608f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502428, "uuid": "f57ed5fa-81da-4b45-9262-f67d0dabfd01", "value": "T130547D12A3D049B7E0351E7CED194229653D3D313EB29849EAF26B0D9CB93E24BDC257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502428, "uuid": "23269e79-6ef7-470c-81b2-6b0e9699951e", "value": "768:i8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGifmjOsOUFF:Qsq+QV4rObAdXWpf/y+q3zNwiEohA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712502428, "uuid": "0d80b7a7-1543-4baf-96da-05e7ce7b06b1", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712502428, "uuid": "32522392-ae8a-45a8-b4df-7c4ba092e03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712502428, "uuid": "98fd5cdb-3580-4627-9eee-cda4331c0d8b", "value": "2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de68a70-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504517, "uuid": "61747f51-f8e7-4d2e-91e9-9ba866b87b7b", "comment": "Malware payload (Neshta)", "value": "a6226de5c2e07b39d741c486a453172c", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504517, "uuid": "bb6c7139-d4e3-4e8d-8abb-f317f7ded4bb", "comment": "Malware payload (Neshta)", "value": "f2408d3b442b209c99dd7509cd28058c510590779dee89f9c27547d23f517104", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504517, "uuid": "9db7c346-9dfb-42ce-b3f2-af64c223ad03", "comment": "Malware payload (Neshta)", "value": "c1ff30de8580912457a7b241afdc1ba33f842668", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504517, "uuid": "9b91e7f6-b073-4df1-bf1f-31859ee4a57b", "comment": "Malware payload (Neshta)", "value": "6ae1fc226177afadb177d1ebfeb31f397feeb526001f0d82ca8cd1a831c5acf581a06538caec2b05c0044b127e6db7c3", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504517, "uuid": "e4190001-551e-4695-8b40-23266a313b21", "value": "T126836C56F6A1C872D0341EBC8C2AC278D53B7A317D2A1AB2BAF51D4DDC6D3C22D0D54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504517, "uuid": "891017a4-2675-484c-9edd-b6c1be9d0d8c", "value": "1536:32xqjQ+P04wsm1wxqjQ+P04wsmJCcBDG/:3Xr8ltr85CcBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504517, "uuid": "e3ab1a78-e255-4d2a-a61e-3e8ede11b1b8", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504517, "uuid": "4b72d2c3-4a10-4bdf-95db-2c3eb150ee24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504517, "uuid": "8bdb026c-f2f1-4d21-a8cc-50b756a96953", "value": "f2408d3b442b209c99dd7509cd28058c510590779dee89f9c27547d23f517104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e146b0d-f514-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712517697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517697, "uuid": "f83775f6-3f2c-4aff-9b78-01ad592db723", "comment": "Malware payload (Gafgyt)", "value": "492dcfdcc9fc961fce21720bf0908459", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517697, "uuid": "7b9dd357-b01c-4fc3-beec-27ce805ffdb8", "comment": "Malware payload (Gafgyt)", "value": "f360ced15d082cf574c715b528742f8e8fb36555596fb2f5f9a22eebe7dfc62c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517697, "uuid": "f281b092-3048-4727-918d-8198297057e3", "comment": "Malware payload (Gafgyt)", "value": "34f599b1ed9e0868274f8122f8a42178d0beaa32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712517697, "uuid": "c61f07a0-8417-48d0-bef1-b938e9c61331", "comment": "Malware payload (Gafgyt)", "value": "079917df9e2ff2fea7a0897d135f2321060b88da3b48e0867e4bb66ae3d7ad94199ea6420f31cec517057da88d761a11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517697, "uuid": "ee710576-aeee-4e05-ba68-a1d3917ca3e8", "value": "T174B33801D5508B67C2D2277AFB9F425D33332B68979B33225A24BFB42BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517697, "uuid": "9c909c37-234e-4ae0-abc2-4bb75f3b2073", "value": "3072:qaflTut0WhwgoxuuDS31glbmTQOWsXAOn:qaflTuExuuDxlbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712517697, "uuid": "bfa67307-c2c0-4839-ab5a-c76d1fa67ff4", "value": 111497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712517697, "uuid": "82d95315-6616-480d-9102-0861f5d6fa3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712517697, "uuid": "a4662cea-7deb-4cc2-9cde-2c9acb971e59", "value": "492dcfdcc9fc961fce21720bf0908459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb93e6c-f4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506506, "uuid": "58403f7a-4944-4f61-9b68-3159cfc7f422", "comment": "Malware payload (Mirai)", "value": "9ead4493d09961122c61a8868c5cfe4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506506, "uuid": "f85a473e-61c7-4880-937e-f12c5b9579eb", "comment": "Malware payload (Mirai)", "value": "f411492f5ee1fc0573133517d3d2ffb48fba83e0ce000ef52a3209e63a4b370d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506506, "uuid": "f7bf2a10-c4b9-49ea-91e3-1d2da1d806c6", "comment": "Malware payload (Mirai)", "value": "d2b1c571eaff269526de20bdfa50110761f57f3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506506, "uuid": "0e26918e-c3f6-450d-aa89-525e27e90a12", "comment": "Malware payload (Mirai)", "value": "79d823b4bf682d52634733c6e7a7589081bdf048d64ba932952e056f0cda62dec705733f01582e7e1f89721426e39167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506506, "uuid": "a9be28cd-a685-4817-8343-3ffe8489b7f3", "value": "T13CC35A73D8266F98C555C0B4B0B08F792F539A8182876FBE59B6C2B54083D8DF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506506, "uuid": "4ec40e37-fab3-4c23-a841-2d93c00b98bf", "value": "1536:aaS3thSA83qzfFUfc34CBKF8pGcgqP/5f3Wwgxv2yz4H:a7toCeO4lFvqPp3WLxvV4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506506, "uuid": "7e8ecf38-b378-4ae5-9003-b876e6d0d76b", "value": 121440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506506, "uuid": "9c05f1c9-659e-4b0f-9587-a70bd57166ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506506, "uuid": "a5257746-bd0e-49d6-80f7-f3b8f9fa31b8", "value": "9ead4493d09961122c61a8868c5cfe4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43081d2-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712503427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503427, "uuid": "ea2d83c0-2521-43f7-993f-1c3eb3601ad8", "comment": "Malware payload (Gafgyt)", "value": "f3298ba60edb81f1ff5a009327700834", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503427, "uuid": "932e7574-067e-4389-8538-0b88570901d6", "comment": "Malware payload (Gafgyt)", "value": "f4563443fd9ab1f445aac16b38367002a65b6d729c20bd02f3b98b9910012c99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503427, "uuid": "3d87ff5f-4ab2-4e2b-979b-e3be93635911", "comment": "Malware payload (Gafgyt)", "value": "621ad1f9baaa660ec72197ab55903442fafca085", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503427, "uuid": "45d5417c-75ab-43db-8201-fe8ca1f083da", "comment": "Malware payload (Gafgyt)", "value": "33e19c17c6739275122caf940372fb17f3c9dcdb62fc0cb05d45af17292ffaeddb552d51a3c41b23f33478bb8fccb4ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503427, "uuid": "488c437e-d88b-4fee-b77f-2c6746fc9911", "value": "T12FE31814F801476BC2D323F6A65D879D3F3517E623DB33115A38ADB02FC2B992D299A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503427, "uuid": "3932cbfe-2950-45d4-a1c8-d2c82a1d06c6", "value": "3072:Oh8pDxLxO0PXW8/2lMq9f5hBke+84FmzZQQAhtRq6AAe:lm8/2l9f5hBkeWFmzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503427, "uuid": "241e6655-bc81-403e-a9eb-a231a31e200d", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503427, "uuid": "a2d1f63f-94e3-45de-a311-eff50b3fd222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503427, "uuid": "abb1d353-fec5-4292-af4a-ef55e72c2acb", "value": "f3298ba60edb81f1ff5a009327700834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182474df-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506977, "uuid": "9ae49b19-c8d3-4221-aea0-5af10c62da6f", "comment": "Malware payload (Mirai)", "value": "32b27d58e212e5fafa0730890c5c3d31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506977, "uuid": "26c0c66d-a4d7-493c-a792-f7e40000d238", "comment": "Malware payload (Mirai)", "value": "f79c04d7c010391198085daffbd2ee3940cd60e4611df6f2eac5fdc5000a00c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506977, "uuid": "b7299358-7919-439a-9379-224e3e1d4cab", "comment": "Malware payload (Mirai)", "value": "699a8f587e32e07910792ede28cb8a1fadd2bf5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506977, "uuid": "1baafff3-462a-49ea-9d0d-1adcbcf359cd", "comment": "Malware payload (Mirai)", "value": "c732e91dec8e611c56733f5783eeddc1e0d555314f287ae194b10e6fe9ec709835f6124dcb3c4da0276688674b71b1d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506977, "uuid": "e6beb953-7d0b-4708-bc0f-10f2f8251c05", "value": "T195936CC4F643D1F1ED5700716077EB379B32E0B92429EA42C3A9A936EC92511DB1BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506977, "uuid": "7a85e939-384f-46d3-af54-f35b8ecc4b7e", "value": "1536:BdcmZSmS8+UTqCAdpZ75mP1NZq5oNh0fTsYtSccHzy:f/gmSK6Z7Uz45Yh+xE3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506977, "uuid": "9943b35b-d3f3-4c52-84dd-d1178eb69db1", "value": 92388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506977, "uuid": "82ea21e7-6427-4f58-9794-6eb7ad2582be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506977, "uuid": "a9471e8a-1889-4bc9-9c02-6e19e3e6dc4e", "value": "32b27d58e212e5fafa0730890c5c3d31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb774a5-f4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712504518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504518, "uuid": "99dee642-8114-4db9-ab7a-039d9c3ee90e", "comment": "Malware payload (Neshta)", "value": "55caf06170be15ab473a0f2e975166fd", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504518, "uuid": "d03dbe90-6780-464d-8baa-d1361fc0e6d9", "comment": "Malware payload (Neshta)", "value": "f917298f2b33bbf21e276ff930463ab4076acad6bb73bf2761c73bff5d90a81d", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504518, "uuid": "c016a7ab-bde6-486c-9a64-a91243e7876c", "comment": "Malware payload (Neshta)", "value": "0e9f5da8c1b6cd0c6ea66afefff5116573e2da63", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712504518, "uuid": "bde7f650-442a-4649-8471-10f3ca0844dc", "comment": "Malware payload (Neshta)", "value": "e5b0de66830f9b7775ff5093580361a47f6747f3f9c33f4ed5fb361ac9d76c587ebbfe5729541ef4ce493dd83feaced5", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504518, "uuid": "91a9fd44-5821-4b8d-be39-4f3bc20d4b56", "value": "T1D5836C56F6A1C871D0241EBCDC2682B8843B7E31BD291AB2BAF51D4DDD7E3C22D0D44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504518, "uuid": "10942d39-727f-4642-822d-eeee5e0c5a96", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbNxyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPJ:32xqjQ+P04wsm1oxqjQ+P04wsmJCcBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712504518, "uuid": "211a6a6a-4c67-445a-8436-0a74e787396e", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712504518, "uuid": "75944b17-7075-4889-932c-88670fbbb84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712504518, "uuid": "72c02cf0-6470-40cd-835f-3ac34f3f9db8", "value": "f917298f2b33bbf21e276ff930463ab4076acad6bb73bf2761c73bff5d90a81d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c989f87-f536-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712532405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532405, "uuid": "e6f0260b-a16c-4896-bcfc-3c4534f3ffd5", "comment": "Malware payload", "value": "9af09f5574c1c54c9c5812880fc5b683", "object_relation": "md5", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532405, "uuid": "42e72392-9dc3-45ea-8a5d-d379d508398d", "comment": "Malware payload", "value": "f91a87785c00c643f5c7af795074064ccee8bd0e1d36673cc755221177cc91ee", "object_relation": "sha256", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532405, "uuid": "cc62f1a8-cf8d-4802-b2ea-e2708a92933d", "comment": "Malware payload", "value": "bddca7dc810cac7e4d801358c4dbc8b3c43d2004", "object_relation": "sha1", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712532405, "uuid": "216406d0-05cc-4e35-b472-9f0f979d24d3", "comment": "Malware payload", "value": "d6d2f4279de79e96639b806ecddbbfafad11cd436c9ba27f8461136d46d1bfe5de3542769358c0c91f6f1cda73fde961", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT_script", "colour": "#E1A9A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532405, "uuid": "01bcef59-c0ec-4784-ae64-5ea97137ea79", "value": "T1B943C603FD2CB12795ABC23D9122388E867E70315AE448E5FCA90264757A55F41BFBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532405, "uuid": "a7795b3c-87bc-41ec-b233-a0649c3db09b", "value": "1536:hkOpTGLX51QHAkKIaZOjhoyKyHGA3CpWY:hkOpTGLX51NkKTMjhHKyHGA3BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712532405, "uuid": "08baeabb-5d02-4f0e-9f55-7eccef58fbaa", "value": 56536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712532405, "uuid": "044c0800-b22e-4e0f-9471-7f5c8a95bb2d", "value": "text/x-c++", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712532405, "uuid": "43c15642-d95a-461f-9e67-fd34e231d827", "value": "pe_heuristics.cpp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba130c4-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503976, "uuid": "4578c1bb-2e24-45b6-8b01-f52d6dcaddc4", "comment": "Malware payload (Socks5Systemz)", "value": "932872948d28ec6fb3d4281af9559c50", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503976, "uuid": "ba02e087-72de-4bdf-81f3-aae50f36d820", "comment": "Malware payload (Socks5Systemz)", "value": "f94c7fb21ab9be8425a67372cab71f8e5bbd143126a3e3fb2308b62e1120d855", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503976, "uuid": "f28cc95c-b463-4be0-8dec-6d65dbbd553a", "comment": "Malware payload (Socks5Systemz)", "value": "e8b31a2fc8820bd1534c83207d39e8d40f993677", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503976, "uuid": "549009fb-3898-4941-a007-707d78276eec", "comment": "Malware payload (Socks5Systemz)", "value": "017b7fe02bc1491160039fb25ce8b4c662d63f620384149e292622eab8c44d17e5203258d107d4163ceb49ee33b731fc", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503976, "uuid": "5d381498-81d6-4870-9534-ddbdea4cf162", "value": "T1E8E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503976, "uuid": "2067d3e3-1f35-4a9e-a26f-1ed4879485de", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503976, "uuid": "a15b1261-cb00-4a63-88fb-47ccce417299", "value": "12288:HjsgiZdvAeRwP+aFH/50cCtKBqi6cvpWw3EmXRKLiTOkERp1H/skaiIjcBDQg5Ea:DsgwdvAGef50cCtKBqinvpf3EmXR+iTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503976, "uuid": "2dc26ec2-ec90-42c6-8d4c-338e041d66db", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503976, "uuid": "8600041d-6574-4bc4-9981-e3683d74a6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503976, "uuid": "59c3b863-8976-41bf-a3cd-753991835d57", "value": "f94c7fb21ab9be8425a67372cab71f8e5bbd143126a3e3fb2308b62e1120d855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fade8e-f52e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712528985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528985, "uuid": "6a288252-3cd5-4868-b613-be6e90e2bd8b", "comment": "Malware payload", "value": "d43f2191937f519e0ab6f9c60649c37c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528985, "uuid": "98e0acc6-362c-49b9-9de3-b33d619a5341", "comment": "Malware payload", "value": "f98aa56adc2417ab64be36289564428a9883d458ddbc6184f1394f0b0d542d39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528985, "uuid": "d2aaea71-e547-4f1f-9c6c-09cde6a364fc", "comment": "Malware payload", "value": "018aaad6cb65f723bdc26645c442601f0b299b49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712528985, "uuid": "5b3a35a7-a3c6-4241-a023-a27f560cbd58", "comment": "Malware payload", "value": "1a1de0f81a9042767340c3ae21943b1427a2be391c99c359fb19bce03de36f1ef8c83dbac2a075f8f0f2fb412c9e8265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528985, "uuid": "24cfc300-f7f0-4c0c-bb2a-3910da24c41e", "value": "T17B04D50377AAC5A1D6C5573AD9DB410023B5E9A2A353FB0A39CA177EBC0377E984470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528985, "uuid": "2741da47-f19c-4587-91e3-5e8bf774808a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528985, "uuid": "0819965c-bb11-4f8e-984e-9e512ab9736b", "value": "3072:WD7y7hOg0vSOlQDSL4uPSDhn1vtzu2zN3Yot48PAfFo+uZc:WD+N10vSPlftBPAK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712528985, "uuid": "fcc2e2ea-946d-4af9-84ec-dd4b1022cc4d", "value": 181032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712528985, "uuid": "94f833a9-53ef-4a4a-a2a1-2370d36a8f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712528985, "uuid": "eac05cc5-a6dd-47f2-b73f-3a1d230d0754", "value": "d43f2191937f519e0ab6f9c60649c37c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1caad203-f4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712503978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503978, "uuid": "80f46306-e59f-454a-b55a-c3437b34e2b5", "comment": "Malware payload (Socks5Systemz)", "value": "73875e9da68182b09bc6a7faafff67d8", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503978, "uuid": "8bb47546-7f2a-41aa-88b1-7d79ce86c488", "comment": "Malware payload (Socks5Systemz)", "value": "fa5ad08bd32896b9e43b76f0531977c639b902b8b2e2a6910a6d221aa72ae865", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503978, "uuid": "a655cdbd-aba7-44d5-90ea-2c645a18cce9", "comment": "Malware payload (Socks5Systemz)", "value": "554d6c9f25b9fd16cef3368f078b3f759b546cb9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503978, "uuid": "80b9ab32-9c10-4050-9a7d-196bf52d77e2", "comment": "Malware payload (Socks5Systemz)", "value": "e6add21a204a79d8f0dd17be24aa7878f4e0ba657eb0a2df88c7aa2444bc25e25ae01c9d8072ee80495919f45d79a1b8", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503978, "uuid": "6329b68d-55bc-4e04-b8f9-b162ff10ef8f", "value": "T149E49DB13A06D1FEC35A44B4E853A603C53867F18764D64AEE6CBC7CCAA34A471D878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503978, "uuid": "b53f8758-bd12-44ff-9652-96e072fddc9d", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503978, "uuid": "42471440-f79c-4c94-90ab-9008910ee00a", "value": "12288:O+XssgiZdvAeRw3+a5HTl6u9zO0t4W2Nx04xa9oOjjI1Y4hwfS9wijm2657Rk2kx:KsgwdvAOezl6u9zO0t4W2Nx04xa9oOjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503978, "uuid": "0b822d59-2368-42f6-970e-ecb6434b55fd", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503978, "uuid": "ccb8ae72-dc81-4713-94b6-62abe483582a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503978, "uuid": "e8b74c82-6eca-4921-bf62-f789a35a119d", "value": "fa5ad08bd32896b9e43b76f0531977c639b902b8b2e2a6910a6d221aa72ae865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4d5e7d-f4ff-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509079, "uuid": "95446587-9411-435c-9144-5ffa49bae31a", "comment": "Malware payload (Mirai)", "value": "74d780693b238c89652452edf0e95673", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509079, "uuid": "eec41c21-1455-4652-b58b-4ca771b9e846", "comment": "Malware payload (Mirai)", "value": "fc83991a2317570a3e3caf3a66d560814a374384a5a8e75de0aa8cbe5679e689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509079, "uuid": "3961ff37-e2e4-447e-96e2-953c799e9e7e", "comment": "Malware payload (Mirai)", "value": "34f7b8f39acbec3a44f5c2f446ec046d84c669ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509079, "uuid": "d7d881c5-a25d-4cac-9ad5-b552b68d4075", "comment": "Malware payload (Mirai)", "value": "b85392c65b9bc144baef16949ef023dfa1d55020fc1256da0a50bf6524d9251b09d1537987c50e82ac921c49ae723531", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509079, "uuid": "7084d334-4f7a-4802-8e1c-6096e84d3548", "value": "T1C96339D6F8019E3DFC0EE67A84550E09BE7163D112831F266BB7FDA36D720A66D02E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509079, "uuid": "41fa3bad-3079-409e-9073-c9b73be6c4a7", "value": "1536:HL3mMsvOLG5XJrr1Dctrn+zHdtIi5zFY9BgOo8QNLRvQ5:rCatDmOQgBJy1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509079, "uuid": "cafd19e7-5bce-4dcc-ac48-7d70270e5053", "value": 69148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509079, "uuid": "0c25c981-76af-4076-b41f-4dc4437285fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509079, "uuid": "94047ddb-5c47-47aa-a313-79498a8377aa", "value": "74d780693b238c89652452edf0e95673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5029b00-f534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531721, "uuid": "3ac6ef3d-2652-4346-b7ee-b004b3674dc1", "comment": "Malware payload", "value": "9ac0f564fc1468d1b83a5e69f505e2dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531721, "uuid": "e1e16716-49e6-4f13-92b5-b585c340855f", "comment": "Malware payload", "value": "fce3624cfd922ac7ace5f85d4d6c9e4a318e30dc8468a1c037e15d65defa89c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531721, "uuid": "b791f418-ffb2-4370-be0c-35420da6c870", "comment": "Malware payload", "value": "d20615940a4c22ddd2a9a95cebe54712ef6b67e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531721, "uuid": "ff84db7a-b217-4e43-a0f4-693ff32ed110", "comment": "Malware payload", "value": "61fdd4e8b05a821e84e86a61812e383efbb5f51f7195b5d76bbd4344fc0005ddd2b310b3a8ccbe0329ed6d4ddc578a1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531721, "uuid": "fd983b5a-067f-4e2e-ba8c-045d57ba66be", "value": "T190766D0772F258BEC485C431852FD2636931F0850632BA7B794997342EEAEF41F6EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531721, "uuid": "acd24d12-f278-49ef-bbe7-70213d54d49f", "value": "98304:jk71aSVKIfVH1W/N5p3BxTuU17g0QJFIPZ6dmngdty0jtigqiptQGJn:j8KIA5Vl7oJmxgjBzptxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531721, "uuid": "88eb787f-80c8-478f-894d-1ad9a4a8e717", "value": 7646752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531721, "uuid": "63886eff-09d1-49c6-8ea5-1b2f32dee1cf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531721, "uuid": "1ad51ef1-1148-47c4-8e62-d4b8b9dafcb4", "value": "qemu-system-microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3ae383-f4f2-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712503090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503090, "uuid": "5316c3f4-29ac-4cda-ac35-1c1a70c103cd", "comment": "Malware payload (Blackmoon)", "value": "10825df4d86b3dd529a8b006b1bdb641", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503090, "uuid": "317e6094-9d45-4ae8-82c7-e5e74e1ae93a", "comment": "Malware payload (Blackmoon)", "value": "fd29313bdf0b552358264a64c604dbd793029a1dd76fb46391fb0d485d03e7d8", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503090, "uuid": "b70b8509-c56b-4142-85d0-28f4534bf0be", "comment": "Malware payload (Blackmoon)", "value": "ddca4c26cb4c8fd98732a78849e3440772476ecc", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712503090, "uuid": "d89ff60f-2d79-4a60-a671-65dcf6c9c7d4", "comment": "Malware payload (Blackmoon)", "value": "fe45b52d1707f8832a27dc1abd92c84840495a8a0e947c0e0ae2a5c1fa0b6388e0e2748aa3d11ea3ca25987225661f4a", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503090, "uuid": "f8c65876-484b-426d-980e-14dd2ae6e132", "value": "T11B23AE03ADD148F1E829027539FA073DFF3881816D31865BCBB1DEB02D73229762A58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503090, "uuid": "670101ac-4281-4e82-b043-4025ccf4c36b", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503090, "uuid": "a29a62ee-b56e-4313-9bd2-99515f9ec0f2", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+Xp:w0hAW1iqdWNzI5Pd4CSyDt+Xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712503090, "uuid": "91a7a99f-d843-4562-b8fa-2621a3cfcd6e", "value": 49820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712503090, "uuid": "ef47aae8-03b8-4509-b0fa-4a3f07abd38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712503090, "uuid": "91838f09-24d7-4f2b-96a1-e2a82af79b45", "value": "fd29313bdf0b552358264a64c604dbd793029a1dd76fb46391fb0d485d03e7d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ae2748-f4fa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712506599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506599, "uuid": "0408157c-77dc-4565-87d7-d962135d9ce2", "comment": "Malware payload", "value": "7d71da47ef42cbd20f00e30b3d2888d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506599, "uuid": "ba2a9143-788e-4918-a138-39cd59d1ad4c", "comment": "Malware payload", "value": "fe88f8628650944ceb31980043596b9efbfaf3d739bf23e0ce82ce488cbdd56f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506599, "uuid": "7cce3fdd-2efc-4b16-a1d8-a7252591f5ff", "comment": "Malware payload", "value": "2cc0d5d12c4d59ebae58bbaab146f0e5d0b1fae6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506599, "uuid": "4553ff36-2cac-4ca3-9bc2-99bccde65736", "comment": "Malware payload", "value": "d8b6d7da84a04fbdd67a57925046eec12bbec66d1833ac8e37b0e2411a4bb0e30ce750a29f7510d8a919462958f570e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506599, "uuid": "543c622b-e4f0-4cc3-a9ab-6aaf7d68c5bd", "value": "T1E2332825B6762A1BC4C5A87A22F74769F2F4070E18E8CA1FBC720E4EFF54590215B2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506599, "uuid": "1b225b22-e67d-4ce4-997c-f6926274dbe9", "value": "768:KbTAiUPsNhqvCM1Q5vGx9l3jDWO2AI/DUCc53mClTnO+BeqsKR:wRUPCh4CM1SqbdI/oCI2ClX7bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506599, "uuid": "4a378ab0-5e08-4370-bc0c-000d72fb0eb8", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506599, "uuid": "1ba1bc6b-ecc2-48f1-867f-a181ddf36d9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506599, "uuid": "484612c8-b172-4e69-8aee-4261db98d9e1", "value": "7d71da47ef42cbd20f00e30b3d2888d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6f7af6-f527-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712526067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526067, "uuid": "0c07b8c4-eadb-47d4-88a6-8a1c7cc09678", "comment": "Malware payload (Stealc)", "value": "8312651e6bac9b7a04db6df564958251", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526067, "uuid": "dc9be75f-93bc-498d-8ce8-9d888181877d", "comment": "Malware payload (Stealc)", "value": "fe8a4f533f7073756e9f7abca0b84630c60e402751b96c125b17ad22e6125d6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526067, "uuid": "390eb34e-faaf-4a3a-a5b8-3dbe7e474024", "comment": "Malware payload (Stealc)", "value": "54f36efb941322a3ce6aa5079b89b42e29308cad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712526067, "uuid": "5cc2263b-cc48-47fb-a664-d5e2490dbaa7", "comment": "Malware payload (Stealc)", "value": "a0fddd2f5584d5a034a2ab78d26059c73c3efdd38138e8fc8a86cc54086e2c01d1623750f42c3190ec3cc36d9278b189", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526067, "uuid": "d4addfae-e43b-427e-99f2-51e796a4cb7f", "value": "T123649D11A6A1C823EF661730DD25D2A94A7A7CB15BB4718F36943B2F1AB33E07951333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526067, "uuid": "5362a986-e70b-4a46-8d18-5b05b70571f8", "value": "32db0a910f88bc9b49b86745793d5182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526067, "uuid": "e1511c43-54d2-4f96-b50c-ebd9e3fb05d4", "value": "3072:VCpBPXpoH0lWUKbwsXwNnW8aMoe4Mz+ylek4SM4Aip67za2oO:MpBPXpoH04Uyw7NnZoe4MTwPC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712526067, "uuid": "5f37ccd5-8eea-4c65-a99a-21219ed5775e", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712526067, "uuid": "a2739613-5c10-406b-8b50-0b0f8def9255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712526067, "uuid": "58da943b-bdbd-4617-b37c-9bbe053b1428", "value": "8312651e6bac9b7a04db6df564958251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d792407-f533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712531065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531065, "uuid": "014d27ec-aa01-4256-b520-66d2917496e2", "comment": "Malware payload", "value": "0a01080bd0e8989baa4072a3c59dc3a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531065, "uuid": "3fe47a41-1327-40c5-9a21-1f3d07cdbacf", "comment": "Malware payload", "value": "ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531065, "uuid": "28f9c04b-44ff-4830-8f30-c3c1c4e2586c", "comment": "Malware payload", "value": "9bb260bfec660ffb000760a61ec35e33f1664d87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712531065, "uuid": "1aef47f3-6869-41da-b89d-e5a88d5166ce", "comment": "Malware payload", "value": "72c8287cdd41d14643a55549be4c6253362fe50abb70df71e8c0b4234ab9df208cf2fcdcf3c3516024ebfdbdd4d8216e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531065, "uuid": "f6a26951-b1ac-4dd1-b7be-3167c1b8ebbc", "value": "T1D0165B2FB2F2545CC48FC430C657E5632D3974B95B31247B2A88A9343EA9C39667FB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531065, "uuid": "bb31ffd7-4e44-4f82-b237-d681cf9ae976", "value": "98304:gpgiIjxQs58LPdl2mUy8AI1sJQ891asWv7QaDyFe:EDdOmUiJF0QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712531065, "uuid": "8e619631-4976-4ad1-9533-0c2277954b43", "value": 4217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712531065, "uuid": "f5c936e0-794f-40a1-95e6-56443f1f4ab5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712531065, "uuid": "1bb3db80-c536-4c33-9ad0-65ec9775ec2e", "value": "libsystemd-shared-255.4-2.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af109b0-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506955, "uuid": "e5d727c8-252a-44fb-bb66-e805e870958a", "comment": "Malware payload (Mirai)", "value": "73c3cd09e9c093a4f4e57c04f1da18fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506955, "uuid": "75fd5b37-172b-4786-accb-76e3e5140fc6", "comment": "Malware payload (Mirai)", "value": "ff829dd35ad0873d739b5b98f04ca03ed5e3e53d9259af1f2d8cf5348c2a70c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506955, "uuid": "28328b7d-dd6f-486d-aadc-6e484e629f03", "comment": "Malware payload (Mirai)", "value": "4201a918c2e577120e49435029479dfa34543b21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506955, "uuid": "68716417-2c84-4c06-bf4a-6685c583d55c", "comment": "Malware payload (Mirai)", "value": "880884f0f94bc74ff03e04c0afacc4f368ae1928a5261fa01a3232e33aad5961b9471f4b08704ce9f8ca453da22a9809", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506955, "uuid": "fdfe9e39-0667-4f12-9c2a-fd8d2a9f2737", "value": "T1DA04C71AAB550FBBDCABCE3706E90B0139CCA45722A53B363678D528F54B50B49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506955, "uuid": "632bd167-607e-422d-9a73-c3881a380d96", "value": "3072:NIV+P9XiK3DsNpFI8uOgr5v/IqWgl+tXuKb:NIVOliXFtuJr53+aAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506955, "uuid": "b5ec3c8e-9b04-4d86-87e6-8e0b6d883e6a", "value": 181932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506955, "uuid": "f125a632-7d70-4f1d-9fc9-f53dbfc609f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506955, "uuid": "b29b75d4-7621-4433-8f39-99d260e643a1", "value": "73c3cd09e9c093a4f4e57c04f1da18fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d96323-f4ff-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712509069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509069, "uuid": "dd787148-94ed-4056-bf15-495327616e8a", "comment": "Malware payload (Mirai)", "value": "64d4d4443a8fced5c00ef3877f0fffee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509069, "uuid": "17b29aff-e9c9-4eaf-8230-3ec22c5160ee", "comment": "Malware payload (Mirai)", "value": "ffb816b01668f485b9d62b54e8bf86b8cf47e549a75b6266630c68f707cde808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509069, "uuid": "5bfe6f74-d0c9-47bc-ab5a-9a9e9e0c8f7c", "comment": "Malware payload (Mirai)", "value": "2f6805d820cfe8db2a533d2a7d09ae292852a00f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712509069, "uuid": "15643628-c30a-4d8b-9ba9-5e9a651c823e", "comment": "Malware payload (Mirai)", "value": "3ae78c1464327e02bf19485e7db3d8855f77f22e0102f243277e3fb8c4d01fa9a7338b07fc0fac3a5366e62a61d4cef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509069, "uuid": "d61820eb-e698-4a42-bbfa-2196aed5ac98", "value": "T195045D46A6418F13C0D72B79BBDF424533239B64D3EB63069528AFB43F8679A4E73601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509069, "uuid": "56b10b55-228e-4e4e-ac49-e42eca52fdad", "value": "3072:RUlqdRz6dqWZH/VTHqQjaWxTtTvisRTtRRQSphV+rO2Ki1M/9y2S3:P2dBfFFjaWxTtTvPR5Q0hsrO2BM/9zS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712509069, "uuid": "f820c587-8a55-4ad1-af7f-a85467b905e1", "value": 178928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712509069, "uuid": "fde2d860-53a9-4563-882f-346bb3b6b3e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712509069, "uuid": "6827ac14-4111-4930-b674-505eda71fe30", "value": "64d4d4443a8fced5c00ef3877f0fffee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024ba588-f4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712506940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506940, "uuid": "74da9675-5363-4c75-b6d6-7a3e26948b76", "comment": "Malware payload (Mirai)", "value": "1cf484207f5edc9c08f92dcb4bd98acb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506940, "uuid": "85574fdb-d7e4-49cf-b7ee-35cb3d41333f", "comment": "Malware payload (Mirai)", "value": "ffdf344e0ada328cac947e224723e2ba1b560232c16c7d2627a4d3aa7e88300f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506940, "uuid": "ba2c0913-62b0-4aa2-8dd4-3189e1f36104", "comment": "Malware payload (Mirai)", "value": "426de97c440e171e95b26a934bbcf45a6c527398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712506940, "uuid": "831258a9-1a98-4c3e-b7b8-c005d59234c6", "comment": "Malware payload (Mirai)", "value": "0a62010e6cfcdfacac05fab7e844768aba4630c16c6dfa8882da00612f35bf6d6d926ac9590f7277c88da13480fb34f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506940, "uuid": "ceeea870-fe60-449d-a827-0ae766bf7815", "value": "T19104D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506940, "uuid": "ac69ebb6-3170-4973-86c9-8f3660c49a61", "value": "3072:ueEksFM+wX5OWaVR8H3NaMZOTTMJxt9U+7fKbME:ueEnO+wX2VWdaMATwJHy+uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712506940, "uuid": "58a756b5-35d6-4767-b83c-0b6cb1e83097", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712506940, "uuid": "d28dcb6a-50e7-4607-b72a-e539ef6337e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712506940, "uuid": "e9e32411-e7a3-41c8-a168-244076ad7e19", "value": "1cf484207f5edc9c08f92dcb4bd98acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }