{ "Event": { "published": true, "date": "2026-03-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-28", "timestamp": 1774742581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "13fe258b-20e3-4fe4-9d10-bdb0e6ed9973", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9737fc-2aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774732850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732850, "uuid": "da525912-91f8-4edf-a265-29379e099476", "comment": "Malware payload", "value": "63ab5a23551446596fbf541732788229", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732850, "uuid": "2ab6a3bf-b0bf-49c9-84d9-8f92f18ee840", "comment": "Malware payload", "value": "00bd9a8763aed0cb7b33f1156a7cc5db12305b5e29988e250bb8190fe6d9f588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732850, "uuid": "7bf2a507-0f5a-48c9-9c28-c061cac8c45c", "comment": "Malware payload", "value": "c59a70699b7723d4e2f1bfceedb183762f114fcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732850, "uuid": "53ceb300-476f-4524-a280-cbfc828cf671", "comment": "Malware payload", "value": "863a215b99a7599c38d52af83531b5920813f7d4380acb7796633e8dade73fdb20cd516081bbc32c6122aff33a41d9ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732850, "uuid": "226a5e94-8a2f-4600-b468-332f4f6868a4", "value": "T1EC160A97B8D14682C4E4367ABC7E81C432A70EBD9B9A13676D05FE3C3ABE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732850, "uuid": "ec7baea1-3d02-41a4-8dab-18f7ba2bc800", "value": "24576:79NbrYx697frd83OyNYvxPVSVRR43Ku9XljurW2F+RDKfkWT1PxTHRKptN62Eg8t:lXjD58jsz3qD+ImiA/NswZZj11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774732850, "uuid": "9ef62369-6d72-4111-a0ed-8ff38fff23e2", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774732850, "uuid": "1779625d-781a-4fc9-8dc3-fe866485835c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732850, "uuid": "f8f7711d-9819-4c5c-a5d2-7fd9767108ec", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c527d2c-2abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774711827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711827, "uuid": "5821658b-841d-4b0f-906b-afd3f0421030", "comment": "Malware payload (Mirai)", "value": "5ba885b15de4c858efea4b0f17a6c1e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711827, "uuid": "fe29ca5b-1949-4699-9000-a1ce8167e49f", "comment": "Malware payload (Mirai)", "value": "0160a5877f558baf6bb1423fef633a7ec31991c5f6090a7468a3e916f28636de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711827, "uuid": "c50a99c1-84f8-4079-8434-e79a3b7ccd98", "comment": "Malware payload (Mirai)", "value": "e0c99da9f51ebbd31f578bd4b5b2898b731086b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711827, "uuid": "d5241563-0beb-4636-910f-82d72f0ae588", "comment": "Malware payload (Mirai)", "value": "be9856f87e5566d00f7841a880b20eec38cab15d562582c8dd2a3e911ebb960d93960832b577d99fcd07f155129f3ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711827, "uuid": "90ed4b80-c715-45e7-8afd-1e9390056535", "value": "T1ADB35A63D8656FA8D218D0B4B0B08F792B939AA096875FBE156BC3758043DCDF5093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711827, "uuid": "3faefd89-c575-4710-9a75-2d1fd458b22e", "value": "1536:6QzUqcJdTY6vl+YC/DKjRGZGCQAKZ6WP94Yow38U:ZUqedTR+YzjqQ56Wl4Yl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774711827, "uuid": "fb578555-6094-4848-853e-3c13753040d6", "value": 112432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774711827, "uuid": "43061c2e-181c-4baa-8f1d-1a0c1cfffafe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711827, "uuid": "5fac037d-baf2-4539-9973-0380b1de6346", "value": "udevdpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1b9edd-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720422, "uuid": "e22f44e1-2d74-4db1-b268-a95af624bba5", "comment": "Malware payload (Mirai)", "value": "7f2da2e0c9ee880be2f8ac883cc71005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720422, "uuid": "5848fecf-2681-4fff-9296-0d95a723c179", "comment": "Malware payload (Mirai)", "value": "02860e85cb1a66537d4dafbad435007757f8697f09f945fa3d2a1af026406030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720422, "uuid": "0d1c378e-1dab-420b-86df-2375bc4f8f66", "comment": "Malware payload (Mirai)", "value": "3af4ec0c7fd25c55198a2f804ec8a35414c84200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720422, "uuid": "5130b936-ec15-4281-bb09-156ad5c5b8f0", "comment": "Malware payload (Mirai)", "value": "a7d3e2df682d6f543b857ceb549376f78dd51fd6a456e7d488125b32eeaac57b12b57cb986e41f9da125ec0bf4c89bbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720422, "uuid": "ba2d2329-f1d4-479e-9cdc-a5a9ec583d6f", "value": "T1CB334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720422, "uuid": "31b8f409-c810-4689-a616-017e5eae7db6", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Two:ivW3jdQGqt7Y+Z+zN9cGgI6bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720422, "uuid": "15b11ed6-0be3-443b-b9d3-970d287b1832", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720422, "uuid": "db0de81d-f134-417a-a3e3-4d2a9a2a7256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720422, "uuid": "51b04d97-8dd8-45f8-9c7c-3db0a4295b19", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6f6d95-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720369, "uuid": "8a323693-8736-4ad7-a50b-bba4989867c6", "comment": "Malware payload (Mirai)", "value": "bb63cf4f899b12b2fb5c31b3fb73d834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720369, "uuid": "94482b02-393a-40c9-b50b-b53bcc1383eb", "comment": "Malware payload (Mirai)", "value": "03910d96fe70213c7b043403ab5989cdf2efa824b4ea2236e23c74b2ee7a6ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720369, "uuid": "5ab9e36e-f5eb-4586-9aa3-68d21fe0443f", "comment": "Malware payload (Mirai)", "value": "8507afced5663c96eee16d7e983e47962386b457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720369, "uuid": "5ee63583-b39a-4dbe-8455-65949b31c984", "comment": "Malware payload (Mirai)", "value": "8b5bf8702b96ad3700ee428cb2fb4449a3e408239e0990cbbda882e7067df31520946d63875382e512f0e58d45693edc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720369, "uuid": "fce221aa-0fd2-497e-868f-a5426f91d9ac", "value": "T1DFA2E019BF58828BC832797455D9F5D21397FCA1F29DCC4E2940C15FF0A33A96474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720369, "uuid": "b3f5779f-151f-477e-85fb-7a36de7e0487", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTc:798o08kxofBE+ZkXaITbp2F2TWul0c54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720369, "uuid": "63e4bfa6-d4fb-4487-8b40-68b02874a654", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720369, "uuid": "63efcf84-e020-49eb-86ac-163b0bc89c42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720369, "uuid": "bdafe441-6786-4279-a317-9620d7866d4d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3711b5bc-2a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774667231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667231, "uuid": "fc66c98c-fc4c-4398-916f-665e4919d877", "comment": "Malware payload (Mirai)", "value": "75313bfd47148cc2860ea2131ef7cb7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667231, "uuid": "b8907fd6-7ae7-4968-8c90-31521ab5e1e0", "comment": "Malware payload (Mirai)", "value": "06b5b580aaaf8758e38d2b79719aa18b91570aac46ee153bd1d49a0a5f73da6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667231, "uuid": "a30be3ab-8417-4e96-98f0-1bacdcd1f338", "comment": "Malware payload (Mirai)", "value": "9944a418f83afc3d4b0681d86e0493c0406e6044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667231, "uuid": "936becda-d3d8-490b-9c56-a14bf1066a0f", "comment": "Malware payload (Mirai)", "value": "5d8fc2e20373bdba55382f87aeb280a83ea1273b559ff6f3dae23067103ce1eee377bccf48979acf16db6b268ff6c8a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667231, "uuid": "9b89978e-0408-4e0e-8e64-246f97ac022a", "value": "T13904975E6E329F7EF6A8873047B34A34A75923D623E1D684D2ECC1145F2025E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667231, "uuid": "18e1926f-1643-4b00-bf5c-74e7121fa806", "value": "3072:W8XQCzGybyuJ0m1eeonZSAtbYyPGkFxPwcIZ:fVzGybyuJKJ0ajP/xPFIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774667231, "uuid": "18a2081c-8eab-4bc1-b867-64e26dbe74c1", "value": 182020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774667231, "uuid": "ed215ac7-1eef-4253-9f71-c0ab9b0063d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667231, "uuid": "6632705b-db28-421d-9705-cefcc59b101f", "value": "upnnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0f02d7-2ab4-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774708876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708876, "uuid": "236e7349-9ab8-4ef6-b581-ed913400903f", "comment": "Malware payload (Arsink)", "value": "31f38e6ec8e7e90753b382773614906d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708876, "uuid": "d9829104-16d5-4a03-9e5e-ca760e840782", "comment": "Malware payload (Arsink)", "value": "06f7dfdfbff03719082750fb11ca1f1fe720daa57f11c7d30d3b3277bfeceb13", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708876, "uuid": "0ee5a27f-853d-4072-8172-382bb146263d", "comment": "Malware payload (Arsink)", "value": "6826915272fcdd07920d40254c32a5da1038d101", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708876, "uuid": "1ce9b061-042a-4426-9be9-60ff0e76db7f", "comment": "Malware payload (Arsink)", "value": "4179dd401cf2ac841763c6361de1caab2ca2e770c7d8f95b41c8a061e2d288d683a9748c8b7c94bcf480c55227b79402", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708876, "uuid": "2ef1eac8-1b88-45d4-95cb-74fa57697da2", "value": "T1258633A3E781063AF09D687CAED34AC6F1092D5BA329A1C1E1B5F7B175B73604F86107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708876, "uuid": "4c2f180b-2014-409a-ba9b-d65b0c0a0169", "value": "196608:f1ZzxpwXzvob06McFyACZPKKbkTljmh8EOZM:fBpwjwb067FVCZC6ElL/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774708876, "uuid": "58a854c8-1b4a-4694-9a04-ecd5eeac1493", "value": 8545457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774708876, "uuid": "e3185e63-1a88-42ee-8bfe-c301d5d009ae", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708876, "uuid": "c1f4ac4d-26d0-458c-afba-455305c31951", "value": "Evil Bunny Neighbor Android Edition.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f125389-2ac4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774715859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715859, "uuid": "9457a6bb-e227-4a83-a1ea-ed6c5910419e", "comment": "Malware payload", "value": "0452879e6480d8b30cba52265f294190", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715859, "uuid": "14255c12-2121-440a-9415-2eeb7375071b", "comment": "Malware payload", "value": "084274fb033411a03b996c1b17f10cc3780e65effe52de2bed3fd76b6138d99f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715859, "uuid": "1ab6747b-dc84-46e9-bce2-1e73f6b3499f", "comment": "Malware payload", "value": "fc501a7e844a9b08d085d7e91fae267224711d4a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715859, "uuid": "d2a06688-fe52-433b-9055-242907907b5e", "comment": "Malware payload", "value": "c44112704b9fa371e499037ab0c052219fd3018fba756ae289b39705c0712205b753d98725e9ef09940fd856458004c7", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715859, "uuid": "96cadd8f-3027-4ede-b6b2-04d46713fdc3", "value": "T1B5A5AD4A7CD104FAD0AA63328DB662967BB1B8490B3223C72E50B67D3F767E05C39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715859, "uuid": "278c1b92-b8c1-4443-997b-d1ab8c76422c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715859, "uuid": "040d7d0c-72f2-4eab-8696-c8f90a64c498", "value": "49152:2k/rpqhYVerJDOO5oKGg0gUL2OKHRVtYrdF:2e1MJDh101L2OKBuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774715859, "uuid": "ecc63ea8-0935-4989-bcdb-ea6591a34ed2", "value": 2228416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774715859, "uuid": "cee9d59b-fcb9-4e63-a0e2-5818b3296ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715859, "uuid": "673e4244-ed67-4e68-881f-530a61362798", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44381f22-2ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774724806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724806, "uuid": "ceb4500f-26f7-41f1-97af-82e78c3d70e6", "comment": "Malware payload (ValleyRAT)", "value": "6bad108dc071364eab6bc2159effe885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724806, "uuid": "7f788e26-297e-4ebf-aec1-83446cbbf36d", "comment": "Malware payload (ValleyRAT)", "value": "0953e4227c3f8a5a834fa821fd542a1c948dab9aacbb4e2f7b494fedf98a1ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724806, "uuid": "169ec0ac-b693-431e-bdb9-0135c8eaaf6a", "comment": "Malware payload (ValleyRAT)", "value": "c9303a8637050ef8093da0c60829ec92bf6afa77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724806, "uuid": "7ad77c27-3674-45f4-989a-0eb337557030", "comment": "Malware payload (ValleyRAT)", "value": "a9a14115cb3ef19e60fbe26581c7de28636ad90f7cbcd79602ceba35a0cf46e18fbb170e023dc9bc2503fb30a9d6b485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Win64/Malgent!MSR", "colour": "#C34936", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724806, "uuid": "c19d1993-5bf6-444c-a61c-f97564595529", "value": "T17F5611146552D6E8FBC2B6B84A05D1F4977A7D221B32D6EF02F13A173E335C78932A21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724806, "uuid": "d79fc49b-03b9-4cd8-9851-e60d415c5f97", "value": "c2b1918a0623855be1a49e774e5ed82f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724806, "uuid": "8961082f-08f1-46a8-a004-ac8c98395821", "value": "98304:lkUvPzUc0loFE1W+X2xaQVSYM05NB+nGFXJqEFSKTKK4KKDyK5EZ1EEEEmEEE1EV:lDvPzUc6oiW+X2xaS5NB+WtFL1BoU3cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774724806, "uuid": "2f64d6a8-e5ca-43c0-808c-bae88d86f6b4", "value": 6140416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774724806, "uuid": "a3bd2aea-4bae-4903-a344-081bdd6e0284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724806, "uuid": "caefdf61-59a4-48af-9842-e796b89f94ed", "value": "dingtalk_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fcab82-2a90-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1774693588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693588, "uuid": "8e135cb0-4d97-426d-b897-f3db7a43cd8a", "comment": "Malware payload (DCRat)", "value": "6cdc64fa1baeaf6571d193c94da034b3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693588, "uuid": "3a0cf59b-dc16-49dd-b81e-208af89e02d3", "comment": "Malware payload (DCRat)", "value": "0967642412f4e199c78db003425d750a183ab5f954b50396c6a293a9ea4fc9a4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693588, "uuid": "f5c3c593-17b2-4b35-b255-c306210061cd", "comment": "Malware payload (DCRat)", "value": "1b26d0097ca7b8da0fabca15753e637f80622574", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693588, "uuid": "2164074d-a2e2-402c-96b0-953b1bf25b48", "comment": "Malware payload (DCRat)", "value": "1cb36f2dca95b491807752fc08f9b849b54be1e474f7cfe02a38148cb0e063af41c632048c77be6d8f03bdc128323c0b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693588, "uuid": "09821bac-a9cb-4548-a670-e0cddef0a45c", "value": "T1D6F5F1427E84CE92F0191973C1DF420447B4AE516AA6E72BBFA9337D54213937C1EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693588, "uuid": "9c52b121-847a-4415-a84d-6e7a634b5fc6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693588, "uuid": "4e17f4f3-6df7-48fb-b192-84b44727f0d7", "value": "49152:UbA30q5X9zlaCsc6cxhvXUp+o7OVfeAFxLUFZXltJxZIdU+rc18U:UbW5NzlRXhva7If57+Z1ttIdU+o1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774693588, "uuid": "f13856f4-d2cb-4678-86bc-817c7c89c072", "value": 3476337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774693588, "uuid": "5c9529e7-85b8-476f-b4f3-535a9430e61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693588, "uuid": "4294c304-a289-4a9a-be78-87d5ea001619", "value": "CHRONOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2961e31c-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774706722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706722, "uuid": "efc777e2-cb2c-4a2d-872c-d1447c9c417b", "comment": "Malware payload (SalatStealer)", "value": "b0d25d10cfdfe07a8ee2f7249be01292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706722, "uuid": "0d8ed0e0-ecc3-4e5b-aa33-f89bffc63232", "comment": "Malware payload (SalatStealer)", "value": "0a1e4f5fb63f0c15294267ed9e03abede1db0e20327f570504e57f41fa2c7dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706722, "uuid": "d76f527e-a03f-4891-863c-755f246c1315", "comment": "Malware payload (SalatStealer)", "value": "c4be908a759b0ae3eaed961fa2916644af59fee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706722, "uuid": "2ab03127-47c5-4672-b373-a3baa55cfb47", "comment": "Malware payload (SalatStealer)", "value": "95410f563cef63a399a9a9a6bd2562e2ec32b10db82a586e954a2137cf7ba6e885fbad7a41dd197fdfe8db9b0c10e0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706722, "uuid": "0199c8af-3659-4c1d-8993-4478025a2901", "value": "T157D64C41FD8B54F6E903583141AB723F2331AD048B28DBDBEB587A2AFD776921876305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706722, "uuid": "3575a65c-81a1-4a38-9a7b-bfe0c249f140", "value": "49152:8pxJOfBgW2B9HR/2cSOyRrYGxz68oz0KDs8k6JfbdMx5Gz/pb99nTWAH+nR0Wljj:uJIBq2c5Y0Gc82zK8SR2+4VoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706722, "uuid": "52e7cf7a-583e-4b8d-abe2-6e76c2d3499d", "value": 12921344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706722, "uuid": "544ef1fb-b78a-459d-95f0-ccf3cecaa906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706722, "uuid": "bd3d9a17-602f-4a0b-96d5-97584785660d", "value": "0a1e4f5fb63f0c15294267ed9e03abede1db0e20327f570504e57f41fa2c7dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8766707-2a5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774671341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671341, "uuid": "3e97c389-ed62-4a9b-a0e0-c90091fc20ee", "comment": "Malware payload", "value": "2518fbb412168126ece4aefe957c48d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671341, "uuid": "40203c28-fbdc-4d74-9072-e90add89abef", "comment": "Malware payload", "value": "0a735cb4d609d5ba22f5f2598dd20ea5e5ff931e34c31b2ab93660f9eccecce5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671341, "uuid": "fd1175e8-d2e7-4218-9c27-7fd55089b498", "comment": "Malware payload", "value": "a45cbaf6f7901a0246d3210978e60ce17b3e3398", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671341, "uuid": "a5b9912b-9ea0-460e-9beb-09737e73cb44", "comment": "Malware payload", "value": "70ebc58e822b3758970f620fed8b93cd0337faf532518eb8b5add6cdbef41bde00684011697f554e9eae9e22ee5f9887", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671341, "uuid": "1eb27140-c320-4e90-afd3-c0b11afd26e7", "value": "T16747DF77814338E9E5B98DB4D41025416DAC388B5738A3C7BAC871E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671341, "uuid": "801947f5-29d1-4a2f-95e2-23d2841c5ef2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQV:cqYUQuVDt0TZEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671341, "uuid": "348205aa-5ca3-4e37-8f0a-689f2637ec1b", "value": 26836992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671341, "uuid": "0b046936-c2ca-41ac-91e5-f488160064fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671341, "uuid": "860767d3-9540-4f03-9e8d-9b8748cf41c2", "value": "0a735cb4d609d5ba22f5f2598dd20ea5e5ff931e34c31b2ab93660f9eccecce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e718f42c-2ab1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774707899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774707899, "uuid": "802ab1fc-e8b1-41bc-b465-2dde8291569c", "comment": "Malware payload (LummaStealer)", "value": "02afcb50496fcae9a555fdc05ddae713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774707899, "uuid": "6f0c0682-09a3-40e7-927e-e2ba89b8b19e", "comment": "Malware payload (LummaStealer)", "value": "0ba68de391c48c9ef283dd8438b68a93ea6b69fddf987e32b16976b0bc0836ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774707899, "uuid": "c8d3ba82-54ff-4c02-97f4-a1fb051f8c49", "comment": "Malware payload (LummaStealer)", "value": "2873501c7597e497e76db72021cc676265439310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774707899, "uuid": "af5388a7-977c-4740-9e5f-28ef9978335b", "comment": "Malware payload (LummaStealer)", "value": "3edf434166e72fde8b9a0186ddb67677fe2fba5e9f41ff2e49e2c59bde41466ce4b31d1c6244c4cd6b55fc73e2871c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774707899, "uuid": "b894f71f-7abf-42b5-b418-4cfdd0e7b3f5", "value": "T14126D001B4C0C472D122253055F4EA340E3DBDA14F66D9AF77982BAE9F353C1A726EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774707899, "uuid": "e1b30191-6153-43bc-b836-9625bf8903c9", "value": "15145246279dbac9c0f3d99a59f6d9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774707899, "uuid": "ba24e29a-10cf-49b0-b40d-8c36801bccff", "value": "12288:sgyaj6kygeMiHux4N0pnuqHo0L8T01TA6F:ZjchMY0Q011", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774707899, "uuid": "6aadf384-a247-4124-be0f-129299429345", "value": 4551680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774707899, "uuid": "22e7bc92-429a-4182-a12e-2bb52452a735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774707899, "uuid": "e34ba97e-b152-45c1-986e-90879a73dcd2", "value": "0ba68de391c48c9ef283dd8438b68a93ea6b69fddf987e32b16976b0bc0836ef.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09bc0a4-2a57-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774669207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669207, "uuid": "9e526c34-dfdd-4f00-922e-af747bd33ae5", "comment": "Malware payload (QuasarRAT)", "value": "1424a8fcd5aa3daf7d0d2f6926da1892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669207, "uuid": "22c0bc3f-c9f4-4dcf-b67b-f795a450af58", "comment": "Malware payload (QuasarRAT)", "value": "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669207, "uuid": "fa020f89-22a3-4b44-a85a-1d7f27e86d18", "comment": "Malware payload (QuasarRAT)", "value": "c05323afe860078044daacde8e1e9d6ab092743b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669207, "uuid": "d6e382fc-c331-49de-88d0-022b5b4ebf2a", "comment": "Malware payload (QuasarRAT)", "value": "0d510afca734e134a45e18039aa67def6593bdef67c154bc9a30ec187208ded4ce0c788e6d99637e5dbdac2e5b2275f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669207, "uuid": "b198e2ca-0e4c-4f58-82a6-1a93467393fc", "value": "T1D0E56B0437F85E76E16BE6B7D5B1501263F0F82AF363EB1B2581A77A1C53B4088426B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669207, "uuid": "1d6d5028-1f3a-4cb4-873e-e616ac7f984e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669207, "uuid": "d230d6fb-00d1-4f55-a1d4-b2b895320a84", "value": "49152:evkt62XlaSFNWPjljiFa2RoUYI8XfS6oGdxTHHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIAfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774669207, "uuid": "694c9d79-8a13-44be-a990-cd1576c622cc", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774669207, "uuid": "928075fd-6489-4dc6-890b-47776fd81537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669207, "uuid": "9b87527f-22d9-47de-a409-00d744e719ac", "value": "1424a8fcd5aa3daf7d0d2f6926da1892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03365b60-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720402, "uuid": "0721c4f4-0562-44f5-941f-fbbc66b27f3f", "comment": "Malware payload (Mirai)", "value": "b60a3bc32154c2bc69ae02287f94defb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720402, "uuid": "25be54b3-3e49-4862-9cda-5f967db4008d", "comment": "Malware payload (Mirai)", "value": "0eca9c5ce899393b2afdd84b63061b36372817a6416ebee595b700c08cac6a3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720402, "uuid": "7f483240-833b-4819-968e-a439a7efc148", "comment": "Malware payload (Mirai)", "value": "b3f8b9ea13dd4d9d8cf78c6ff705bbb00d82451d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720402, "uuid": "0b0dc266-80f8-4e1a-bd05-fec22fcf89e0", "comment": "Malware payload (Mirai)", "value": "c1e4443ee82dd3b68f309f3b01bdf3291316d7f90a5e684bf76555d39a3c0caf73665ae561f797cc70a3457fcd217477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720402, "uuid": "2b1f797f-862e-4817-9ca8-206bc8baed09", "value": "T111230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720402, "uuid": "814eca5d-115c-4f23-b2ca-8e4ae26504d5", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THa:5DmKF7Gxyk8cqoHAmWurAufsG5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720402, "uuid": "baef9437-7cac-44a7-9281-1353161b3b5f", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720402, "uuid": "2311f256-b454-475f-8eed-c84b1a345907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720402, "uuid": "5e4ad569-0a6b-48d8-b877-fc7884e442f4", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22108e4c-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774729473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729473, "uuid": "52f01ed8-35de-4d17-b2d8-19e7fa9b207d", "comment": "Malware payload (LummaStealer)", "value": "27d5ca5bed0cad0718a7c63f1a99d17f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8559", "colour": "#56B3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729473, "uuid": "7a0e2412-8b88-4e22-9459-4a6224df01ec", "comment": "Malware payload (LummaStealer)", "value": "116aa6093add4b437b303dbc1d36e704add5f7ae14c735de30a58b76177b119b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8559", "colour": "#56B3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729473, "uuid": "fa4e30ad-0ff5-49d3-a363-5b59c16d7cdf", "comment": "Malware payload (LummaStealer)", "value": "2381cf551c271856d0e04836847edeece909bd31", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8559", "colour": "#56B3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729473, "uuid": "9f379320-9ae8-4cbf-993d-bfbf6fd7e265", "comment": "Malware payload (LummaStealer)", "value": "c4de302a430816f845220ab489685ab707525c2e9ec6aea8328174c403f250b891e9de87228c1d9f0c5839085902aeef", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-8559", "colour": "#56B3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729473, "uuid": "6e249f15-ce3e-48bb-a22e-774eddfd7931", "value": "T1FA0733B579D12DE2D1689284F05D9B6F317E9DB8EFD1323227C2265E980039B1BBE350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729473, "uuid": "5f20b64e-a5b9-4902-a481-814739d0db6f", "value": "196608:ggKbeGSoWbeiKWcGVF2ujm8cltHR7giHVj1SH/Wxbz5L1RaLXbil5rxaYEjkxeMG:LK6K03/jmJj7bVxSfIR1wLuDrxT/TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729473, "uuid": "d947cd49-7d9e-4bc8-8d3a-8f2d1f3b3dc3", "value": 17014771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729473, "uuid": "463a7df6-83d3-462a-8f35-1e1536aa14b2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729473, "uuid": "4f8418e4-d896-4405-8a22-3fee38e31128", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4890f0e1-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686588, "uuid": "7820bc5a-3e50-41dd-ae3f-292171e7fec8", "comment": "Malware payload (BPFDoor)", "value": "fa8d29099ee2836436d573b0160655b6", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686588, "uuid": "80852d77-74ea-4748-8b62-c359ae35dcf4", "comment": "Malware payload (BPFDoor)", "value": "123eb70723e4a186fa83ea5760a1ae0e16cffd76a62e6464d5b79b8d0979a7a7", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686588, "uuid": "94314ddb-8588-4481-a7ff-ac89fb5e5bc8", "comment": "Malware payload (BPFDoor)", "value": "ed6750fe47d9827a437d4ea1aa386662fed4a2a4", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686588, "uuid": "edc4d952-af5c-4cc8-a3f1-8265091570f6", "comment": "Malware payload (BPFDoor)", "value": "619426d3c42a90d0360117a14697b438a25f4f4823b08729c2e3948a6e69ced630fa9da8115636477c0536686cf86784", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686588, "uuid": "cbbaa170-accb-41d3-b01e-9c3cba13b2ef", "value": "T15AC2E72BA1928B3AD546E2B41DDF4074B873B0F49B27A21F3E4132369C617C94F1E6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686588, "uuid": "239616ff-d15e-4daa-abe8-f2574d14f332", "value": "384:wihqewT68RfL6YG0N7WFpdFLufi69DeS3YCqmNhj2Hc:wUqe068RjRN7ydFcDe2YCqX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686588, "uuid": "7eeb076e-c5a5-41da-9581-39e175a3b71b", "value": 27920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686588, "uuid": "bc7365d4-cd94-476d-b866-2f4cd2d42396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686588, "uuid": "9a54cec8-b189-4b60-b110-aa7d84b5e7cc", "value": "123eb70723e4a186fa83ea5760a1ae0e16cffd76a62e6464d5b79b8d0979a7a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bbf31b-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720411, "uuid": "c3865700-a98f-4cdf-b4db-9feab8e0800f", "comment": "Malware payload (Mirai)", "value": "bf19cd9ecc647ea849fbf918aca3f921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720411, "uuid": "1f3bb955-10d2-4e00-be03-c9d2817120a7", "comment": "Malware payload (Mirai)", "value": "1423cc40c26db4693fe28ba4093fa61f3e31f0d55d7a690637050f9651ebc973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720411, "uuid": "affbe288-92f9-40c4-9211-ec2817fe5cfc", "comment": "Malware payload (Mirai)", "value": "489643f44bc8ab40dda2ea303331e357cf6ba6f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720411, "uuid": "e58d98e1-1645-4e0e-b803-7cb111c2505f", "comment": "Malware payload (Mirai)", "value": "e34c2af6ebafe346d3be388dcdbab4b95ef631e1866b6450b7177c50a123bf7cb7e948c610c77015de1a364fa5af23fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720411, "uuid": "82eee9a9-8c8b-4098-a21f-e4406cc06e05", "value": "T125C35B42FA818F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720411, "uuid": "59685693-5850-43d8-8942-f01cbcbfdfa7", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoprScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIprSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720411, "uuid": "0b572ae7-418c-4c78-866e-c8c5b1dc0da5", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720411, "uuid": "13b28c82-6014-4a2a-a334-24365674524a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720411, "uuid": "db847850-307c-470a-bfc8-82c857fb1dcf", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8e0782-2a99-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774697606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774697606, "uuid": "8f843d64-db33-46fb-b3c6-03a3c06b7855", "comment": "Malware payload (Vidar)", "value": "42fe404900688da4096f37fc52a0817b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774697606, "uuid": "cae83f77-853a-4a6d-bc94-9f088080c423", "comment": "Malware payload (Vidar)", "value": "14b499c006fd4d56403f51c143895d0aa93de3ee9a94d198978d9ccd65706b5e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774697606, "uuid": "4eb68832-6eab-42e4-83cb-57c5815f5c00", "comment": "Malware payload (Vidar)", "value": "838acdd41aa66ec8060aaaedb403a212f5a3234f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774697606, "uuid": "8b790889-935f-4938-b8d7-0e9a08fe01a0", "comment": "Malware payload (Vidar)", "value": "07af26f698c205834f5a0aff33d0ee27329e010fd9b511d6540a5e11a79cd0830704459b8ad3b675efa1a1d2e91ab011", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774697606, "uuid": "241857a9-80f8-4f35-bac6-f94583c60219", "value": "T12EB59D076DA545EAC4AAA73688B36285BB34F8490F3133D72FA17A793E723D05E34354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774697606, "uuid": "39393106-9e6e-4622-934a-a8cb30c9a294", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774697606, "uuid": "83e58e8f-b922-4524-83ce-00fed8485861", "value": "49152:+lEyNAeOfsj4owMl4D2pxjDtDzHcKJWmQ8:+d40j4CpxhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774697606, "uuid": "7897c43e-bb0e-448e-9c64-466b1f575664", "value": 2462376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774697606, "uuid": "a10320ef-bf3c-4af0-9c81-7e66dc1d38ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774697606, "uuid": "f8e5828a-bc65-4e1b-af16-d3d8a50d9762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6816aa01-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774656576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656576, "uuid": "a82b04fb-2f08-48e5-a494-5b447ae084b6", "comment": "Malware payload (SalatStealer)", "value": "087fa8844d1e09fd1f30eebcae971edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656576, "uuid": "cfd158f8-1a87-4bd3-af5c-1477fd9e1784", "comment": "Malware payload (SalatStealer)", "value": "190e14386759c250ff5bcfc53f042e86bd7c7730bdbf06b98725c282cc37397a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656576, "uuid": "1eea80b4-0bfe-4820-a6b3-7c51abcd6958", "comment": "Malware payload (SalatStealer)", "value": "50cb12cb170de8e1543dd099b348ede669f4f2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656576, "uuid": "f9aa2332-c9bb-42f9-bda4-650a9aa8eb18", "comment": "Malware payload (SalatStealer)", "value": "767a27e4f4398b82c9516fb8a699af8f06a561a37dbf02d29fff5656ee9d5f5102f8cad65e0486451c1ee2dcbed465b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656576, "uuid": "9811dcbf-e9a9-4b0f-a72a-392514408f9b", "value": "T1BCF533A76F31A690C313937D0E11C36FB0ECBCBAE655B8C92D4C6306BE98975D6014B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656576, "uuid": "061cc8c1-62ac-4552-b51f-881d216e9526", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656576, "uuid": "22d70a19-f69a-4c82-8f2f-a375e7150f64", "value": "98304:yisb7lgRGJMp5z6jarxat2S0ElInvlFuOXu5N/9o:yi67lGVD6jarE1SHL4N/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656576, "uuid": "9da68fde-8fef-44a4-91ed-f0bfb0abde81", "value": 3587072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656576, "uuid": "cc432d9c-f1e3-4876-90ce-dae6f92389ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656576, "uuid": "23fc6e14-2dcb-469d-82d0-df0f97960c52", "value": "valonity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57bccfc-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720352, "uuid": "a298a306-0f0e-4fd2-8e0a-dbb2f283ed1a", "comment": "Malware payload (Mirai)", "value": "eaca40fd3d5b1dd375e2d2407b74f786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720352, "uuid": "a2dd48a6-9db7-4e40-a203-27439a5dd1e4", "comment": "Malware payload (Mirai)", "value": "1b491d67e6f2debc782ff4f1533afb2959de03515ab5f62db6e905eeb28ee874", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720352, "uuid": "a00d3cc6-57bc-4bb3-9367-260a4e8b47f2", "comment": "Malware payload (Mirai)", "value": "70bb803ff628ab24617f5d5e792f7d47ff94c4aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720352, "uuid": "a458d237-766c-444c-a9b6-c693c0a7ec40", "comment": "Malware payload (Mirai)", "value": "bff9ad3b7ac690b867b7df830b118ccb5e3725e739b385de76244271e11b1219125698120a5ca34064436c2629b212f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720352, "uuid": "e7a18a90-15e3-4fc1-88e9-7392d003fe12", "value": "T1D1B2D03C1B151BA8DA1DC0BD839C0B513CB81B2591829D4B7207EDD7AF9A8B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720352, "uuid": "fb15bde8-103b-4155-91aa-1a9bc642d21d", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiImdtJgGlzDpH7uNj1JA45:YeD8ZSWvZHZbs1row697qohQvg9IitJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720352, "uuid": "305d2888-5f2e-4b7f-af81-9956dc9d1dbd", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720352, "uuid": "a94ad6df-c891-4e1e-8076-a22abdf6e9e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720352, "uuid": "918235cd-bfe4-43a9-b435-d3f25d2488d3", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee723c68-2ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774714784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714784, "uuid": "22a91a65-09bc-46d7-8368-952bc88f84f8", "comment": "Malware payload", "value": "07e441b0165facd91690ad69c185440d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714784, "uuid": "8f3d59e0-d8f2-4c27-a8e4-7a94c786e162", "comment": "Malware payload", "value": "1eed6c0318d9536a981450c380a16aad6856cac5ccbbcd2625d9477641bb188a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714784, "uuid": "fec17f5d-dd3d-42ce-95ab-c017f97fa48e", "comment": "Malware payload", "value": "0e64984b46eb82d51455ff2525f97320411d26e8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714784, "uuid": "1295d1d0-4035-4c7f-a7fe-14a39852df18", "comment": "Malware payload", "value": "01380f0174658de8a2a720804332245d666f4a7ea0fe02d05b941f3985f81658184f1676d36a43ce5cf873c677045867", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714784, "uuid": "418a0b17-2138-4845-8d40-250d3cfbd36c", "value": "T1BBD3AE4D0C5F00D106525C65578F1977EB79B46A0398C69BBBFED2E2DF288AC10B72E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714784, "uuid": "8ffc810b-bad7-463d-a229-91be19b095dd", "value": "768:47lwBgyMwU8Q+wTeDywtL3qa5Zj4X7baMruqwc5Mtw44Uj0axca7YOXOcHV8uBkm:weayTU8DywtL3qa5ROMtx0axcarlm7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774714784, "uuid": "566cb6c0-5068-4ddd-a226-cd4845d72760", "value": 137325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774714784, "uuid": "fd5d32c9-6613-4646-a3b5-af0bb525fbd8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714784, "uuid": "223d3a78-a671-49ec-80f6-62d75fb722e0", "value": "Local_X_Summary_731.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3385eff1-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686553, "uuid": "715401d9-854c-4021-b4a7-22da256975c7", "comment": "Malware payload (BPFDoor)", "value": "6e5231ba10d4c2fd53787d2887acbe9d", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686553, "uuid": "7c95045a-7fda-4dbe-b738-35313b3b7705", "comment": "Malware payload (BPFDoor)", "value": "1f4bde6295973e54ca0bb67c532095559bed024186219d8d0b4323b9750d82f2", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686553, "uuid": "6445d964-7f39-49f7-ac05-b45fba7c7c72", "comment": "Malware payload (BPFDoor)", "value": "5f6e72b9dd8d6643a2937e7be66a481ca1bf1598", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686553, "uuid": "83402ccd-dfdf-46ea-9f56-a7b5a9452d4b", "comment": "Malware payload (BPFDoor)", "value": "241bef838b9d83a91cfb1bf17eec8a97a23913cea454e12f36b63ed0ba4c708eeaf14dcd20bb270c212a286e2bac17c4", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686553, "uuid": "9475baa3-3cc3-49de-8054-24cca4833a95", "value": "T14E545C4AB6AA18FDC997C8304A2761766DB074A962127D3F3486EE306D16F301F5DF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686553, "uuid": "9874e6dc-6176-4a2f-9fca-5c6322343ff1", "value": "6144:Q5yJ6+er3j5P9JTE7rJuKORf5avD3L4Wkl+9dfArs1u5:OqFyp9JTE7rJuKORfsvTLTklof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686553, "uuid": "0b02f84e-199d-45af-b527-4f2275a881fd", "value": 303058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686553, "uuid": "ffaab97c-ac58-4308-a4d5-e77ad22210bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686553, "uuid": "5ac94994-1b7d-46df-b453-a48b47a1af5f", "value": "2025-12-13_6e5231ba10d4c2fd53787d2887acbe9d_bpfdoor_helldown", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c87ad06-2ab4-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774708902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708902, "uuid": "1cb38b0e-3843-4d7e-bb39-884b29aac0e9", "comment": "Malware payload (Arsink)", "value": "b51b921b28b8e27d6f9c8a4b6f0cb343", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708902, "uuid": "2fb2bf16-59a5-4c8c-a873-d9f2f2553672", "comment": "Malware payload (Arsink)", "value": "2063030918df932a61673559f99e51cc47f3436337f94afb2e8acaafa84289ff", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708902, "uuid": "859e7b40-788b-4540-a962-a2c3873c9afb", "comment": "Malware payload (Arsink)", "value": "890b9b3722cfcf4092cdd397ec112a016d6d9ab8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708902, "uuid": "47aa1ab1-e5a7-4787-84ee-8e058522a7e9", "comment": "Malware payload (Arsink)", "value": "ea216e22e6a678b043c7efd6b37f408b2948df9d0eb72cdda8f7d1daee421a74cf1c644247db859be712e51249864061", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708902, "uuid": "d3c109e6-0c61-4365-9e26-31171c79db27", "value": "T127472342F788A52BC4379132C6BA5B27918B4D118F8397536A05B34C69B76E4CF1EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708902, "uuid": "9b5f6389-dcc6-4b9a-a866-0a3428a4aa90", "value": "393216:/cP5dkU4GpemUftA+8WhoJoEoDo9qYLLmQK+Iodl965qJnS2+CqW589VjUR2B7:/cPfklLA+c0YXmhotJndqWOo2B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774708902, "uuid": "5ce57a96-4cd5-4de2-87e8-d0bc2973c52e", "value": 26004713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774708902, "uuid": "96365606-b20b-4b70-a1de-c10168bb1588", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708902, "uuid": "cca209a3-95b5-4f9b-8fa7-8678b12880a2", "value": "FIREZONEBD.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e7014-2ac1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774714492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714492, "uuid": "2bb63271-504e-49a9-87b3-1ae10ec692b1", "comment": "Malware payload (Mirai)", "value": "1efd16ee79357e61922294180fe7acf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714492, "uuid": "ae61522d-90f9-4f25-9f46-09fe542058dc", "comment": "Malware payload (Mirai)", "value": "2363d42ec31aac6ebef7c984ac753ca30edaff8befbe58799a62e383e3cefe29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714492, "uuid": "6ca13073-f6b6-433d-9172-302c6cf8c469", "comment": "Malware payload (Mirai)", "value": "229d66c9590da2c34f6744ca0efa0dbc3dfce735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714492, "uuid": "aaaddfb0-71c1-4e78-bb2b-5eab1fb1e24f", "comment": "Malware payload (Mirai)", "value": "02602c8bb680702ee580c8619b92294e0c417bc4e15d38d599dcacc440607f9027dcb94d8b01ffd3c6317a5b02f8e633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714492, "uuid": "59f317e1-c576-486e-8a25-8bddb0b14abb", "value": "T16EE318D7F900DAB9F80AE73748630805B130BBA159925A377357397EEC3E0A90567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714492, "uuid": "94785af9-f41a-45be-be12-4522828d5f10", "value": "3072:4wEKwI56K687Ixn69ov9gAmJ4VVjbiBLwooxzm1Iy5csN:LE+IZ6mvZmJrLEy5FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774714492, "uuid": "eb8b1927-124a-4514-9d78-4b6716a7df47", "value": 143628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774714492, "uuid": "cf1b182b-4cb8-41ff-ad0d-7e30c17ca0a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714492, "uuid": "2dfe2545-1202-4e67-bc97-cb0a824112a9", "value": "acppid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1fe0e8-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720363, "uuid": "1d05b5fb-1158-42fb-a51a-08395f040b21", "comment": "Malware payload (Mirai)", "value": "8e5491882081c571cbd309f90ec9d393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720363, "uuid": "7be50b19-868e-47d9-aad9-374a1aa67baa", "comment": "Malware payload (Mirai)", "value": "23bd2ca6e5301ca13cee5d8f17cfba5ac158d3e498b72b4ab043ca4cfefe4414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720363, "uuid": "d6253673-2f8c-4760-badf-1bd2357c5315", "comment": "Malware payload (Mirai)", "value": "8196c62e01dd89f6214ab320669b44fc6795a254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720363, "uuid": "1e5147aa-b64c-4aec-93f3-e26177bdf008", "comment": "Malware payload (Mirai)", "value": "5d30919c4d97208471082d3f47311857e1ac539719e46e6f4b76325f2c0907cd57319a434462f996c182b060f715bb13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720363, "uuid": "c5e989a6-f26f-467f-aded-6f725344dec8", "value": "T110432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720363, "uuid": "c30cb2bd-6228-43be-b612-06472804bdbf", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwH:RqtmZPuutfbltZFBSJsBcfDSTFI+BEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720363, "uuid": "c7276398-8747-4833-9e12-99e38cb355dc", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720363, "uuid": "cbdc0f7c-d256-41fd-b349-82caa88b13cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720363, "uuid": "cfc2881c-07b5-426d-bf68-3d0bc39c31de", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04ec24c-2aea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774732369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732369, "uuid": "15039a7a-faff-4392-9740-48bcdfa62c51", "comment": "Malware payload", "value": "1f51a43d96c3a10b117bfe33068f3c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732369, "uuid": "48c00f51-64c1-41a4-9a11-662ec7c9772c", "comment": "Malware payload", "value": "2544251fb0dfa1eaca402526eeecc52c583b2586e2af6b912dd5c198c1b871c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732369, "uuid": "6ed1c09b-b50c-4078-a1c6-7d240b7c60a8", "comment": "Malware payload", "value": "301a6bb10db272dfea501aa3b31154131ddd289c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732369, "uuid": "133af4ce-e9a1-4979-96d2-6bc2e0f54b7f", "comment": "Malware payload", "value": "25af84ffda66a208de42321e86d234aad8f2e308be7111a51342ebfa1dfeddb0f660cad690bc5f25a71a8dee1f7c7d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732369, "uuid": "5a0e70bf-a5e0-4b61-82ef-e8a74477f6fc", "value": "T1353609127F58EE1FD26421348AABC63427E93D0482F025338756F3192FBE2759D5AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732369, "uuid": "dac93564-e9ff-4673-b3c0-29cfa0480dd6", "value": "24576:teHL5UGPZuu8aOrH/KcnHZbwbaiPVqj8lVGaZt/hq6eQIWiYCID:tUj+9ucnSbrPnlVDZtJHeQTiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774732369, "uuid": "370aed63-75b4-44a6-bdb0-ce996c0c09a4", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774732369, "uuid": "0b11e60c-2d93-49fb-9f85-d1fdf5ad5c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732369, "uuid": "9f8ba04d-0af6-4b68-99ec-1aecb9349ca2", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48796654-2a62-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774673703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774673703, "uuid": "33d9f451-1590-43f1-9efe-2a90ed90a929", "comment": "Malware payload (Mirai)", "value": "1f83076fbbe2c4d8ee5b7389f81feb8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774673703, "uuid": "0b8374d3-3502-44fd-8683-d8e7c09445e5", "comment": "Malware payload (Mirai)", "value": "269a363ff2eb073049f31948d48086c4fd115d7942535a0f82d3ba6eb0baa4b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774673703, "uuid": "979abc1e-7fd6-4fbc-a756-7724abfdd0a4", "comment": "Malware payload (Mirai)", "value": "744cef7f26aa2d96eb0f53c66da55001586e94aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774673703, "uuid": "0830183a-2efa-4773-af12-b2f0cd686263", "comment": "Malware payload (Mirai)", "value": "35d7e381d082621bcf4536e4a7af2bd4171b76230141f42bc434586a9dc77bd0d47c171402531d73ecfecbdae5faef89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774673703, "uuid": "d42937f2-cb45-4ddc-9a50-39a35d432be7", "value": "T19F531946BDD29A2AC6D023BABA6E118D3321B3F8D1DE3247CC105B147BC991F1D77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774673703, "uuid": "283d3829-f4fc-4f99-a008-a28c158e17dc", "value": "1536:i2yI63xLtWONbbRM5yH25jxGIX9ykySpHv0L+:CxLtWOxAtxGs81SpHs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774673703, "uuid": "bd2334e4-a1e4-44be-bd51-0c7e629091f2", "value": 65028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774673703, "uuid": "007171d9-9a3b-4336-a270-afccf63384fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774673703, "uuid": "4aee39ad-1043-44b7-9bce-e786818724c2", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d08a69-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729686, "uuid": "55102bec-c75d-47e6-b7e6-a2bee7b29f85", "comment": "Malware payload", "value": "099ee576e86238953f31116d0a5efe6d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729686, "uuid": "95ab65e7-a6e2-4e07-9ed6-5c89267e3bf1", "comment": "Malware payload", "value": "27342466d14ded0d69dfabda9b8334ee5109a9fd7302577eae421ee652feed2b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729686, "uuid": "59686a34-d6e6-4a12-8968-baad1d7a2490", "comment": "Malware payload", "value": "9c8fc0842ed8bf0ac823d38f9620bad4b6270d90", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729686, "uuid": "47dfa4af-df56-47c7-a2cc-00b6641a0c6f", "comment": "Malware payload", "value": "0115346e48e4305965f959fc4eb15e197dd0bcd207ae8e856828d634b20454207a867e8ea26ed10cc8b892aca0a6975d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729686, "uuid": "1a6a94d1-2a49-46d2-89a6-961564e1f88d", "value": "T1A4F633C613C1A8AD98067DBBB4EBB5418DAD08DCD28323FEBD3A1ED1582975405E533B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729686, "uuid": "bb43d3d0-8aa6-4652-8b71-188df30a8de8", "value": "393216:M+zFVifnNTUMV3kNfaNXTIXMMkS0z5QRrKkkl:F4fhCNfaBSMMyuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729686, "uuid": "6411986f-65f9-4412-b679-89997edba979", "value": 15891334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729686, "uuid": "bdcc18d0-2232-42fc-900a-22ab54d7f1a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729686, "uuid": "bbcfbd4e-234c-45ad-9ea0-06171ee9d4b5", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcad8df3-2ae6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774730645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730645, "uuid": "800f943a-82bc-4145-99cd-e8855e4c0a06", "comment": "Malware payload", "value": "bc1c03e7fa10819c9e47382af360a31f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730645, "uuid": "1044cce9-98be-4b1d-89e9-4bda86e3b58a", "comment": "Malware payload", "value": "28758a4c088ebc656a4e3506154b5506fe37732c146eb8e66c55bcb9dcd1bde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730645, "uuid": "bebb6aef-9bfb-4eec-b7ed-d6a73b900c21", "comment": "Malware payload", "value": "c1560a658bcccbacc6c54114837a408719e1c7c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730645, "uuid": "89d7fa94-3f29-4a07-a8a5-381bda3c8107", "comment": "Malware payload", "value": "9ea46daa00465817df0ef5c01ee3878e1aae564992d8de14de12a88186dddbb4b46e017000e125e38878bb16dc8527d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730645, "uuid": "a39047ac-41cd-47a9-9b11-8cb45b3b085e", "value": "T19D46123FA28B613EE02A7AB579B69110583B6E6164024C1296F4F45CCF35073DE3F69E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730645, "uuid": "8ed15753-49c2-45a2-a475-0a76f5483908", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730645, "uuid": "d6213aa2-2fb6-4d74-9937-546b108efaa0", "value": "98304:c5/zigGlm5qdz4M5HDEjO0EGBqBaiE9+Qk+jGqZm+mQUH5kBt:4seU4M5HDA/LsBO+QkttdtH8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730645, "uuid": "5e61ec4c-b552-46ee-8933-e0f3336c2a44", "value": 5772278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730645, "uuid": "a3effc85-47f9-4f14-9603-f9b6fa74bca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730645, "uuid": "82bbeb93-054f-483e-ac72-7adde0f68e96", "value": "Infinity Kleister PDT v1.06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a7b95c-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686582, "uuid": "0664dc5a-7c0f-4ba9-ae7f-7880be7e1fcf", "comment": "Malware payload (BPFDoor)", "value": "7ab9aab965e00211c30e885dbf665f05", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686582, "uuid": "ccfbb20a-9f95-47ac-9715-74cf0c481111", "comment": "Malware payload (BPFDoor)", "value": "29e1b75c659eabbd9977867f1adc876df2c11c1ae411fade20a0561f58f64baf", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686582, "uuid": "26a3d9f0-3f84-41f5-9082-af92137d6e75", "comment": "Malware payload (BPFDoor)", "value": "7748860196d2ec33f45da8e297234f1e26fd29d8", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686582, "uuid": "46c73d8c-c05c-46ec-b153-14716e6b6e48", "comment": "Malware payload (BPFDoor)", "value": "8a67174b99232f0d58de82b2629a2c3a823f9e1951068a76553eacd59a99ca0905310457fd0ad9244cf556290072b412", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686582, "uuid": "d55d84ca-ebb0-458e-89e4-b627684f2fff", "value": "T1D7C2E85BE2A1D73AC1978AB41CDB4170B973E0B9AB37D10F6A427235AD703C94D1E239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686582, "uuid": "59cdf28e-93ba-4b7d-8fc6-f3b90e546cf1", "value": "384:hRkjqFVNxQeZX5ySXhQAWIhzP5pTa9bNsH8mwJCqmNhj2Hc8:hRuqFTxQvuQ5M7Ta9bNsBwJCqX88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686582, "uuid": "8540a229-15bc-4396-8cba-1c3c5f6fa572", "value": 28032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686582, "uuid": "34987a1f-289f-4299-a42b-6a96ee5c533b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686582, "uuid": "c4929456-596d-43d7-b483-0d2d6afc7237", "value": "29e1b75c659eabbd9977867f1adc876df2c11c1ae411fade20a0561f58f64baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd2946b-2adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774725893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725893, "uuid": "c77c3464-01cb-432c-81af-63627c4dcd20", "comment": "Malware payload", "value": "fd7b817a7b9b0881fac66bd2dc270918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725893, "uuid": "75720e22-378c-4026-8bee-81b9f09e9901", "comment": "Malware payload", "value": "2a41ddccdb6f35041a1d8115cbf54d7044f8523dd6cbcbcbc4336e882c48a913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725893, "uuid": "237384de-6ae8-46c8-a0e1-7719afe05589", "comment": "Malware payload", "value": "77bf251d470dad863eed005d2da8ae963fbc0ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725893, "uuid": "13706215-927c-49f5-a351-eef587c4f660", "comment": "Malware payload", "value": "23aec69dbbb8d1a0f7400dd6988560e80d6dfbc950111c46afc518f3dc2b78d5a22ad39975c6c03ada27438ef7dd51a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725893, "uuid": "6beecd59-e69c-44e1-914e-10d0e37230fc", "value": "T1E5C48DC4BE8260B7C8241C300466B6B72E741B615325DDFB825738D2E7F6E73A2725A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725893, "uuid": "143ba1e3-6e96-49af-9247-e0b8fbf77471", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725893, "uuid": "4cea8712-0231-4aea-a2b7-e032582b4441", "value": "12288:i4bZS+74XGs0vyBTbjcA2usBmdOcDbNbzIG1bK6q137vakhXDCpcYc+a:i4bZS+70Gs0g4A2us/ezIGm6qx7SkhWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774725893, "uuid": "37f51fde-c4f6-4cc6-b13b-fa96dfaa8b3d", "value": 553296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774725893, "uuid": "3b9e3bd0-fbae-4a7e-8491-fc092a70ce99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725893, "uuid": "f2fa292c-1b72-4d2d-9911-133225fefd13", "value": "2a41ddccdb6f35041a1d8115cbf54d7044f8523dd6cbcbcbc4336e882c48a913.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91029aee-2a5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774671677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671677, "uuid": "1b157d24-5419-4c5b-a617-d425cae59525", "comment": "Malware payload (Mirai)", "value": "87f0c0664fe0b106166f52c641ec92ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671677, "uuid": "4c85772f-dd43-4211-9a1e-60d41b1a61e8", "comment": "Malware payload (Mirai)", "value": "2a6dd96e61b92ca2110268a4b201373ce13631cedb69bdd2dcf066d77df256f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671677, "uuid": "f8bb8fca-b5a6-43c9-a98d-b80136338da9", "comment": "Malware payload (Mirai)", "value": "1dc31058e62b5b49b567bcf199aecf2c8cdb959e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671677, "uuid": "b1126ad0-0378-40d4-a9fe-25c38251fb7d", "comment": "Malware payload (Mirai)", "value": "99d3ec3d94f4d3b9afe83fc602b0c46a3a3c80a6f6b9ca8635d716a17a0c630832a744333cf6d0426b065d2d72767e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671677, "uuid": "1b27f0bc-42a7-47c4-8789-fb5679597859", "value": "T141935AC9E783E0FAF85244B121765B32DB73E53D602AEE46C3AAD835D872401D71A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671677, "uuid": "cca5a0f9-48e7-46a1-9bce-fc9c631cec09", "value": "1536:hiwIP809Q+sjvIIa9n33amW/RjN78lWrYZSh1Fo:hi3Pd9YjQXZ33o/5dywrFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671677, "uuid": "7aef457a-6f70-4176-b368-a509f3a1a498", "value": 95212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671677, "uuid": "bc05a368-097d-46ae-98b5-325e876818bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671677, "uuid": "5c2cc21a-2bf5-419d-9297-2e0152565f05", "value": "telentd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d8355e-2a77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774683015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683015, "uuid": "aec52e3b-ecef-476c-b909-70345a900964", "comment": "Malware payload", "value": "feb5622e46e8f4e726b37ce422385885", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683015, "uuid": "fdb28234-1623-4440-a5a8-9f3205c97424", "comment": "Malware payload", "value": "2ab82d7829e3473ddd4e3e356aaa44a4ea09aa7dc84818c92a6360b4430a4a78", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683015, "uuid": "70d20637-1c17-45cd-8f82-f5da81b40ecf", "comment": "Malware payload", "value": "63deec5b688e235ffb6df029d017e900348bcf02", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683015, "uuid": "c294b450-4bff-452b-9a90-53a77a818423", "comment": "Malware payload", "value": "78997f7ca3c789c317dddc10119b20c6b50d87f24f99f60ba9a0980b5dd9f6b488a2dc0d1bc4d1218091d70550ee28a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683015, "uuid": "22a68eaa-0b7c-40a0-be7a-7f1369773d63", "value": "T1F0A2E70BF35318ECC456D474CAE3A332F1B1FD19153A2B6E8264C6323EA56756A3DB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683015, "uuid": "cb1bfe27-5d72-497a-9ac9-c835b7b38788", "value": "108eb78d3c8e0a910e013cb7425dd852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683015, "uuid": "5905e878-2891-40ca-aeb1-eb6112f7c743", "value": "384:Sr3DL4GTZgEZ5Akja6p30g9eyOg65U6EDTgDd//I9Rho:Sr3QGlPWkjJt9U5Gfed/uR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774683015, "uuid": "b5e5f2c1-aded-4815-8e1c-7d3ddb61cb3e", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774683015, "uuid": "e2647366-e696-4e2d-940d-d01b1b38c39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683015, "uuid": "abc68cd2-a4d9-4874-badf-f748b28274a5", "value": "dropper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d220b968-2ae3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774729339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729339, "uuid": "8b26b0d5-1244-41ee-b133-e6e93861e120", "comment": "Malware payload (Vidar)", "value": "0ed73c56af6c1620af004478b3fad13f", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729339, "uuid": "77e3753d-33b8-4804-8be7-561f7a2d9c38", "comment": "Malware payload (Vidar)", "value": "2ace7840b3df6d6a02556c76c75d51bcd34fbb52f06e952ddda7ada28493b644", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729339, "uuid": "0979121f-d538-4fbc-a741-66baa04a8e46", "comment": "Malware payload (Vidar)", "value": "e0dd4a65ad0c880efe83a3f640a60ffda560cf91", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729339, "uuid": "ecfa7c10-d70a-4d36-9b6d-41d46fc7a825", "comment": "Malware payload (Vidar)", "value": "bef920110ecaeae444352893ea3c3a7bdf37acf936bca39a3534a50c605d5e69c810951fb4ebc792f04327ba76e36ddf", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-Vidar", "colour": "#F5203B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729339, "uuid": "09d0f145-812c-43b3-b9a2-03a2fb7a6e07", "value": "T130A56B077DA548EAC4AAA33588B26395BB70F8450F3233D72E917A793EB27D05D35708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729339, "uuid": "1b148883-8fb2-4c05-b389-3377fc24d99f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729339, "uuid": "b7dbefcb-331f-4ed1-95e6-5616572985db", "value": "24576:b0tTQ3Vh7Nv5e6T5L9fUTO5SEDFK9RFhele5n923T4JWmQ7:b0BAVDv5eWLxUCLDFKTcsJWmQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729339, "uuid": "0df8b923-3c8a-451f-8378-e200991fbb78", "value": 2115240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729339, "uuid": "eacac5a9-62b0-4868-8e39-bbedb3e9e0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729339, "uuid": "8b728737-8093-42a8-a68a-f69435487866", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546901ad-2a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774668569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668569, "uuid": "a5e49668-68a5-4829-a0a5-955cbe401b01", "comment": "Malware payload (Mirai)", "value": "7efd1b1c688c0935b312e9e2f3f72bba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668569, "uuid": "e9b42d08-bf8b-47ef-8c3b-324e374b8359", "comment": "Malware payload (Mirai)", "value": "2bb93f230f468468e66e2c0362d58bf3a0f96273df16f1fdabe22c61f5e8d1c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668569, "uuid": "dc4d94a2-f1b5-4fea-b1f3-3df2dec64949", "comment": "Malware payload (Mirai)", "value": "1347fe84edf9089a485097c12386473eb558ee2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668569, "uuid": "fe368907-42a8-4e5d-b25f-d8c7fea4e350", "comment": "Malware payload (Mirai)", "value": "5d699956188d9484c94b41f63d851bd63e772c4dc1eb0e73c1c8d4414f623e6eff377c39163d58a8cd4352ccfa21dd8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668569, "uuid": "a98b7c4f-a8b5-40bb-b813-ca87b7131a99", "value": "T1B8A1B6E974B4936B2DB0ED7376D6CA42F14061A7E0C91C0EE6D6F0E8498CF61F494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668569, "uuid": "8b81e682-281f-4d8a-aee9-b68fef3f39b4", "value": "48:vpK8KMV4k2pKDK1V46pKrOKrWV4vpKQKoV4BpKE0KEEV4EtpKUKkV4NpKDK1V46i:v3gd1bsX4TGEpt7OFBjnf8j2tXr7je/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774668569, "uuid": "ef7da43e-8c34-479f-b4c7-1742f0a444bc", "value": 4779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774668569, "uuid": "2ea264a4-efc6-4d1a-a3c1-1843c8c20200", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668569, "uuid": "d4754b75-1286-40d6-89c5-6e4d8748cb62", "value": "lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c56963-2a5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774671442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671442, "uuid": "48e56cbd-58bb-41bb-aacc-635772c6892e", "comment": "Malware payload (Mirai)", "value": "a2e3d4ca520caf6b26fc3f365f5a2cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671442, "uuid": "6bb94e20-2811-4540-a0c0-42350b418ff1", "comment": "Malware payload (Mirai)", "value": "2d28b6f43cbd8f869e52388a0788dd1b92aa5ce7957aeeb294b919aaf379902c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671442, "uuid": "906d5a83-c00e-4e5a-8b13-7e5122d0081a", "comment": "Malware payload (Mirai)", "value": "ef6f294ff4b631f0b294e48ac56fbdf8addc09e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671442, "uuid": "96deaa15-7dee-4117-ba60-4a59a2f4264d", "comment": "Malware payload (Mirai)", "value": "5cda121c41b177987ffdee80fecc8d57706b813b59c92d89845f1ee2ccd4c337c98df53aad9928b45a17fc0800674c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671442, "uuid": "03dda32d-81ed-40de-90c1-2de7bfa89579", "value": "T19EE30856F8819F16D5C111BAFE0D524E37231BB8E2DE72029D246F707B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671442, "uuid": "d449455c-acef-4833-982d-4388fa150c79", "value": "3072:Amy8pgtHQAFLQXaA2saWlSGjvIAgbBnQ65HDCm:Hy8qJz+XaAHa09MAgbq65HDCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671442, "uuid": "87aa35a4-05db-467a-8128-eb253eb3a6aa", "value": 147888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671442, "uuid": "297a2800-d7f3-4d70-ae69-cb743688f327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671442, "uuid": "71d1e6ac-e9e7-4791-8534-677aa614f970", "value": "systmed-login", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44737d6-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720350, "uuid": "decec2b3-2496-4df8-918e-4c56e543b05b", "comment": "Malware payload (Mirai)", "value": "a47aff0cf8ae0a54aceafe818a589cd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720350, "uuid": "6168b993-3e62-4186-9344-f0a0f0d8d9ba", "comment": "Malware payload (Mirai)", "value": "2dbcb1f89b1cf40138111aac45ad3f9273c4a8a92239bd83a30044c6dbb555b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720350, "uuid": "c11eac3f-f4b7-4d9c-b657-ebf2b6ebd215", "comment": "Malware payload (Mirai)", "value": "3fc67a1c52bf168e47d0d68226d3d22700e8e64e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720350, "uuid": "66c9e82f-cf7f-466f-8eb6-40b573fdf6de", "comment": "Malware payload (Mirai)", "value": "388e38e4a82ea2f293889eb9a148a92b086cf40b3929224fb02e65658db2111276f16ccc519b96023436c2d04f7d0ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720350, "uuid": "c1f039b1-e3a5-4093-ad04-12bd75a226b9", "value": "T1E4A2D11173A32D65E3ED1C3DC96A8317B9A71BFC90F6327569415620C90D34A3E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720350, "uuid": "2012a97f-5b36-4f23-b46e-64edf8565ca2", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjFhymdGUop5hW3:vvQn4j+ZO5fKAlxZs3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720350, "uuid": "67809c35-2016-47a6-9ae1-4f6889a0c672", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720350, "uuid": "ef55324b-aeda-4501-9200-19d0560fb239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720350, "uuid": "6c44462a-ca95-4b0f-839f-3bad68fdb483", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7564d8-2abd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774712791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712791, "uuid": "1f22ff04-e3e3-48e7-8e5d-0b083f91373a", "comment": "Malware payload (Mirai)", "value": "286d44869d42cef3206cfcc41f304889", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712791, "uuid": "00fb3965-b95b-42c4-8c9f-1c8e186e7d15", "comment": "Malware payload (Mirai)", "value": "2e341b0e5f4da4c0f0a54ce9b96b53007d914de7da70ae1c0d99c0cce4ca2755", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712791, "uuid": "0036bcfe-62e4-49be-b0ff-a8ab30ba490f", "comment": "Malware payload (Mirai)", "value": "0cc4d13802a234a5000a1cf98ea0d849b160bd6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712791, "uuid": "3707b690-e86e-484b-8c27-87b557668e72", "comment": "Malware payload (Mirai)", "value": "cbc0c4aaf8dae55122d67fb220890c2a98d0510d7d5675fab048e6d41fd658f290e02a860c64555f2bb8b40354788532", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712791, "uuid": "f9b2fa1f-9c67-4f9e-b88c-0a9bc7974660", "value": "T1BAA1E5E974B5936B2DB1ED7371D6CA42F14020A7E0C91C0AE6D2F0E9499CF61F484B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712791, "uuid": "a8d17adf-12e9-4d7a-90df-218375476864", "value": "96:v3m4dv4b64X+4TGEpn47w4Fz4jV4fq4j44tl4rh4jg4/eb:+6ZzmG4nPKs55A4Njb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774712791, "uuid": "69797bf3-dc09-4f85-b5cd-c9cb88a93ce8", "value": 4849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774712791, "uuid": "57dab022-5018-435e-b61a-16063bdcb225", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712791, "uuid": "895517eb-def0-4117-aac4-58765cbbe0ff", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce8d52d-2aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774732847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732847, "uuid": "c155adc3-5baf-478b-bfb0-6b653e3dd1e0", "comment": "Malware payload", "value": "b38fc4c86376a9f459e49b6a1ea9f5b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732847, "uuid": "4856a2da-eff5-4afe-91e8-7e79ed17302b", "comment": "Malware payload", "value": "2fd9a191840dd738087420df2e4008776ab672de6f2f459d1a63681c91229d7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732847, "uuid": "46634f9a-701a-45e7-912f-1a2cf888c23f", "comment": "Malware payload", "value": "01aeb37b54c4f3ba6bb1a9ad7fdf1ef996de7bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732847, "uuid": "736b67c8-0ec4-4b59-b11b-57929bb45ebe", "comment": "Malware payload", "value": "1cf9b6ceffe886128a0c9c66840fe8d470267c5fd560b229f12017099a7aaa7a6b7516904efe0a8e8acc84fab5f3e56d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732847, "uuid": "245ce724-acc1-4dec-9648-177d06fd417a", "value": "T1D7163A06BA042EA8C865483785F74E9137A27ED52F319743E748F6BF69B33024F15E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732847, "uuid": "b2f3b4e5-0547-4045-92ff-e16c31e33906", "value": "49152:mpIwWQgwyJjTEDHOsh1u5ElEmy3yUTYj1V:mpIwWQgwyJjT+HOsQEsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774732847, "uuid": "4769f365-d526-4037-bb0e-803554f464ad", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774732847, "uuid": "644a3b81-1013-4e82-8ca9-795884346e3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732847, "uuid": "709311eb-d96e-4c8d-89ea-4b8179a3aeda", "value": "linux_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08601e7b-2af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774737161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737161, "uuid": "8888dc3f-f91f-4748-90de-a5d483290c98", "comment": "Malware payload", "value": "ca881f8820d3afbc84c9f9d3d0ba4da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737161, "uuid": "6447b674-57b3-45bd-80f3-fb5e6f53dd48", "comment": "Malware payload", "value": "32ae6596f0b865eb056b1feae5b41cebf3e1b9f7809d9d9980ee16a0b2a88958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737161, "uuid": "21665240-cb0d-4b64-ba8f-5a5084c9dd73", "comment": "Malware payload", "value": "1bfecf98fde435ce1d840c35b1fae249d01cd189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737161, "uuid": "0484bddc-a374-4ab2-a11d-69e04d055843", "comment": "Malware payload", "value": "72be3179a7d0ebd5a37d33a92d9a20646ed0247e4d6eb610271e9de15cb93ef5d275afa6a068c4339e9228d608b7f849", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737161, "uuid": "97cf33c8-c72b-4911-90d2-35401bca541b", "value": "T13D161B5BB8914A82C0E4367ABC7E41C832A70EBD9B9B13576D05FE3C3ABE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737161, "uuid": "abade9e1-fb10-4e54-9a9a-deebe35dc237", "value": "24576:SIAdfHGb8kCLW5qLCYJktzMDIf760Vfnfsp48IzhAQCeTtvkE7CMwXdCLbqmXvfF:xecSL0TbHeIGyZ9m/gnAn9PUQZD11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774737161, "uuid": "df7d7ce3-88c8-41d9-ab12-4c87415881e8", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774737161, "uuid": "0512ac2e-8fbc-4521-a053-3a356f4350f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737161, "uuid": "080c7a09-ddf9-4bc5-b731-434df3690f8c", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bfc6a5-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729610, "uuid": "89aebd42-b51a-4f07-8f06-5373d9119642", "comment": "Malware payload", "value": "c032af6c473aa1b1da60a17863bcdae1", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729610, "uuid": "3a3286ee-ef42-4923-84c6-5ddf1eaec37a", "comment": "Malware payload", "value": "3324b61cefd951578ba35d5af3db926dc33df77e6997f5c515269e689d870e6e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729610, "uuid": "176fa526-c8f9-404a-a20a-78864c6d8b16", "comment": "Malware payload", "value": "dc81b3927969b07e307a4a11ec5b4af493b52b92", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729610, "uuid": "86f3017e-e470-4e54-b84e-934e36bbe8a1", "comment": "Malware payload", "value": "ae6f4d82454118ba0639ec1b50a3353b7395d6d14802fb49bd8a964fb975a913a1a2d02bb6003f7ec273ce3bcefc1969", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729610, "uuid": "003e6bdf-e6b8-4a53-af9a-6d31af9510d0", "value": "T1B7568D22F744ED38D0FA0132D27525708AE19C269779E1C37B8C7AD94BB27C259B724B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729610, "uuid": "3aa50219-5c89-4008-86f2-1e626fc31b61", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729610, "uuid": "0298711a-d3a6-4e5e-8022-89348dc4064d", "value": "98304:G0u51GxhiehH7MZcniem+RqGAGpD6JMvsEDUxg:G1PIUZ4Rq4vzUxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729610, "uuid": "98c28382-3a27-45b3-a32b-1439858cff46", "value": 6221312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729610, "uuid": "748cee8d-6e70-4d14-9ff0-af792e991d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729610, "uuid": "d6e02fd6-3271-44fa-a96c-2287bba147ac", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db184cf5-2af2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774735797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735797, "uuid": "7e49926b-c30f-460f-b9ce-3751c3d642cd", "comment": "Malware payload", "value": "f5f19ecf98c546ad5507760b7f6a8e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735797, "uuid": "fda2ae61-1b9d-4966-8a8f-82dc417bc509", "comment": "Malware payload", "value": "33ee5f8de63b859ac28649988a4515665eb48025fafc28541ec51951f7f6a84b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735797, "uuid": "29ac1965-5484-4a3c-bcce-bab0d282e9c4", "comment": "Malware payload", "value": "69299d58b9fae7150899fc2c76e87ef4aecca7c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735797, "uuid": "c7aef082-25c8-4b0e-ae3f-340d9e31435b", "comment": "Malware payload", "value": "0ab787eebaff56c4c1df087173fc923dc9956af656b30b9c18f9a3fcde8920ed46cedfc91dfbaf909a43b23566a88875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735797, "uuid": "3daa7018-4f3b-45cf-b515-ab8aa5dba5bf", "value": "T1F32619526E18E71EC62911345CB2CEA86B7E1C9A41D7A917B345F309B9B20BC0D6FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735797, "uuid": "2df5de42-faf1-4c18-be18-de0df5af44d9", "value": "49152:3e0GUe1v8hicBZ1raTK3J33N8a0NNTG3J3vB8uQ9UVWXQaFBgaN/OzCXIG3Qn1+M:3e0GT1mWaUjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774735797, "uuid": "58d3e0d6-ef18-434c-a2d8-620d3421d086", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774735797, "uuid": "08fc386e-4c66-4ae0-a785-d787551e2e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735797, "uuid": "3275b8a1-9bf5-440d-8ce2-7265fe2a4d19", "value": "linux_mips_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4597d0f-2a90-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1774693614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693614, "uuid": "0bbf7971-654b-42db-86be-838eb3af714d", "comment": "Malware payload (BlankGrabber)", "value": "093343a33794d62ceebda672dd695220", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693614, "uuid": "968cda9e-458d-4ea0-ba83-07ee8e6d2746", "comment": "Malware payload (BlankGrabber)", "value": "34dd9c513bc557feb6aa0a0d956f34517308b60a0e23dd406bca28e1a05de53d", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693614, "uuid": "9c0d1e26-33a6-4e8d-8e08-acc1d85af96e", "comment": "Malware payload (BlankGrabber)", "value": "f3bb47cead36abfa1a21a20cbb126ac211ec853c", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693614, "uuid": "5c15ac92-a74a-4145-9174-361e74b527d2", "comment": "Malware payload (BlankGrabber)", "value": "33c7d7792d48eeb0486b09ed6670a39cf31248f5141bd7ea8bc767526e46ed5b385a39c58e15601bef093d2617b1030f", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693614, "uuid": "722b7b94-4f6c-41c5-bb70-165cd86b3e9a", "value": "T11697220DBE90E805CDAA2D7BCFE255115771A4D1DF11C2471084AEFE6BA33B14AA263F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693614, "uuid": "a4b8bee3-6fba-4a74-8cde-09f9a3bf2875", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693614, "uuid": "e33e3a14-1a12-44d2-a49c-80fe48892ec3", "value": "196608:lm5uRro9Hjvj9fZwQRCgT0E7KEpPx1J/coy14ZAM9qxixnedcBtpD8cDndkP:lmqrkHTw8ZtJEoy14Z/wieCB40k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774693614, "uuid": "a0373996-5e43-405c-8407-6d132e8931dc", "value": 42991616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774693614, "uuid": "bd3c09b4-3010-4521-8404-d16710c9c7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693614, "uuid": "74a377c1-164a-416b-9894-67cb352a7656", "value": "RustCheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197997cd-2abe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774713138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713138, "uuid": "bcf02998-70e8-4cab-b974-d87057fc70a3", "comment": "Malware payload (Mirai)", "value": "b34138770ddec35af96df02f123a0712", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713138, "uuid": "f9604c0f-323a-4f18-be2e-368da7a2e648", "comment": "Malware payload (Mirai)", "value": "351e5de41242d19e1b065712e72fe9e420eebba0e7c25b721ad0ab11c119e555", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713138, "uuid": "44df3d2d-f394-4eb0-8d71-43d335bf6cdc", "comment": "Malware payload (Mirai)", "value": "90052a925aedc7209af9a8dd122135ac7d19f7e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713138, "uuid": "9a6489f2-234f-454a-8a58-9d222437f3b0", "comment": "Malware payload (Mirai)", "value": "1b7f36404186866fcd2e8fe512fd6a5744f31642201dd6ea3262bfedfbcabe9466c3c91d7b317166bbd3448302c3d6fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713138, "uuid": "3f80f7b5-5598-4c8d-8756-24c9a1c4d06f", "value": "T1FBD1E9B4F125D630D98FCAF61299BD1DA228B8C3D4E68E59FB7E15646C04FEC3C64902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713138, "uuid": "b952cf1e-86b1-4cb2-88b9-43f6183196f1", "value": "48:0UrFrf0rmqTBKotKzhqkMvaFf61vqEPBnhA+BIRMfd32uAeRmYxnMPGz0aT9OxyB:LdUxoTMepgrojQzh4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774713138, "uuid": "5fa61ab7-56c5-49a5-b762-c302be52a04e", "value": 6737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774713138, "uuid": "53967776-2765-4377-8771-0d254545394f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713138, "uuid": "1db97e74-360a-445f-965b-c0a4435dd4fb", "value": "update.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582b0efb-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774706801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706801, "uuid": "00142dbf-6459-44f3-b874-c6446123ea28", "comment": "Malware payload (Arsink)", "value": "4014095c97dc1d55f0e1f91044761838", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706801, "uuid": "9ae57345-90a3-4772-a6a9-56adc532ac9b", "comment": "Malware payload (Arsink)", "value": "35f06f91902faf5a4bc27c8b73f74b74aea6a6be2215ae1e990ee504ceb29e4f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706801, "uuid": "0cdce04e-c3ab-4f2d-87dd-fb567c1d32d2", "comment": "Malware payload (Arsink)", "value": "eb09b20cca940cce46a040ade10ebe9111cd22ea", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706801, "uuid": "205b331e-d10e-44e7-b4fa-12184b0f3bbb", "comment": "Malware payload (Arsink)", "value": "ec062547f607faedd31a2a8e52e1e9bf277dff6eecc41703b8347366e5ca3da1b2412fc326f28c482a5d315574a26263", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706801, "uuid": "8994b064-1b0d-41b5-860f-dc3147002fc8", "value": "T1EEC6128DFB44D92BC477903285AA5323518B4C06AE83D77769247A4C28FB9D48F0AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706801, "uuid": "004f3d51-836c-4f75-99c4-537594011f4f", "value": "196608:93U5/QYQUEyCZ7C8AsztWUtvjJCpXmf5STAGr2z/ifzQy2fd:9k5lnEprptBvj0i5TGrUi7j2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706801, "uuid": "f69e5c39-fb12-4568-8393-588dd2d23c40", "value": 11938031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706801, "uuid": "ea50434f-5cc2-4fa4-acf5-e388b44c3fcf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706801, "uuid": "adab534e-3173-481f-8509-c72882d24907", "value": "RM%20TOUR.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdbdb55-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729785, "uuid": "c1a0c42a-cebf-4ded-aa9b-2ed40ef1ab8a", "comment": "Malware payload", "value": "8fed5910932e7d293ab943677319756f", "object_relation": "md5", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729785, "uuid": "f3674b00-8c36-4c69-830e-151ef6f9a62c", "comment": "Malware payload", "value": "364bbf2b39496bd1ca814ca06ea0536ae5d00614fac24901b8395a8ae071c311", "object_relation": "sha256", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729785, "uuid": "997272e6-864d-42f2-942e-c758ba4ed75b", "comment": "Malware payload", "value": "eb2749b4c58d33520de8886fd6862c6f7b321290", "object_relation": "sha1", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729785, "uuid": "c8546e94-69c0-4d6a-989b-2c0f2292f9fd", "comment": "Malware payload", "value": "2b867c3fbc6f05a490d56183554f1735478e831490bf061dd2d3198d0b62711f9f0172d0d3b3fdb4e1c7eaf07f9e3d03", "object_relation": "sha3-384", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729785, "uuid": "cab21b0f-7152-47b0-8370-0b84be90f6dc", "value": "T1BC67336B9C35578FE47BE4B58BA4859A97A43E64AE624B21331973130C73FF0307A187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729785, "uuid": "96360129-90b2-4816-9be0-6307982f8ed5", "value": "786432:SjqUqYsqw4SJAVzRx3hC19dn77vg+Kj3MDuNwrybW:S1wtJAVD3hCPfoxjmukyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729785, "uuid": "52fcf772-c6c2-4688-84d9-126bde9fe7fb", "value": 29933568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729785, "uuid": "13895f2f-44e8-4b50-916a-b27f45aef071", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729785, "uuid": "4e408789-8e8d-494a-b761-522de9811f5c", "value": "Launch.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07612a7-2a70-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774679971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679971, "uuid": "ed3829c4-bc24-4e2e-ab58-c0600279ba83", "comment": "Malware payload (LummaStealer)", "value": "1fdeafe79b36f19294bbf7ae6e014c98", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679971, "uuid": "78f95f1f-e11e-4c1a-9412-1b763f483d71", "comment": "Malware payload (LummaStealer)", "value": "38044d9c236b3660267e35562af3bf5a45b93daddc49bd53089a49894c2cc96e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679971, "uuid": "48781892-34f8-4f30-addc-db40ee9dd1d5", "comment": "Malware payload (LummaStealer)", "value": "f4c2cac751a016d720866f0d627b8e33423add8a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679971, "uuid": "cce778d1-298f-4193-98bf-405e7d2280c3", "comment": "Malware payload (LummaStealer)", "value": "ee028f5f08256f011dc7df3ec9e53d2a50b7d4c897dad492ecda1fec811938d29bd2102dd39c5cf2881d31deca35e9a1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679971, "uuid": "c5d28c69-73b4-429f-b0a4-eb62f2d2aabd", "value": "T1C3854A40FDC798F6E506563659AB23AF2734AC090F329B87EB483679FA772D10D26305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679971, "uuid": "f2f2e043-b7da-474a-a039-0c75d90250da", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679971, "uuid": "3bbdfc1c-fce6-4733-803b-d00347c50fae", "value": "24576:0AK5l7K9vHig/LZ28QJYK8mjimG44zJ2vTZzWdu/6aW+8UTFuCd2KsHDPpr6TuZl:0zPCe/jMcu68Up4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774679971, "uuid": "8426474f-5b75-4422-9016-b19ca0fdbefd", "value": 1851392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774679971, "uuid": "19c5599d-2125-47c1-b03e-e10badac5dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679971, "uuid": "66838f26-86ec-4696-9965-adc61565c829", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598abde6-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686617, "uuid": "6b23f241-6b9e-43a8-9d24-803b8e9e5dcd", "comment": "Malware payload (BPFDoor)", "value": "b3c6933a67317277f371a5ab531eaa90", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686617, "uuid": "078f7e92-e776-450b-a409-3ec8675c5f46", "comment": "Malware payload (BPFDoor)", "value": "3b071d36ffa393a8891832590304b21ee9017b4977a747917e6c6116596851da", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686617, "uuid": "34470bfd-4572-4f32-b1f5-85c38025d819", "comment": "Malware payload (BPFDoor)", "value": "be60939d2156990b0bd1e4c9cff1e92a0bd42c8e", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686617, "uuid": "5863cb4f-faef-4764-9486-f840b810c740", "comment": "Malware payload (BPFDoor)", "value": "8c3ee679ccd01ade3242867a84c82e908e0f356424377036a0a667a1564f90babad1c89652e290746b0a34059c00d540", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686617, "uuid": "29b2c07b-bd5e-45d2-b42c-b3faa32dec68", "value": "T146545C49B6AB28FDC987CC314A2761736DB0746962126D3F3486DE30AD16F701E6DB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686617, "uuid": "c12e5df0-5a42-4b7a-9757-b37045eaa2e0", "value": "6144:OTymc6T9PC5Q1EmSblD58nWpoksIbAkXSlU9dfArs1u5:aNTdb1EmSR58nWpxsoAkilif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686617, "uuid": "0c2c8127-80d7-4d67-8ee7-4cdbd4d40422", "value": 302576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686617, "uuid": "5c72222b-c24a-4cc3-a02a-22f516b83bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686617, "uuid": "9caf71f7-6010-4cba-aaf4-9bd9e9c1b332", "value": "3b071d36ffa393a8891832590304b21ee9017b4977a747917e6c6116596851da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386f0540-2a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774671958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671958, "uuid": "a5ddb629-ef31-4ba1-bf16-b992d374f034", "comment": "Malware payload (Mirai)", "value": "4030754a063163e637de1ad64bac4f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671958, "uuid": "5b235f73-c061-4002-8985-8aa9d1415953", "comment": "Malware payload (Mirai)", "value": "3ccb5b82017530f77d89d8d5892b452b20e872831386d5f247e53722faef2fd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671958, "uuid": "6b7f1051-2cb0-4301-83a2-d622d7c9a0ab", "comment": "Malware payload (Mirai)", "value": "5817747accd72a9ee007af1efe547e289f9e6bb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671958, "uuid": "9f241f1c-b2d7-4d03-844d-0e4b58d92e35", "comment": "Malware payload (Mirai)", "value": "f456c04bb77ec89c8b2d8eb7290310672894f4ef739e39bd24b0b0f764dc90e2efccbfbf51fd7e4799704738c63ca061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671958, "uuid": "b6ae2ec7-e1ae-4b9f-9afa-18a601c094fd", "value": "T152D31945F8909F23C6C6127BFF4E428D7B2A17A8D3EA72039D156F21378B45B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671958, "uuid": "430bcba4-d70e-4578-8c77-c934f2c4b52b", "value": "1536:RmFhF10ooYxOOS8rzsJeqdYjqtC4ekndlpX4VrM7HAdz8/OsRbD5NHCPuilRTwyH:RyoYx4gqeqejuC4ekt4SEdz8/VxEhOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671958, "uuid": "1d5dc6c1-c570-4635-a7c4-1af71b610a4e", "value": 133932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671958, "uuid": "c74630a2-f5e2-4144-9789-e063be19e2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671958, "uuid": "6ab42fbb-fd39-485d-8af1-c6881d9873d3", "value": "avahi-deamon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a3f348-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686610, "uuid": "d9972b4a-23a4-48bf-8d2b-4831baea24d6", "comment": "Malware payload (BPFDoor)", "value": "e9ecd3bff84e0be13f8cfb8401e6005e", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686610, "uuid": "13409866-af08-409e-8a06-c7bdbb516276", "comment": "Malware payload (BPFDoor)", "value": "3e01a4bd73b3567f59bd80c7349e3b7ce85c15a6d94016ddfcd0bf3f239684dc", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686610, "uuid": "5af9e18a-991d-401a-ab42-36b2f9d7ed85", "comment": "Malware payload (BPFDoor)", "value": "4d72da65c09e09730f2fad3063d21189f333a740", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686610, "uuid": "273d2094-6934-4e54-a9cf-5a58c3d2a522", "comment": "Malware payload (BPFDoor)", "value": "c5090e1b1b785ddfe12be9252df5114dc65217495ac96725370c88a06baabf8f7f794156982122576a4c73f0c3afd4cc", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686610, "uuid": "bef01dee-5cc7-4869-8060-be087f7446e7", "value": "T1E1546C49B6AB28FDC987CC314A2761736DB0746962126D3F3486DE30AD16F701E6DB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686610, "uuid": "27e5b5b3-c2d7-4f8d-b927-7fda8aa57d44", "value": "6144:tDykouG5MenxkzPoqaDc8BWxaIUQk6Mmcb439dfArs1u5:FHzbOx0PoqIc8BWxTUD6MR4bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686610, "uuid": "c21d8d5e-f12b-4b39-9cba-560f78b00622", "value": 302576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686610, "uuid": "597e5858-af38-4c8d-9238-17213202d96b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686610, "uuid": "c3956e65-8f03-4c9c-8f53-4fc81a06818d", "value": "3e01a4bd73b3567f59bd80c7349e3b7ce85c15a6d94016ddfcd0bf3f239684dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8969554-2a57-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774669247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669247, "uuid": "f5f79986-436d-461c-9555-0e71878775b7", "comment": "Malware payload (Mirai)", "value": "5c2150787a430ff1fb1e2519d1c02524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669247, "uuid": "2257d94f-b3a1-4873-bc7d-6ce251d318c2", "comment": "Malware payload (Mirai)", "value": "3f5d3158ed532e7911b79f160d32532b3621b968b9f9eb84ed7c718a43619fd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669247, "uuid": "6bc7f8e2-4a88-44c2-b223-70015faf81f3", "comment": "Malware payload (Mirai)", "value": "d26d0f5bf0718169f8fd6667b64da7291f13355c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669247, "uuid": "8fa876b4-d94e-4736-aa10-28169735058b", "comment": "Malware payload (Mirai)", "value": "d345f2a70300cf368cece8f7b1b4f0d8e255af04fb0ec03e55b8b8d5c2770ecb6bf8ad1a7a511681f658b529de949804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669247, "uuid": "4ecdf079-1c45-4039-be5d-145b318feb1b", "value": "T10804D60AAF910EBBD8AFDE3306EA0A0234CDA45722A53B757674D528F54E50F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669247, "uuid": "2d5e6344-9404-46f5-9c21-b8ac644763d5", "value": "1536:ZwBr0VuiN5UP+B4qRHSsR5AQ1x73Skfvz+ml/3nndBWfMBUui0SAxPgBfh1Y0kg+:ZCr0N5UParRlaml/tBRBrxIlhSZfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774669247, "uuid": "44c67842-2815-46c2-ad0c-720e959fbe2f", "value": 182020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774669247, "uuid": "edc8c189-d3d4-4a69-9386-0bf40391771d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669247, "uuid": "08b86994-8961-41c9-a104-b157780fca83", "value": "miniiupnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8a7897-2a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774688853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774688853, "uuid": "55119fcf-a2d7-4ad6-9705-c4823ce5bf4b", "comment": "Malware payload", "value": "ae1fb3ab35cf0b0f472dc897d46e9245", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774688853, "uuid": "3eca3cc1-43f4-4ed8-84a1-f8e87a9cf4ec", "comment": "Malware payload", "value": "3fa31b352e9e07665a3a12fb4aaa3c69eb7ce7119c9db352e43e44e8b1ebfcf0", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774688853, "uuid": "8f7f90bf-5f3a-4287-8711-ffc0a8f40e70", "comment": "Malware payload", "value": "a8a63c55be54f5e15b8aedf55a018ee0bc402e89", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774688853, "uuid": "09638d2b-55fb-4313-892e-81803ae14d6b", "comment": "Malware payload", "value": "46708625d1435e5edbad4e1b6be8cb32e1bc607da2f4dd238b4a5b17b9c3101f17c272f0e2d4e9279340a7df9c71b696", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774688853, "uuid": "f69bf67a-efe9-4c71-987c-104d568b9a81", "value": "T1C5D3FDC8999A88B48B1F746C561F9C178A9DE273022DD890BEDEAF543F11AB131BD4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774688853, "uuid": "4530a20c-bc43-4747-aa30-e180dadcf5ec", "value": "3072:skdRSH+KOWZi7vJCc1tWMoPXFexp/JiSsNnWHFsjTOnHXlkln5S56ARd7OqUWbnp:s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774688853, "uuid": "ad81d3f8-dd7c-44fa-be3c-5cf74742f5da", "value": 131681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774688853, "uuid": "0efae5af-4047-4104-904e-3586cb31406a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774688853, "uuid": "f2b45e62-6977-4861-aa0d-b92f78c7ff90", "value": "Beta_Record_Winter_4879.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f287745-2a43-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774660534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774660534, "uuid": "dcae0054-5271-428b-a55b-c2e1e52ba351", "comment": "Malware payload (ValleyRAT)", "value": "67bccded34ea9ddc8d8a9b5e7dfb7d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774660534, "uuid": "d1bb4283-d184-404e-a842-c7c9fe295c0d", "comment": "Malware payload (ValleyRAT)", "value": "40750c5d1422a9d4c4161cbe0a2d8f32fc5537265665961002f96f8290c29116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774660534, "uuid": "4fd05fda-b07d-4c79-a1ac-672b47bf2f5b", "comment": "Malware payload (ValleyRAT)", "value": "6982070e1b31162afdb6bfea3e91ac7ff00aebed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774660534, "uuid": "87025080-3783-4cf2-93de-a89b0a5d1dbb", "comment": "Malware payload (ValleyRAT)", "value": "4fe0e91dba8800bb358bb6132de6455f057697c98050b2f6d287594f3fc816e1f32b909649497fc642c997dc7824c736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774660534, "uuid": "709c1dae-84ff-4f96-bf26-5df0a359f172", "value": "T16BD52382A8C34EF4C8C6C3B48981E3BCF13E7FB54664884BA7D85D4B7C456171F69A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774660534, "uuid": "028bcc10-b0f8-4fb1-91c2-e74081d3109e", "value": "b5947d75970d0b71f221990673c9b5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774660534, "uuid": "406bee6c-38b0-40cc-b855-41e52c24e62a", "value": "49152:oozXiJTdQ/8a+/zeQKGyDQv4lEwH5OvXyJ7Jq8j55x8KjCHku9o1JOQl+3qt8glF:lDkTs8a+rRKrRH5OvXEFplrFjYFm1E1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774660534, "uuid": "4102c1fe-13c7-4dc7-86ac-ef73b5729dec", "value": 2998272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774660534, "uuid": "bbb86e3b-4521-44b3-82fc-c4b903610c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774660534, "uuid": "0db8b023-f160-4a99-a29e-41652c5ce481", "value": "40750c5d1422a9d4c4161cbe0a2d8f32fc55372656659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525175c7-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681880, "uuid": "0f3cafdc-c00f-4f11-907b-a4d210ed4edc", "comment": "Malware payload (Mirai)", "value": "282e8abbf1c01d292fe1c862989594d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681880, "uuid": "8142ba46-cea2-4e30-967f-c0d57f4db27c", "comment": "Malware payload (Mirai)", "value": "43b395eaf6d796cec36c1c3999939022a705f91597c403ecf31b1adb0ec80cf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681880, "uuid": "4cf926ee-32a3-471c-8623-31f310ce7ffe", "comment": "Malware payload (Mirai)", "value": "da142efd187dea78fa9c8fb77b7d99999e8a4b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681880, "uuid": "2a69ec1e-f6e3-4c24-b32b-c312bd11193d", "comment": "Malware payload (Mirai)", "value": "4cff47a1f6f7611237ebbfd470abee285e6697796eaabc0d4fad2f25ce7349faf5036bf22e73cc1cf80048d16018a129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681880, "uuid": "ee61da4f-6b56-4602-9d88-c5ca483ad6ff", "value": "T17A634A43B84580FDC268D57457BF793AC47234BE1238B2E637D8BE122D06E601E2F59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681880, "uuid": "c1975ad6-34c2-49be-84fe-4e3b737b7a29", "value": "1536:c+la3fdTbA+aB7zlaHE6qe+eWTVdXhkJ3tSxSDyJ4H+0eiK:cUavNbA+0Zak6qe+eWTjiGSDyl0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681880, "uuid": "4142693b-4a30-417c-860d-0cf045794b87", "value": 71648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681880, "uuid": "feb570ad-4533-43bf-947a-9cfc26180093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681880, "uuid": "b9ffb39f-8532-4c13-be64-f8b5270b4ab8", "value": "db0fa4b8db0333367e9bda3ab68b8042.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07460409-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720409, "uuid": "33d7e5c4-75e6-49dc-8b47-938986cc3d48", "comment": "Malware payload (Mirai)", "value": "708a4093e69f43fdf63dd888f488cb80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720409, "uuid": "a8134ede-879f-4a42-a45e-d22cc6721829", "comment": "Malware payload (Mirai)", "value": "443aa1ab4f93fa4b316351b4a10d06e67b9ab2b23bb845f7cd6e83be80ff6458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720409, "uuid": "97c9685a-8deb-4a51-bd18-3e9a20ca6445", "comment": "Malware payload (Mirai)", "value": "4175526fad80104a1e9607cc87a96bb2e9834c10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720409, "uuid": "17dc09b0-0ccf-41aa-a435-3f5dd94c7bc9", "comment": "Malware payload (Mirai)", "value": "108531951bc394048e1cb07e3e9a2c10c44d17adc9238b888faa2cef1a2663360ab7c96002dfd7e6fd4b1511507006c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720409, "uuid": "1f8688eb-4dd9-49bf-ba8c-b14f48a3fac1", "value": "T17E63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720409, "uuid": "4a7bcca7-4c09-4f91-8f66-fde815dd61b6", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAz:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz4L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720409, "uuid": "db74648a-7bd0-4e40-99b5-3643b4ea53e9", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720409, "uuid": "e629569c-494a-4d8a-ad97-f2ad7572e281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720409, "uuid": "d2517aea-0cc8-4c86-a9a6-f7d7d103ca8a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9185bc8b-2ae5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774730090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730090, "uuid": "1fdff114-12d4-4046-aa48-6ad56f7b2463", "comment": "Malware payload", "value": "71f1a5c242b64ce1fe67d58c7846bf59", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7037", "colour": "#F44E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730090, "uuid": "fd7d8360-4bf9-41ba-b812-c03a2fd27bdf", "comment": "Malware payload", "value": "44488ceecafcb1b247e111647f7fc02c9fbeb1a362972eee4c7e553d99d77215", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7037", "colour": "#F44E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730090, "uuid": "72fdbda0-5752-4a9e-857f-d8381c246893", "comment": "Malware payload", "value": "ea858e925cc65a7a83ba778837e43afdb6bfd374", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7037", "colour": "#F44E41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730090, "uuid": "be37dcc3-de77-407c-b843-3ffa4202dea2", "comment": "Malware payload", "value": "555e8c6a2be810f74ed897ea98ba938f5aefdd403ffb0ddfe6dfa77d0c85d55fe78ea4b16569000c3ece126d764fc2ee", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7037", "colour": "#F44E41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730090, "uuid": "9c9525f5-a22d-4b5b-88c5-272a3c002371", "value": "T160E53333F5085231DDE2B57BC5322680061B6FF63D2D7A94BC2EAE340A8825789D365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730090, "uuid": "0a794809-d5e8-4b69-93b0-82113c4da61d", "value": "49152:MS8I2pfDzU/uHC3r+W0HoeBp4MFhiqvCbKnyII6BWHc5snEaTftBrpg0D708r48+:ZCrzUuC3rUpGqvdyII6AVnHVX9r96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730090, "uuid": "85710df7-34c0-457d-84f4-ccb704f33744", "value": 3302035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730090, "uuid": "a47a5424-f1c7-4848-a2ce-245c26cbebb3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730090, "uuid": "78ac723e-247c-438a-9eb2-7fb1a7446078", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcc8daa-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (MuckStealer)", "timestamp": 1774656559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656559, "uuid": "1934555e-c6e1-4306-9eb4-287f77913daa", "comment": "Malware payload (MuckStealer)", "value": "70d71b5b13b6104dc4a9426486a69634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656559, "uuid": "b63c44d1-b9fa-4dc7-a454-9d1f5a6e2922", "comment": "Malware payload (MuckStealer)", "value": "449a0cfe1a555621fdbd94579bb1b1c3cfe1afdf2cd6fd64154ef388d09d8a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656559, "uuid": "aebd2c35-2207-4328-9425-3e1deb5fb6e7", "comment": "Malware payload (MuckStealer)", "value": "bea870f576e7c6908dec7e49657458d3f1ffc651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656559, "uuid": "f7fc04db-18c6-4eac-b594-1b8509fdd859", "comment": "Malware payload (MuckStealer)", "value": "a232b2dc5f1accbd80fd16848f7b250ba7afeee7172321f59840be212d6a238f3f6834e36eb860ec83870531cf6588b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656559, "uuid": "5fdf54ff-f884-43aa-a9ed-15143eb0f401", "value": "T191B63390A5900BFAD4F7A17EC8499654BA73B4364768CA8F07B043262F67FB1693DF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656559, "uuid": "92d24816-75bd-4225-bb01-d943c3771a37", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656559, "uuid": "6f822dd8-a512-4540-9886-7f0a700da7ec", "value": "196608:XY2pN7iDBiDfyGlW21X5Sp6GemDMPwQRA+PMWIEB/uHVrN6SZ3iPj:XY2pN7iiDfDllpfaMPFR5n/uOSZy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656559, "uuid": "730b4f5c-5acd-44e7-8483-3b4024946f7f", "value": 10465639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656559, "uuid": "9ee7fe29-0950-4f2e-bc1a-3da4abf29345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656559, "uuid": "5fe60834-28a4-41fd-8e50-661abeaee412", "value": "70d71b5b13b6104dc4a9426486a69634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c004d3f9-2a90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774693661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693661, "uuid": "0d3cdf54-1d74-4dde-9566-c7b4524d0d07", "comment": "Malware payload", "value": "d0f9bcc531924ab206b7d39b4f5e5cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693661, "uuid": "acdf3be1-0269-4292-9e0e-ea135cbe481b", "comment": "Malware payload", "value": "44b6aceca9302e75538237faf85946c7833c28e290de8941e50c72e6310e043a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693661, "uuid": "7541d184-77fb-4100-b741-8f3a39f07592", "comment": "Malware payload", "value": "d77d9035f7572402b428c275cce64149f6616507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693661, "uuid": "c2bc429c-e42a-422f-8eba-c92524112897", "comment": "Malware payload", "value": "7e0b3852220611f492446d959fe2f9e8b3fdcca4db5b8d879937b90c4985f37df5a7203c3854f7502158d03a38d10f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693661, "uuid": "894f71ff-8b29-4db3-8f91-2d6a91bc45c2", "value": "T1FCF7BE15E3E84716E52FC2BDC563C113D6B1B8971712D7CF0414EA992F63BD2AB3A222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693661, "uuid": "5cbb229d-4f4c-49d7-ad82-cbd719d0f1a2", "value": "b5d3ce44460b794187f3e238adc502a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693661, "uuid": "f3182a59-75b0-4ec5-b56f-cfbb2f7165a2", "value": "393216:446Mb5vrfwR48vaVWacyWaceWac+WacpWaceWac305FBdkUlGwd/qj0lc2lhbG83:LmRXqFNXQjdlqQLlUqtWmVvJpXFUSI01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774693661, "uuid": "64b1f808-ac8a-495f-8ee2-83cb5bd9193b", "value": 76020352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774693661, "uuid": "e54fcb70-82a2-4750-b4db-84d38833146a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693661, "uuid": "869f341b-1e70-453d-b9e2-6e0716d63e60", "value": "Reader_en_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2081365a-2ab4-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774708855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708855, "uuid": "70288800-5d3e-42f1-914f-a0ea0ac3f457", "comment": "Malware payload (SalatStealer)", "value": "dc5ea79b555c404871dfd9470179e575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708855, "uuid": "f608c0f6-f5c7-407a-9b02-65017f13b5e2", "comment": "Malware payload (SalatStealer)", "value": "450b62982ec35d56dae9c80c1a0a14ca19ed3c7b8af7d7b4096ccd5b1285a971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708855, "uuid": "e78ed71c-0a81-4557-a228-0dfa75f13bf7", "comment": "Malware payload (SalatStealer)", "value": "4801742b89cfab23cb6d4dd89172392e34b97a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708855, "uuid": "28845ab3-cafa-46fe-bd74-e7eeb982e4d6", "comment": "Malware payload (SalatStealer)", "value": "8e80bcffad4b5d947065fc8e157b93aea95ff8f4a858dd25d78a4d1e156698626643955a87561faac6f892061418241d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708855, "uuid": "1c177ba1-5ec0-4056-b546-da6eedb489f8", "value": "T15AD65C11FACB54F5E903583140ABB27F23355D048B38CBDBEB183B6AF87B6A11966705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708855, "uuid": "46e4d20a-fe4d-47bb-87c8-66e68ab06dc1", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708855, "uuid": "9f4afb44-32c9-4ad6-8301-18f48020009e", "value": "98304:EcnIiZ6JHtwUXioDufleDwVCSts44+G2IfDEpC:J68UBDmdVCys4eopC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774708855, "uuid": "da4cc4d1-018d-4f50-951f-d57fa65eb307", "value": 13177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774708855, "uuid": "86ea8753-1bf7-4d86-9d2f-64ae37d76b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708855, "uuid": "c4d3c69d-e0af-440c-8931-5429b4d11e54", "value": "450b62982ec35d56dae9c80c1a0a14ca19ed3c7b8af7d7b4096ccd5b1285a971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cb88d1-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720346, "uuid": "026b9eaa-ff49-4900-8665-72e08bf356f0", "comment": "Malware payload (Mirai)", "value": "43c5c0acc26599838037641e1a12b108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720346, "uuid": "33ac0f5a-7cf7-48e5-9c9a-ce90f80680c0", "comment": "Malware payload (Mirai)", "value": "465498b8092ec0ee9a9d3e4ab9147b4a6542c36d9df65920f15e27a03950758c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720346, "uuid": "b3dc1d93-8222-4f0a-bd70-17a99ff42454", "comment": "Malware payload (Mirai)", "value": "7e338b20d1e554779214dd84380878c4305868e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720346, "uuid": "0af96b04-552e-4a41-897a-a2c7a85dd7d1", "comment": "Malware payload (Mirai)", "value": "f4ead1809cfa72a34c08d7ebdc08c385c73cdda1cc437467cc1a0887de1d20520a82e4b29f565672321322378ac45022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720346, "uuid": "9869ce95-2a5f-47dc-ac65-2317b3a817f8", "value": "T19582CF30619B75E9DBE10430FEAD8EC2A71A0BB8D1FC36D317596B78894650650F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720346, "uuid": "8edc6c94-6e4c-4310-81ac-07cacb54fa3a", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMazwhymdGUop5h5lK:2dV0P6+kom0tVAoNvm+to1cs3UoznlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720346, "uuid": "204fd5e6-ee27-4004-88b6-37236bfcf0f6", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720346, "uuid": "b0b3d97c-6d55-4517-9024-85ba025a80b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720346, "uuid": "2822e4e5-adf8-4393-aafa-df14ce5092c6", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02449f99-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729420, "uuid": "b02d8a9a-ca0b-4375-8be0-181a716b5f41", "comment": "Malware payload", "value": "bf7ba859c58de1a2934c8f664700b4d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729420, "uuid": "9997e353-aeb9-4aa6-88dc-01905ee444f5", "comment": "Malware payload", "value": "46cf3f0ac6db7ad4518a2471d04ab34c4e2a710b023b4f3a38e408153caf0882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729420, "uuid": "d27aa01c-165a-453a-994f-917416436732", "comment": "Malware payload", "value": "1bc896f6932128ece65dcda7b9968a60900b4d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729420, "uuid": "f16777c1-fda4-4c32-b7f8-a2dc78c5feff", "comment": "Malware payload", "value": "187fc850d781917da1a35c514b98a98dc8dab7013278d818393c4159150183910bf4a392f326bf8931569eabef2b810f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729420, "uuid": "137fe8f4-a28c-4765-b615-9b5f46bbb9ad", "value": "T1CF17332495CFC6C0F6449AF18B479B9F16123F96C0E1AB773181FB0C653E626077DAA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729420, "uuid": "fdf76437-da5e-44e6-8451-20638fd1bf00", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729420, "uuid": "025fd624-4bf5-4eef-88d9-25c3ff82caec", "value": "393216:s1tsH23WtEXdvrPappy640Md0v/VHo0/y3qDBn482SxOux5yUdOi:sMwWtYzipvLfVHRMmnpDOuxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729420, "uuid": "c0048d16-03d8-4d9a-8c69-30a5048a6506", "value": 19884032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729420, "uuid": "7b46f204-e50d-4d6b-8fd0-835ab8ede2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729420, "uuid": "8e161757-6ac8-4e92-8b0c-5982d843f5cf", "value": "Installer_v1200_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b54bfa9-2abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774711826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711826, "uuid": "a8a22e4a-b524-4563-b89e-06f469b069bd", "comment": "Malware payload (Mirai)", "value": "1aef0624bce2eb6bb5d6014a240d2058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711826, "uuid": "10166ade-9170-462c-a857-fb1d1f51770f", "comment": "Malware payload (Mirai)", "value": "498548828d3d715aacb7900edaebaca3e7efd18bec6d19bed6db1a39962139f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711826, "uuid": "4d371f44-63c9-4428-94f9-d78a0c520bd8", "comment": "Malware payload (Mirai)", "value": "f4cf0f0ca044c3ebf400271636348f40fddf4f4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711826, "uuid": "3bd6a7ac-00e1-4823-b98c-0e8946a9ecae", "comment": "Malware payload (Mirai)", "value": "999a10cbc165ca847d8969e8debe58ee18be21270e6ab7525b3b1375acabc6daa6175ec45d18f56a247c960c435917ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711826, "uuid": "3386b072-d392-47bb-ad8f-f27272906f9f", "value": "T138F3865D2E228F7EFAB8873447B74E25975923DA22E1D684D1ECC1101F2025E685FBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711826, "uuid": "144a92de-0162-40a4-90bd-e0dc1295b5a3", "value": "3072:lxEGLRZSsyyQ8SE2jzjJz2bq0Rrhp21fdgYY05b:rNLRosyyQ8SBjJIxLpkd9Y01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774711826, "uuid": "73798f09-c663-4033-817f-a09c44f79071", "value": 169340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774711826, "uuid": "4b2fdfc4-02a2-424d-b9fa-cb0daa3d2e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711826, "uuid": "1f1a8757-2451-4949-8207-741fac7d4478", "value": "upnnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d56d8f8-2aa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774701521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774701521, "uuid": "7becf418-0af2-4ae6-b417-b31cf0a8c239", "comment": "Malware payload (Vidar)", "value": "f4be53ce059774cbe43b1f78a41f3e28", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774701521, "uuid": "593494dc-d65a-421a-8f02-c195f73d3ba2", "comment": "Malware payload (Vidar)", "value": "4a1b4250bf2910202f2ad0c446999df30aaf6d35eb502b971339e605f374c0e9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774701521, "uuid": "581b2afc-1425-4455-977b-6aad8f2f7737", "comment": "Malware payload (Vidar)", "value": "1ba5baae1434d6ffa3dcc6b0570fa290b63e2aed", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774701521, "uuid": "8ff447df-644e-457b-8759-a0c3f8800404", "comment": "Malware payload (Vidar)", "value": "2b6bd8789f5d328c4fcef70b1b220a98d4bdc47bc66249aa688afbb3ad7316e5b23be7482a27e2529aa239fc3c17451a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774701521, "uuid": "ec1f2d94-2081-42c4-a500-d99c7068275d", "value": "T109957C4A7CE104FAD06A63328DB662917B71F8490F3223D72E50B6393FB66E45D39748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774701521, "uuid": "e62035aa-2046-4be1-9db8-7d8500e3bbeb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774701521, "uuid": "673a29c6-4f52-4d3b-84c2-0a0dffc1a93e", "value": "24576:L+j69OSkFCESuUuHb2ek+5byuJ++soAb0ZwiP5G3AGpA4nhele5nK23TdGKyv:L+m9rkF4uUurk+5TsaKS4AGphdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774701521, "uuid": "b86ddf75-f817-4944-bcad-50574262601e", "value": 1917632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774701521, "uuid": "2201df20-c02c-412f-82ae-508399ed6358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774701521, "uuid": "45a3d1af-22f9-40ed-85a8-59d527799883", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1b1920-2ab7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774710482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710482, "uuid": "0206ead8-1aab-4085-bb35-3646d0c3d7da", "comment": "Malware payload (Mirai)", "value": "b766622602e234bcb29eb35a924b4d6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710482, "uuid": "f233aed1-3ded-469a-94d7-bfe219745e1c", "comment": "Malware payload (Mirai)", "value": "4a6bc9610e4d6e5cf23089e93c20888d7632f23d03114b41ee0ca3155eccfe46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710482, "uuid": "d90c4132-702e-414b-8fec-23a280a3c0a4", "comment": "Malware payload (Mirai)", "value": "2efd828881eb70d9a4ab92b69be3a587d87c931b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710482, "uuid": "2862d598-7275-496e-bdcb-498e83502d0d", "comment": "Malware payload (Mirai)", "value": "c4003041706ed1450493c4a32291f25bddaf225719dcd399d2ddb12e8d756d7a9a90892883d2ef18e126d386ae506fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710482, "uuid": "f5c3b42b-a6b6-4f9b-af49-cecd07c00ba0", "value": "T1F8C33A05730C0983E2673EF43B3F27E193DFDA8121A4EA41255FAA8D91B2D32558ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710482, "uuid": "3d8c8d43-5ee3-4ccd-b72d-c31dddef77a7", "value": "1536:g29lN19kt1YC3bbzxSpHr5C1CHV6r9f2oLDsvApbvITiyBqUM89Imp5:g218tNbbzxqHrbC9VLdpebp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774710482, "uuid": "8525d697-5dff-4882-96f5-da7b029c2792", "value": 127080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774710482, "uuid": "b386b996-2bd8-408e-b25a-a25a920bded6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710482, "uuid": "9d1876f8-6b3f-4e30-acc4-51273d3f6cb4", "value": "cronn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8a7fdd-2a72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774680585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680585, "uuid": "e57e1257-906a-4fb3-a023-62a9f9ebf7b1", "comment": "Malware payload (Mirai)", "value": "cb68d6d19449c9da7258b6619b2bbc3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680585, "uuid": "3b58ae03-f40c-4bab-81ea-80eb6a70d5ab", "comment": "Malware payload (Mirai)", "value": "4b23b6964eeb064df15b198d30b2ebd98d712677ee835674fe1d69268a9a614b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680585, "uuid": "3ce59546-d5ef-48c8-a960-c4165a9312cd", "comment": "Malware payload (Mirai)", "value": "df292dceacdf0fe047b076be2a72b65855890936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680585, "uuid": "e0c2168e-2362-46be-902e-ac3a05119f84", "comment": "Malware payload (Mirai)", "value": "4069677f10a8ec7e25cc9b550e84e257e5c0a530aa80a863af37e33e48db5e68829dd16c0e4390e5c35fb1a09b135a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680585, "uuid": "30862729-f768-462c-928f-48dff96e97c9", "value": "T1CFA31906A9829F11C5D631BAFB9E718933137FBCE3E97101D9209F5423C69DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680585, "uuid": "cbe61f28-547b-4f06-b5d6-a2965cbdaf79", "value": "3072:esiJSj+WfHbR54Jx2a+yT3MZaQDdkn52IdsuB5H:5iExHbon2a+yT3MZaGdY2aso5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774680585, "uuid": "c2de93d8-a027-4aa8-bc80-6b7a4e5d2579", "value": 104204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774680585, "uuid": "a73d1ec2-4ef8-4504-93b6-cb84342f0015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680585, "uuid": "53d98cef-3185-4f08-92d3-82e305ac0d7e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e4525e-2ae6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774730661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730661, "uuid": "c7b87070-4515-4859-9be0-5b1a959d63fc", "comment": "Malware payload", "value": "2f51d2b06c0e492bc170af267de62bc7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730661, "uuid": "5aa95ab6-07ca-4d91-bbf5-4f1bac9a863d", "comment": "Malware payload", "value": "4e5092887e409cdabb39533303c6a3dec7cda5e88224536d72d1b92df7100266", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730661, "uuid": "8e3cfd0a-2ccc-4aea-ab8d-894482578b23", "comment": "Malware payload", "value": "23a2271b6b449eec242494a020fa59ae5219da69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730661, "uuid": "331f9e1c-e820-48af-af43-48b39fdc3097", "comment": "Malware payload", "value": "688fbd17d81a05c386a70c266b3174268b2669eb5a2bfd626407bde9d9b93c0b9d267276f6483a01e01fb36ba0002dd2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730661, "uuid": "2f0d707c-c1ff-4657-a6a0-e9655ac3ebf2", "value": "T16603F22C39AC667D19517F1284E7BFE5B9056DC4D36A0834E81281C66DC6BC399E831F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730661, "uuid": "61f0c53b-ac43-47b7-ac38-1f49e5c9563e", "value": "768:InLP3BvwL198Fiv4gTK/Yov2frvW3gXcH8ZBwSykWRKXxdY/Q2dux4OR1o0:QP3Jw19ugW/YoirFQ8ZCNRAxuPa1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730661, "uuid": "2aac2600-920f-41d9-a4c0-69c915ba456f", "value": 39950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730661, "uuid": "48842514-201f-458d-8cd2-40b4d2ce9b23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730661, "uuid": "ffb5ff84-904c-40c4-9596-792ff53da194", "value": "577a330a_libcyn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7a4043-2a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774692309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774692309, "uuid": "be564316-564d-49c7-97d4-aae99e780dca", "comment": "Malware payload (Mirai)", "value": "2b4421fe0f519d51c1fdcbc9dc333104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774692309, "uuid": "4a288817-b4f1-4e47-8d82-eff3962afd8c", "comment": "Malware payload (Mirai)", "value": "4e6103d7e55a12da438662b28b5dff5b74cfbf79390ea8d61de8335a2cee2ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774692309, "uuid": "a054f060-6fee-4d65-a412-943ca4da0e7c", "comment": "Malware payload (Mirai)", "value": "484f50d92eb75d13811db1c36a49426cfa696e53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774692309, "uuid": "5f0dbaec-e013-428e-b7ee-cf77c74ee426", "comment": "Malware payload (Mirai)", "value": "57581852b20715a139bcc80498cb885d5d42dde00cb47dcaa153ac5b371a0a32335f8aedbddc133faaeeae037c4fc226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774692309, "uuid": "43b373ac-e06a-4ae8-95aa-c99c6a8c3f48", "value": "T1BA342A55BD415F22D6D126BEFBBE81CA332327FCE3DE7112EE045B11368A84A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774692309, "uuid": "b1b5101e-2575-4964-a4a3-00ab0a847ecf", "value": "6144:k33F52KxH9ObW+7/+LZmp/MbXV25DvqpAgdZ9qP1g7asF/ckyC4dGSKDwyP1qZ8:Y/xPA/f/Mh25DvqpAgdZAPG7au/ckyCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774692309, "uuid": "d10ef1df-03e2-4275-a8d6-a47018e3f8ed", "value": 232684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774692309, "uuid": "fce6f519-8f00-43aa-8227-10ecb61f1aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774692309, "uuid": "1be78c55-c326-4918-94aa-07a81a8efaee", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b82f951-2ac4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774715853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715853, "uuid": "08169aa1-a167-47ed-bfd2-1eeff3572f7b", "comment": "Malware payload", "value": "fee356a4d6cb5faf97bffcded7e5fc55", "object_relation": "md5", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715853, "uuid": "e9c474fe-8f2e-4ca5-a1ab-a85b8be25b67", "comment": "Malware payload", "value": "4fb05dbbbebf15f85032dbc0d74164aa736fcef7cfe4293ff4605860b5fe44e3", "object_relation": "sha256", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715853, "uuid": "342f318b-0877-4d64-97b2-56a36f924a34", "comment": "Malware payload", "value": "cb74e0bc56021f7e868bc4dc9e63ebd76791f19c", "object_relation": "sha1", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715853, "uuid": "50801e28-2141-4d40-8461-08c32d5b5d8b", "comment": "Malware payload", "value": "a364bb4e779a60221ecf527f0a3288adea597e84878fad03f90e4efa2b9df079d59c09f35f210fb9e246e013d9403c6b", "object_relation": "sha3-384", "Tag": [ { "name": "181-224-24-177", "colour": "#34E1A7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715853, "uuid": "9ec685c7-2d48-4db6-9955-52bad6da4c9b", "value": "T1C7A55ADD762072EFC857D462DEA82D68FB5074BB831B4213902715ADEA4D897CF280F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715853, "uuid": "d0563bdb-5090-4b01-b9b8-ffd8ac12db2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715853, "uuid": "8d8a8ab6-847a-48c6-a499-e89f98cabe83", "value": "49152:p74cOLVZQ9kK5syk0/w1JG2xAhWCRhUpn6phd/:psZLV29R5syk0/GJGn+pnyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774715853, "uuid": "1b302563-95f4-4274-b884-2f8e6b5e2b7a", "value": 2256384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774715853, "uuid": "a60786a5-859f-4105-9855-f7fdcc4c15d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715853, "uuid": "9b3b43b1-c5f7-44e6-917f-7f91f359a25c", "value": "4fb05dbbbebf15f85032dbc0d74164aa736fcef7cfe4293ff4605860b5fe44e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33aedce-2a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774667440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667440, "uuid": "358fd8c2-8435-40fe-be24-b954ca8d75ad", "comment": "Malware payload (Mirai)", "value": "904ddabd6ef4e0fa91ad30cc08f2d9a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667440, "uuid": "a439ec31-191d-4213-9aee-1737a60858a4", "comment": "Malware payload (Mirai)", "value": "4fd68bfa5d618e88bf408891c662fdf9031bfeb08158d52e45371a2baa480676", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667440, "uuid": "5d114682-473c-45dc-a741-2990d068fd60", "comment": "Malware payload (Mirai)", "value": "a62a63492b365b74b78bbbb2e4603760e8f5218d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667440, "uuid": "d3b08539-8c37-4473-bbe9-7ad45348b55c", "comment": "Malware payload (Mirai)", "value": "e9a494b9ba134530a9849df5b1e38b025937840516c4971f1b39b64af69db56a7facd6114b9980d92c49dea75c556e35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667440, "uuid": "1e660892-e054-4453-bc4e-5bdb3a32b449", "value": "T1BD142946EB404B13C09727B9FA9F43053323DB5897EB73069928AFB43B8779A4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667440, "uuid": "7f5f0773-ee23-4d44-96e3-5ff15c151a87", "value": "6144:y7cPmWlaE2caCHoJSuFdmMtYKaTx4gV/G1+:ywPraE2caCHoJSuy21A/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774667440, "uuid": "86315304-9144-4a77-aecd-aa3f0d8a4197", "value": 204069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774667440, "uuid": "8a1994b9-0aa3-46bf-b72e-e3123a7cda54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667440, "uuid": "2f866e50-5c68-4479-a953-67d5fd730578", "value": "net-workd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5a84ff-2a57-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774669044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669044, "uuid": "f16225b4-d496-44d0-b7f7-de0d6c5865a5", "comment": "Malware payload (Mirai)", "value": "3a7c12bc512f86a5081f8786c6cf5ce4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669044, "uuid": "87a597f5-c492-4ec8-87a7-17102a33ae9e", "comment": "Malware payload (Mirai)", "value": "51a952ccc8b1f190aa07d262f48baa6b0ec96386a1e462094767c83686c41739", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669044, "uuid": "94bfa13e-466d-4c7b-a8b3-d51cea71e37f", "comment": "Malware payload (Mirai)", "value": "b4e48638755b8f1afbef66428227bab6f4f14e89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669044, "uuid": "bb61126c-5d54-42f1-9bd7-2756d39ee2a9", "comment": "Malware payload (Mirai)", "value": "48b306533f61ef15a06fc1b22325f5e4a81a158623d517dce80dfb38c46ea596706f85c66e59178d8fca2a851ffefe3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669044, "uuid": "81b81f4d-b54b-494b-aaa6-f623c42753d3", "value": "T1D7A1C2EA74B5937A3DA0ED7371D6CA42F14020A7E4C91C0EE6D2F0E8499CF61F484B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669044, "uuid": "31407eb8-2fb2-475c-a48f-d5848c972dce", "value": "48:vpK8KMV4kUnpKDK1V4gnpKrOKrWV41npKQKoV43npKE0KEEV4EbnpKUKkV47npK1:v30dTbYXMTGEpr7qF3j1fIjytFrxja/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774669044, "uuid": "6f2b4307-f5f9-40c5-ad7d-dc91aec33686", "value": 4849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774669044, "uuid": "65263691-2a96-46ad-ab39-5fe5d1e58bc9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669044, "uuid": "a7c58d7e-861c-4582-a43c-f9752e4ca189", "value": "goahead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb155fe5-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720362, "uuid": "cd07909f-b034-4cc4-989d-e18ae14d5cc1", "comment": "Malware payload (Mirai)", "value": "544993177e452644c8cc76fe97795c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720362, "uuid": "c1282f84-3869-4178-8d8e-33524efd9b58", "comment": "Malware payload (Mirai)", "value": "51ce0607e266317785f1f7abb0f0684d62a2e41cb292f9dd760cfe73ceabb754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720362, "uuid": "361d355d-44b7-4b8a-9f39-939c50c3f5a7", "comment": "Malware payload (Mirai)", "value": "4ff99f66c19bbc9132e71fe57506279066776cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720362, "uuid": "a6972dd5-1687-4f4f-b0df-04a6d0c8b936", "comment": "Malware payload (Mirai)", "value": "c5d45825067557ea3b13ad258caba252947fe990fff738262bcf4f62b974efdbdc08f8f1ac6b388af563bc5cb573352f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720362, "uuid": "8783b2d0-d0fe-40a3-8587-951abe7eedf3", "value": "T1E2C2D0A0B726FE31C4206C3DE62A4D8A3A51067C91FF353764258D358FC1A9B67E48A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720362, "uuid": "0bdd7677-8be2-4af5-af1c-c2f8ca29d6fb", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrkyp59q3UELu5:PKy4qfqoeJdXWgkypsLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720362, "uuid": "5dad2ede-ffc4-47c0-8d8a-338ac867075f", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720362, "uuid": "d255ee8c-17b3-4eba-b64c-58fab7a66ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720362, "uuid": "74b27099-3c44-49f3-8db4-025a42393758", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10955fee-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720425, "uuid": "20d896f9-177c-4ea2-b154-8963e4e4ddd1", "comment": "Malware payload (Mirai)", "value": "fd906326a810a71e9e1d2fc4ce0378d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720425, "uuid": "ffdda754-9551-48e3-8473-d8fc592f5fe7", "comment": "Malware payload (Mirai)", "value": "51d722c0fd975fee851bd1cb10666d54c55d4dfd6561979c94b2179a0048e927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720425, "uuid": "d783c950-56ca-40e8-b49a-c334c1d50f23", "comment": "Malware payload (Mirai)", "value": "18e4c84d46ea61ae534a2810287c60122e5c82f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720425, "uuid": "422c9864-dac7-452c-9654-4eff5c1f616b", "comment": "Malware payload (Mirai)", "value": "ad422e388fb7d02865ac74e3fb05c91aa79226f5909d52280fd4a6aea51c96d128239814db2977a05b0d421873b69335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720425, "uuid": "bce7563a-a21c-4a77-b936-02fcb03a06ca", "value": "T1F02309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720425, "uuid": "31de09de-d665-4ff8-a7bf-4ee3b19292a9", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2i5e:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720425, "uuid": "0e2c286a-ca34-4c19-a89f-d52ee70d0b46", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720425, "uuid": "62e16e8d-372d-4fdf-b1e9-101a5a6d86b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720425, "uuid": "d08c1d7f-6a30-4f72-b4b3-432ecc0d70b4", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0f1e8a-2afe-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774740976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774740976, "uuid": "22bbf512-1947-4a12-ab65-30f5d40b3c7b", "comment": "Malware payload (QuasarRAT)", "value": "cdec97a451c316f62cbf71938ade5deb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774740976, "uuid": "3542f786-4cea-4ed9-b5f4-7eb2c29fa41e", "comment": "Malware payload (QuasarRAT)", "value": "52ba679694fa019918e32b699fa4f23a30221802a982bc61204072d69f5d9648", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774740976, "uuid": "2d22ad79-9578-4cca-8876-bdae95f2b7b8", "comment": "Malware payload (QuasarRAT)", "value": "fe1fd5c212d32fa149049bbc8078175dfa6ae038", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774740976, "uuid": "ae673a23-93bb-4407-8359-88e9f708f966", "comment": "Malware payload (QuasarRAT)", "value": "950995e58e5b56342a92f8473955d73160c579a3ff4a6d817943c127806bda5653d30f0b32aa949a2eaa60d8559347c8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774740976, "uuid": "1d53d89c-7bf8-4ff9-9320-53923ce34b10", "value": "T175066C1837F85E32E16F9F76ECB2001267F5F82AF363DB4B1641AA791C12B1059423A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774740976, "uuid": "c72a06a4-c565-4c13-b2f1-1d804623ab6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774740976, "uuid": "9e6137c0-1b8f-4fc5-a17b-09bfcd33d3a5", "value": "49152:6WM0H3xHeweSsyJ5n7p+gVuqHIVj0KNAQH1CQdt2bQG+ITr5QgdhXMPwccohgHHf:6XYRKNAQsQdt6QG+03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774740976, "uuid": "4bcdc6e4-9002-4f0b-b095-4377b840d52c", "value": 3789824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774740976, "uuid": "883c9b74-7fcb-4e2a-96d0-a32fb0d8ded5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774740976, "uuid": "371d85b5-dcf8-4187-ba4e-3c7bd1c3e77f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702099a1-2aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774732611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732611, "uuid": "7b4c6ec3-1252-47e4-bf39-09084c28c2a1", "comment": "Malware payload", "value": "5e4dcb2d86c3747f8ecf0a20c45a6ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732611, "uuid": "72b9742e-b5f4-40e1-845f-5916e0ec86a7", "comment": "Malware payload", "value": "54bb89310955e2f6a0edd88b820af7c82dc8ca1da359c0a6c41001ff0c685da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732611, "uuid": "0d22813e-c90e-4fe1-90da-7932c9e8d9c9", "comment": "Malware payload", "value": "47beb1b9c3ae75790fbe29c63232ea79c063e83a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732611, "uuid": "64209bc5-3e63-462a-b72c-f0ba96e39a8c", "comment": "Malware payload", "value": "42fac4b52a2bf83eda7e1ac6c3bbf887b6b270abfcc89a9dbfff75caba3ce4ee16dcf26127ca0e4fd90c585c1f31f318", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732611, "uuid": "16e9ee07-77a0-4eba-a576-35b939f3d028", "value": "T1DD161857B8914682C0E4367ABCBE81C432A70FBD9B9A135B6D05FE383BBE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732611, "uuid": "e973160a-8422-4e6e-bd26-a466e6293909", "value": "49152:qhZGX0VR2cie1wqdlFb4t8lCuYMfZz11:qhZGX0v2vivdlFlsuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774732611, "uuid": "a26aa1c0-b410-43e7-8eeb-b15360a57db5", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774732611, "uuid": "b180958c-a12e-4f84-b977-7d893765acce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732611, "uuid": "062f9e28-3e5b-424b-89e9-fe0247142141", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb9e2b9-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729577, "uuid": "1fb9a497-25fd-4ed2-b983-c0dfcf647728", "comment": "Malware payload", "value": "8c5470e80889a124e00da918f8001b85", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729577, "uuid": "dd9c51f5-70d3-451d-af1c-03090a5af45a", "comment": "Malware payload", "value": "54e725463523f36c19f9d3cf14cd374b094fcaf59a2a9dab8044ccf69637575b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729577, "uuid": "cc4a5f90-8bf3-40de-be6d-e6313078f165", "comment": "Malware payload", "value": "24d4232999e636551dbfd8c1d81b68ded154749c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729577, "uuid": "3555e74e-68e0-42b3-a5a2-52164923f095", "comment": "Malware payload", "value": "c510db95828a233aa827771583db2eddb45518b259a0ce73bfe68d28064c03e93e290a12de4f52633230b88a1abbc6e9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729577, "uuid": "609a9649-1772-421d-b905-5fd2e5a85017", "value": "T16717338CE86122B85AFD8BBB84753E6746C6D69BE2BC8A6DC43D0C1750E3751137324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729577, "uuid": "83102b89-7119-4a58-844f-61899e4fe144", "value": "393216:y/KHNGe7OCGooCKDo0TfD9dr9KqxBLGYtAo/XHWTWE35wpZOWGnFx:lH7Ol5ogr9rLGYtAo/2TWCnNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729577, "uuid": "0331cc75-78af-4858-9bc7-5b964a77de2c", "value": 20297517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729577, "uuid": "3655aa9c-6c23-44ac-9099-28ec63fe0aff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729577, "uuid": "5a6478e3-0914-4de2-bfff-6fafaca2a811", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f60802-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681863, "uuid": "85c04092-6369-4d67-89e3-e6e9cbf3edce", "comment": "Malware payload (Mirai)", "value": "a65d521be5d56edf673dc232b4747b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681863, "uuid": "80ea4cd7-5152-4f64-9b05-3cc7362193d1", "comment": "Malware payload (Mirai)", "value": "55db943ff242b32de9dc9fa31473a4b849ca92dcee182a2d8265053f4bd67c74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681863, "uuid": "08c88db0-7d8c-4df7-9731-02177f2fd868", "comment": "Malware payload (Mirai)", "value": "32c28e0be31f0a32c1d8d681c351135173ea1dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681863, "uuid": "b0c5793d-e40f-4543-8df7-9ffa1bee6de4", "comment": "Malware payload (Mirai)", "value": "00e834f412c3b572c56a84bd2dac01f8a26c414909bd6d733e91594b551f4eed1f252129aed73ca1609c6f8d39846323", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681863, "uuid": "9f7c2435-85fb-4fcd-892d-bf778ec1bdcc", "value": "T178736A21B87A2F27C0D0B43A62F78725B2E1270E29A8C75D7D760F4EFF2569065435B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681863, "uuid": "1cca50f6-5feb-49c9-9f5b-702ca63771cb", "value": "1536:zv9jASMFAhg8eHBginMOObc+hu4NU9asxAOs:pVLeHzIcl447i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681863, "uuid": "deffe9df-2c39-49ce-8354-fe705be41171", "value": 75240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681863, "uuid": "c4eab35f-e775-4900-9bb8-bfbe00eb625b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681863, "uuid": "5b29a5e9-8a98-43e7-8e1b-bfe23ae2bd86", "value": "db0fa4b8db0333367e9bda3ab68b8042.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d394830e-2ae9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774731919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731919, "uuid": "be52bd75-968c-4be6-b2e6-1856d0d020c7", "comment": "Malware payload", "value": "28df63eac6eb2b9fb1d3768a8303e1cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731919, "uuid": "d1e4648e-69bc-41f3-b635-14962992bf40", "comment": "Malware payload", "value": "5a132624a5b57a97629678aa95d4475e587ea154c17c0f35708b12eba030c367", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731919, "uuid": "4c27b671-2e9f-4644-b0dd-16aa25f3387d", "comment": "Malware payload", "value": "2fdf82f2465364ae0bed45168b8e94cfad8ad9cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731919, "uuid": "d4bd67db-0047-418e-9414-d6d277f32d58", "comment": "Malware payload", "value": "0360922546b6a8b636b1cc429e2b599e259c1556c2e513218ef4a7bfab659ce2d0a621a8063a063dbb4c4724061621ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731919, "uuid": "04e217a6-1fcb-436a-9933-124dcaa4b511", "value": "T1C9160850FECB44F6D9031D7054ABA22F27316D094B28EBC7EA64BF56E9776921C3620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731919, "uuid": "cb5b9223-2902-4734-91dd-5c7e581b8389", "value": "49152:v98CKaXPmgRdjhxnf3IuAjwh0XAW/6lzdWKUI1w5RTKJtU0Sk8KUfPPPwPPP3PPp:v9Bugvf3RABB4w5RTKMMnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774731919, "uuid": "1d458bd0-e3a2-47f9-9857-86190c6c5aa9", "value": 4313088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774731919, "uuid": "613ab536-d047-43e8-9f8d-35e92a0857c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731919, "uuid": "b09b0acd-7b6a-4e45-9492-893471b61293", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9f1381-2aa8-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774703800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703800, "uuid": "60e6dc75-0912-4d5d-b13f-6844c6d4f406", "comment": "Malware payload (RustyStealer)", "value": "ec11e0050ad0cedf219559814846f908", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703800, "uuid": "94e68ead-2049-4999-863f-7cb4ce0ecef5", "comment": "Malware payload (RustyStealer)", "value": "5c9968630ccf18caa0c9ed9834a5d83f14d7482aecc3cdbe43fa1ed42f2217e2", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703800, "uuid": "65029bf9-346f-4a3e-a344-ec870db25511", "comment": "Malware payload (RustyStealer)", "value": "e6683fc9bd682b9be2958d32881688085b7a6be5", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703800, "uuid": "2c9c4fa2-fdd7-44d7-a09e-b0f3c78e6aa1", "comment": "Malware payload (RustyStealer)", "value": "6c7015ae69a5123edb7c9adaca561e9586e2982d52b3e94a8bdaef6b1fe7f789407b15245ae12980a33caed5d5fea0fa", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703800, "uuid": "6b5de01f-cc64-4c39-88ab-91b660e3eec6", "value": "T10676BFF97254B8A39D2B017BC7126DE5439636A2CBD3B8DA4078A1D20F63776FE1580C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703800, "uuid": "f4816e7d-3f43-4ad9-b33d-4893eaa460b3", "value": "c5dc6f9985722f9679c8ad94fccdc263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703800, "uuid": "c80c7a47-c1e5-4092-a76c-484d82eaefab", "value": "24576:tbsWL2CNiYfxW3l0b0vv3/4OjcHLPilaj9lijMD1bIwCkR/llF6SmcvenlkuAe2B:uWxNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774703800, "uuid": "c6e6259f-5ec8-468f-a6e7-9e4eac51ef6e", "value": 7188525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774703800, "uuid": "bde30336-9e20-421c-8bec-7fc6dd54527f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703800, "uuid": "43e0f67c-6c59-4085-901f-7b15a5287fc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef268efc-2af3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774736260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736260, "uuid": "010927f7-44f1-48e9-a490-6bb97372bbc4", "comment": "Malware payload", "value": "54ceff00f975cebe1762599755b0d275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736260, "uuid": "b1dae64b-45b5-421b-9c64-254194c5cac5", "comment": "Malware payload", "value": "5cf06e1b31733c256a72dce55a4ff2050aa9d08b080f70198a87cb2e7bdf7f28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736260, "uuid": "5b3ac87a-badd-4129-93ce-c5ac4793989f", "comment": "Malware payload", "value": "411f22884550d4a7ecf819086edf2395847f468f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736260, "uuid": "750b182f-6ee8-4acc-b863-198b097fe15e", "comment": "Malware payload", "value": "99da0ecb91017aa8c98b09d93067a0658f9d39065c7cf4c38f475cb09be17b52806557ac216071885b47d9af7edbc038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774736260, "uuid": "1457b10d-d906-465d-afeb-7b6a87267bd8", "value": "T1B526D909BCC42BBAC02C5F7441FA8E5663746D044AF55A2B62A4FBD8B8762747F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774736260, "uuid": "17889682-36b7-4e7d-8337-43d5d64e4463", "value": "24576:31pe1eCfcR4/PySm4ddhqE1II6WWptTRGqYUIMRkY07/fXB65j1PACID:G1e7H+cI6nIUrRkY07/vk5j11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774736260, "uuid": "d75f8d03-6663-4962-a595-f4b8701c0e43", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774736260, "uuid": "d64b12d8-9142-4556-8106-a56bef9829ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774736260, "uuid": "c594c739-09d5-41df-b8bd-30b49677e4dd", "value": "linux_mipsel_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc8b677-2aa6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774703002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703002, "uuid": "69226543-0126-4cfc-810e-91c47f4d9325", "comment": "Malware payload", "value": "5521e6ca0f2113eae5a9068cb345e681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703002, "uuid": "50bfa8b9-8e38-428e-a492-0a7e2aea2edb", "comment": "Malware payload", "value": "5da2be983f9fc6a618f46646fe969aae18acee5eb1262197df1b98459a17b0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703002, "uuid": "b24a5b37-1d64-4918-8eb5-f95501a4615b", "comment": "Malware payload", "value": "8ca1b38356c8b4392324178dd73c2fe7e78476d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703002, "uuid": "557ec4e5-a77d-46c8-b58d-71adeb4ed591", "comment": "Malware payload", "value": "ee325222958c885d601b12868bb784426d65a77d28686c267285e9f2f47d0ee6c1729a32b33da7851337ac310f4cd156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703002, "uuid": "472bdf11-ca81-461b-930d-eeca8c829419", "value": "T185B50657B8914843C4E53A37ACBE81C433665EB99B8A532B6D05FE3C3EBE1D90A35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703002, "uuid": "82e42fa2-e491-4ce6-b924-3cbf93fcd0f2", "value": "24576:ch7bJZd2eU3wl/k2Xf/BoJm10NBIGa9MIzGEROlP2j3dKiBkOPB+GYDIFddFjwP0:jWs+gxSZelbTb2051b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774703002, "uuid": "d4142208-d949-42db-9014-8838463bc7f8", "value": 2359444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774703002, "uuid": "1ba0b813-db1f-446b-b1c9-7afc6553ee57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703002, "uuid": "b7290e12-6c09-43c8-8edd-12009f32f3a6", "value": "kek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d325351c-2a5b-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774670929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670929, "uuid": "e5d8a9c2-f2d8-4bb6-a2d3-9e4aa9d025c6", "comment": "Malware payload (CountLoader)", "value": "98cad0e05fcee1eea05ebd9fffcf990c", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670929, "uuid": "63a89e70-9199-487b-940d-2590af8cc16a", "comment": "Malware payload (CountLoader)", "value": "5e13963e99e2a0d4f508eaf4c5dcf364c426426a657d0f9c2eabe7706653d18a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670929, "uuid": "46a67f7d-3523-41e1-ba7f-8ec4668f8cd6", "comment": "Malware payload (CountLoader)", "value": "c2795361e1ea287f7351e27f06e6c8007740f534", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670929, "uuid": "d9bdc5ca-a73b-46a4-9270-a403f3275e1d", "comment": "Malware payload (CountLoader)", "value": "fa4d3c08dc15e042ff51e472aba2ee936a321b9b951a33c431211fbc44458ce5700bec04d7a53fa4487ae210b80a3d8f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774670929, "uuid": "6d9128ab-dc09-414f-946e-9ca8d1687db7", "value": "T121D300C859DEC8E48B1F2568469F5C168ACDE127061DC9D0BADEEF883F115B072BE5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774670929, "uuid": "a3ca1468-dd34-4394-9192-9b8a92d398cd", "value": "768:/azSSwaQmYTi4Te88w+KQEDD7roTOmxBo8vqMr/O9qcOwdaOEqNUOPu0Xd3m/SKm:voeDYEPymx3BFvjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774670929, "uuid": "bc4e2e4d-fe46-47d4-84eb-107cdeccb3dd", "value": 131910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774670929, "uuid": "4bac88ab-d3bd-4c50-bb12-fbcc0dd5a414", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774670929, "uuid": "90daaa8a-9b51-4400-83ef-f6b885764f59", "value": "Family_Notes_Clean_4667.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1391faf7-2a86-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774689076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774689076, "uuid": "e5130d93-120b-4077-82ac-29f659d5ad1b", "comment": "Malware payload (Mirai)", "value": "13556e47713462c69a3233a778141c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774689076, "uuid": "8039c800-a18c-4bf7-b59c-f87834100f4c", "comment": "Malware payload (Mirai)", "value": "6197e9e1e04d76a21a2a3c2f44585bd11e385fb6b00be31cf8f840daf9539564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774689076, "uuid": "475899d6-b73d-4bc7-b275-b88fdc624f41", "comment": "Malware payload (Mirai)", "value": "fb02088167a7191183900e2e9a67033829042891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774689076, "uuid": "24ae0458-a1d1-4692-85a3-776fe09cc51d", "comment": "Malware payload (Mirai)", "value": "ba7cf51c96dd88f49514de4626fc577e9dae020775072958df376603ec6f1037e3316d1cb51436eb8c10ae7ac4e6c12e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774689076, "uuid": "d746a262-a163-451b-a9c1-27bb119e398d", "value": "T184C43959A8419791D1D02BBBFF1D934873131B38E3EFB1069D196B246BABC1B0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774689076, "uuid": "d060eb1e-60fd-4139-b9fb-8f0cd273b824", "value": "12288:5T5WGh21cHCGbPVEJK2RCCYiZwymm2o80+wb1ahqlNwf/aTWshW:5T5WdcHC16CYiN78A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774689076, "uuid": "2ac53855-3434-4df6-85fc-9060c3444c7b", "value": 548100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774689076, "uuid": "845103e2-0de2-4f1f-a6df-de7839321b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774689076, "uuid": "d43be11c-38a5-433e-99b1-b337c5c6e8b4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae37ec79-2af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774737439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737439, "uuid": "9425a74d-eecf-40d7-a415-608071695f03", "comment": "Malware payload", "value": "b9558c7e6865e2da08601e9bce798a33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737439, "uuid": "1756664b-6562-4b5e-aac4-fdca62af699d", "comment": "Malware payload", "value": "6211f5146d6911a4e50ccef8a9ace273dcc71d1bf6861ac89dfb8a45e21db870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737439, "uuid": "4ac5dbe1-50dd-4b3b-a84a-3b57c7f92bbf", "comment": "Malware payload", "value": "d05b41b821559003cd15aab3fec3fb5876105188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737439, "uuid": "db1ef25a-8453-4391-af78-611684ea806d", "comment": "Malware payload", "value": "96b851d9fe536b00baba567080142830d3f2da0d04df2d4a1f6bcb809b57e76c1f430e4712fd750e5f327a681c8110a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737439, "uuid": "e51e5667-914b-4165-a38a-5099d6c4110d", "value": "T13D262A177E28E71FC22911345C72CEA86B791C8A45DAA917B355F309B8B10BC496FCF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737439, "uuid": "65732aae-b14d-4a6f-93ed-23cc027f0238", "value": "49152:KvFRlPfZQLXLZYbzitttTN5G7eHjtVFcTx16DmHjVVF/JJeKDDGeTVgg7Dbh+/lR:MFRU1dOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774737439, "uuid": "71e43769-7afd-4655-b759-2e376e70467b", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774737439, "uuid": "7c27d7f2-a424-4690-a98e-6e192cb57197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737439, "uuid": "3854cbab-513e-4a89-8e9a-d3d5c52247bd", "value": "linux_mips_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ba88f6-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720356, "uuid": "45eacbf3-1519-4f08-b4ea-d24bafe59cfe", "comment": "Malware payload (Mirai)", "value": "4f1b5fae28549b60751a054821e4895b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720356, "uuid": "b3e4a8a8-2308-4bfa-a9a9-e8f547be5054", "comment": "Malware payload (Mirai)", "value": "641cc049c4334ae16cf39ba0830781485779902b423c64fa8399375a01499b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720356, "uuid": "2253d305-cc3d-4b9e-9dcf-ec0a979ab72f", "comment": "Malware payload (Mirai)", "value": "cca221139ee8313a7ab5295c5eec62afeaeca95b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720356, "uuid": "b218b345-137f-42c2-975f-88983b3c5d95", "comment": "Malware payload (Mirai)", "value": "19e19fd5fbeb366e9cb2113c98a7cb9f4279e9aed442e853d907fab40fef56fd203888572ae7bef063d09a1c1c861b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720356, "uuid": "39f35856-7254-4259-b1cc-f55fe10fc8e5", "value": "T178A2E17DFB20C18CF086847E2957127B456FF8A64B98420EAE15D0C701C79DED49AEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720356, "uuid": "e4176401-e580-4aef-8c6a-3d5f8372be95", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRx9+cr:TDZ5Dw7RjFjcU+O24sDS4HhrhpEguX3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720356, "uuid": "bdb8d5b1-844e-4657-87c5-a6902e6603dd", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720356, "uuid": "068afcf8-d501-4f1d-bade-ff85cff602b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720356, "uuid": "b075a5f2-52ce-4a09-a6ba-3917d73912c4", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f30d430-2a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774665688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774665688, "uuid": "ebe4a6c0-fa2e-478c-ab4e-80549f32a3fb", "comment": "Malware payload (Mirai)", "value": "8225c426e4983140c269b761682fd2b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774665688, "uuid": "f9dea9ea-97a1-42fe-83a0-0ca4d3f2ce43", "comment": "Malware payload (Mirai)", "value": "65b09ed2146a6c5f55cf42432dca34281771ab93f6596e87f858c55952fa332e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774665688, "uuid": "bd77972c-e5ad-4345-8007-deba0d815044", "comment": "Malware payload (Mirai)", "value": "ea2c3c261a719f8086627583a38d5cf3e27b3e1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774665688, "uuid": "d015e82e-84e5-4654-a898-09240ba38856", "comment": "Malware payload (Mirai)", "value": "c58c5d33f4cd811254de751509ebf790b7a091ac08e8f04c281927a95467d6a57f1a1ec1554acc9759f65b097d35076d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774665688, "uuid": "9ebe6afc-1b25-4cad-a9a8-64f6ff7f42ef", "value": "T148A1E7E974B5937B2DB0ED7371D6CA42F18060A7E0C91D0AE6D1F0E8498CFA1F484B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774665688, "uuid": "bf71f071-9d92-4f2a-9f66-153cf655ae70", "value": "48:vpK8KMV4kIpKDK1V4cpKrOKrWV4TpKQKoV45pKE0KEEV4ElpKUKkV4FpKDK1V4c2:v3md9biXuTGEpl7QF5j7fyjItrrvjg/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774665688, "uuid": "9eac2fd2-2894-410a-aa24-4a6b725520ed", "value": 4821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774665688, "uuid": "3f7803bc-ecd1-4ce1-8dee-21f7d1d14ccf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774665688, "uuid": "db42fb44-cad5-44dc-ae5b-633d39cd3e7b", "value": "pulse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb322c4d-2aac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774705678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705678, "uuid": "c6b94350-cbab-4e14-8398-a2b28a2be090", "comment": "Malware payload", "value": "aa62fccb02efdc7345711f72d6641a5f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705678, "uuid": "e2914101-9fd7-47cf-81b0-310d100ab95d", "comment": "Malware payload", "value": "67e1ae614f21cbfe2352d02dd5fc41245bbf4441440c6ee14de40807e185b203", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705678, "uuid": "75ffe23f-0ae4-4f2e-974d-6b15e91c6986", "comment": "Malware payload", "value": "c629833b1256a5fff81479a7d2bf19fa7d0a8c79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705678, "uuid": "981d7f80-56d2-4698-808e-4ae0996cf54b", "comment": "Malware payload", "value": "450b190c898b1ae5452826f81a8ac3e79051bb585d8f32b61b016925b3d992bcc2d478a1877c2022105ab0d7c704cb04", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705678, "uuid": "53319bd5-d939-44ab-812d-bea3704e6fcc", "value": "T16C416B4E4F46D0E1628024FC674F3D86B88705EF91158104F79EBB8BAFB4711E2889D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705678, "uuid": "2129fe6f-cfcc-4663-b791-c16634739afc", "value": "48:aFRfBvNuufHMzQKFGXx3wSTEYLHvHpO8OSI4QiY2Xx30XWB:wRZvNuufM+EXZWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774705678, "uuid": "334a3854-8892-468b-9c84-8935d2968ae4", "value": 2018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774705678, "uuid": "85ae7821-6a0b-45ce-aeac-c0156fe092b0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705678, "uuid": "d066d24c-e298-4d8e-aeec-73a4e68e166d", "value": "cccc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e04b96-2ac5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774716508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774716508, "uuid": "71aefb80-6e86-40e9-a918-25533fe055db", "comment": "Malware payload", "value": "dd9e0904128f8944bf83d2827ee6ddcc", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774716508, "uuid": "4c266365-9bf4-44c5-bb84-50d0def14eef", "comment": "Malware payload", "value": "699717b325ade9e59966b50e403224494771f64578a4de7bcdbe156ac01bb41c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774716508, "uuid": "787efb45-0eb8-4d93-914d-2a4c485ac8e0", "comment": "Malware payload", "value": "248391275c785e91767d7813f4c5f1104d715a87", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774716508, "uuid": "134b59c1-acff-4381-8c8b-f893355a4ac1", "comment": "Malware payload", "value": "4af732a18ce79e1d135347755a02cccb7bc661e7ae0c0945eb425b743c0044fb3991f370c172d21a78b4857ac0184b97", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774716508, "uuid": "5599c2a1-7bdf-4ae6-8248-8d7795c4ccb8", "value": "T1235102051BF90749F2B78E799876B2219A77B811FF23974C1180964C5871724E87AF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774716508, "uuid": "457e97ce-48d7-4f48-bfe4-66187744d210", "value": "48:8Xlk9JeIywlv8DvoVZrvudLXuH2CNCixZXjV5V:81kdyoAsTWuzEwZx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774716508, "uuid": "d7084ed8-8cfd-4da0-ad33-8312588a551a", "value": 2759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774716508, "uuid": "d724425f-b488-4a61-ad32-c22b1a9f4471", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774716508, "uuid": "a141f2f1-0140-4558-b467-6ee10869ee46", "value": "Luna_Magic Book 4-8.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0483fb23-2ae7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774730712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730712, "uuid": "baef94ec-0d72-4a55-816f-a9adad39aebc", "comment": "Malware payload", "value": "12824e8576094015111f9cd6db064ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730712, "uuid": "66b8a493-d968-45ae-b46b-1c52b5456dea", "comment": "Malware payload", "value": "6b9a0041279a35f906f723d4cf8c38a9f482c08fd3220227a639e266f2c204f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730712, "uuid": "a315ed9d-b310-4f89-a569-9ef95a775960", "comment": "Malware payload", "value": "fb653dc28641bceb7d80800fd1271a59c930ea5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730712, "uuid": "a9308799-c5fe-4225-b1c3-e2b1e8d85ab5", "comment": "Malware payload", "value": "858aa0cf51fbc57746b8215d0aa4bb598a494249e2c5ded4af4c694c846b0605a9e89599ccbede67d4f30165235cefb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730712, "uuid": "16370d77-15a2-45b8-b9ab-c6d8aafa1030", "value": "T184E63324C77809FDE2F7D4B9C9C39802F7B674192360E66F13A958B70E237A4257A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730712, "uuid": "91baab15-d188-4c7e-b074-5da5af194638", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730712, "uuid": "bdabe25e-9b58-4e6f-a6e1-3eb5993a662d", "value": "393216:pw1MvHPTDu9g9VEOL5tmwH4lqUfy1ikNj2Y1aTBCrw:y+Ti9g7D1tVH4wx1ixTBCrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730712, "uuid": "4d907c1f-4d29-46d7-9dc7-c951226efeff", "value": 14338284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730712, "uuid": "2d80df24-7292-4030-aa90-007cbcde9fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730712, "uuid": "67fb1a64-3deb-45e4-866a-a67c03c31854", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fef1639-2a55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774668105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668105, "uuid": "36d383ed-fa33-4cb8-8481-73b3d4063a7d", "comment": "Malware payload (Mirai)", "value": "19987117eea25b4329e97d89d0d29fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668105, "uuid": "9ab8509e-6849-497b-9934-4ad0f64963fc", "comment": "Malware payload (Mirai)", "value": "6c5476450a050339d6f2a1aed2123f71de65dad2cd267e4996a3d4895e25ce65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668105, "uuid": "86ac4e85-915e-4643-9286-3d73b46e6488", "comment": "Malware payload (Mirai)", "value": "9ee9a6aaad146c5f96297cf81ff4bb41140d6096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668105, "uuid": "3a0221cc-0640-48ff-b5a4-09240898a42a", "comment": "Malware payload (Mirai)", "value": "be1d0bdfc29af956b0181d6a17738dc7f4b2acea308289984974a1373815fb96774fc0a6f1f409732fcdf8cfab40c453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668105, "uuid": "1d5f2b7b-5927-42a6-8901-922bd75fbfd7", "value": "T1D5D34A05730C0947E1673EF03B3B27E193DFDA8221A4FA41655FAA8E81B1E32554ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668105, "uuid": "ae0c1825-5594-43c3-99bc-1d6a5e7f7fd7", "value": "1536:pdRAOmweu+j8xn5kzrDYSsjIKhVP1x2JBvKWSAG9uGzvAgcPzxG5fP+qyWEccWs:FXma+j8x5kDUnBz2BVSaGkgzhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774668105, "uuid": "2f238fd7-992a-493a-9679-31f8569e0339", "value": 136068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774668105, "uuid": "92dbc605-cf6e-4d10-a7f2-b4fcfe11e989", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668105, "uuid": "68accfbe-e18b-48a0-8c21-7f789c216b4b", "value": "cronn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1a8f82-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774706755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706755, "uuid": "5aefd0dd-69e9-4b62-9797-95f89e342aa3", "comment": "Malware payload (SalatStealer)", "value": "fbb5d3a6eab97c0d95a0d466ee50396f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706755, "uuid": "e777d565-f700-4627-abad-6d133a757add", "comment": "Malware payload (SalatStealer)", "value": "6d9f06210116db97f34cd074d8967bf0e7ca0dc4f0037c4fc61ec517ff21be50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706755, "uuid": "bb55ea8b-4426-4f24-9c7f-568ff086ed8e", "comment": "Malware payload (SalatStealer)", "value": "2530a37e968e83818a535f4e9b7e40e56e923efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706755, "uuid": "1f582c1e-ae2b-408d-88da-faaca34b3bb3", "comment": "Malware payload (SalatStealer)", "value": "12dd76af3b5e4519f85b2b047c4ad23a063c55993c9ce8beb40c04c5e98ef32ba45270f0b9c1a957ced11f6755a5a5c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706755, "uuid": "70240502-a3b8-49c5-8e61-018a2b3c8ed2", "value": "T1FFF533FDF3D5A6D0D520607DB3227BC039F1AD2A6E6F67283EE68DED085280548511EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706755, "uuid": "e107cec1-cd60-457a-9cd8-2fee4a67fedc", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706755, "uuid": "e84c2a44-eacf-4cf8-bc87-33ac08aa2787", "value": "98304:4YxIg7aeBh2I10TclWGu+6zo7IycD6gXVFZCx:3xIgJ+w0TclUPoULF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706755, "uuid": "fa2a274a-ef61-4ab5-8d3b-5bfcbea83ff5", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706755, "uuid": "a0770a50-7f6c-42e5-b1de-35af51983ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706755, "uuid": "5aaa80b1-ad15-4bc7-9b82-2878d0893c95", "value": "MALTABexecutorv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cc3e59-2adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774725721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725721, "uuid": "146da7b0-5d06-4c75-811b-09a482bc6847", "comment": "Malware payload (Heodo)", "value": "b6299145009e19412777b20cbbf99771", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725721, "uuid": "36e18d13-4021-4f2d-9ede-de436913b632", "comment": "Malware payload (Heodo)", "value": "6da36358a6d614bd0c98973ee18b7963054c7ef085414e7e45f110fa9308ef74", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725721, "uuid": "bd8904b0-2af3-4243-adc4-ea832ce3d0f3", "comment": "Malware payload (Heodo)", "value": "2c3517d490792a52b1e283457a1d31c417ba5e37", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774725721, "uuid": "cbe33120-582b-48da-a670-a961971ee9f7", "comment": "Malware payload (Heodo)", "value": "0b6fb2332927a2303ec2f203be4299d8cf13caa30adf4dc3ac7c32efe4fdf89a2150a7383564f8e6ca3a6bcbb0b4ec93", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725721, "uuid": "1e1848bc-91d4-419d-9704-2a97c9ebfe2c", "value": "T102063352F3CA6531F95A0E31445B8862AE2338B51AF154693DB8C50F0A7D7858EF3FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725721, "uuid": "affaa1ce-c6a6-4dd0-972f-5cdfa6711933", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725721, "uuid": "bd01da96-9c81-429b-ae85-41c1bbdac3c0", "value": "98304:EpbRV5kr+CUYuEfctG3+I/KuJqSJXKPvpYW4d:yIuEE5ICuJhYpcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774725721, "uuid": "9e239821-96a2-4ac5-bdb7-23ba954b88fe", "value": 3722050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774725721, "uuid": "9769e4a1-ce74-4a6d-b2f3-b7f8294bf0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774725721, "uuid": "8c7d007e-975b-4cf2-a22e-7396bb4b62c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d923b9-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720358, "uuid": "c5277c07-6567-4a6c-9ee6-f2d9f9e4ca24", "comment": "Malware payload (Mirai)", "value": "d6dc063f57715dd9ab8bae667f39d902", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720358, "uuid": "c8074eaf-4cd7-4900-b1a4-d9fba241d14e", "comment": "Malware payload (Mirai)", "value": "6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720358, "uuid": "e8e587dc-dcf4-4927-959d-88c26daac651", "comment": "Malware payload (Mirai)", "value": "53e0e409a28003c7266150c06c7730654bbfe3c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720358, "uuid": "52e2a88b-1e00-4c94-8efe-52980525e7b9", "comment": "Malware payload (Mirai)", "value": "0c12aa2c3a5c3d62af3a656cbb45261cb78fe73192573934df350807c0ca2e3aa4e8d439dce84e7a1aecec7bd69dc756", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720358, "uuid": "7c4c6c63-5edc-4734-86ea-9e11dc618824", "value": "T18651C68942C66C312CF7EA13F6B6E13874C1905318EE7F99DDE4BAE8869ED147140B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720358, "uuid": "636524dd-d2bb-4df1-98d2-18cf3e505ed2", "value": "48:vpM70M7N7hpMvM6GpMgnMzPpMfMKWpM1MoUpM71M7o7UpMfOM3bpMEM9RpMhMcg9:v67v7N7h6E6G6gMzP60KW6GoU67G7o7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720358, "uuid": "39799017-24a1-4506-9226-cf1ba9d7f267", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720358, "uuid": "a82e7887-4c2e-4045-a74f-0ddc5d04134e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720358, "uuid": "3dfd686f-9434-4b8b-8f35-46e7dfe56a41", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5609f636-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774656546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656546, "uuid": "f1515db8-54b0-4964-8986-66d35ceff23b", "comment": "Malware payload (ValleyRAT)", "value": "7b8fc1f2a80cb2c327805ec556065126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656546, "uuid": "feb6429b-8818-4e72-8eed-2a353de8f90d", "comment": "Malware payload (ValleyRAT)", "value": "71f740b9be7add86c4d07299b129e7052e3dbbe42b4f103f194e4591c4ac1d5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656546, "uuid": "235e532e-98cc-4ee2-b343-3a819f28c1a0", "comment": "Malware payload (ValleyRAT)", "value": "96f0754072e031a7d95221849ed30d420b7effc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656546, "uuid": "23849400-005b-4c19-98e5-2ed887f12a42", "comment": "Malware payload (ValleyRAT)", "value": "476a3fc922caeae50eacf340bb39ecb5a64cd9f28a9d34390f50aeb524159cfc6ffcaee4dc0d1cc176ac0da887013a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656546, "uuid": "ad5c3b9d-5d75-412c-b9b2-7e187026780c", "value": "T157D53323F6FA7AE4C9769A7A90D1B10EA7B7343260508B5F065842961F1B5F0CC7FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656546, "uuid": "158511fd-63df-4875-83a4-2287d4c36a90", "value": "db8515936065c025943de9f0b2c61e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656546, "uuid": "a0e1332c-a8a5-424d-bcba-2ad412ec75b1", "value": "49152:1i7XgF/L4vNq6b7ePs75xI9kHqL/dSnaNGW+KMe+B9FS/5WUo5vED6rLYAEewi:1i7XsWoyIaHqLFSnfKm/Fc6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656546, "uuid": "85e1c950-4862-4239-8ecc-a3a353c69177", "value": 2950144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656546, "uuid": "2de7d274-6267-4edf-8cdf-ac6c25c40505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656546, "uuid": "728b45eb-007f-4e43-9142-35906b44ac8c", "value": "53b749b6_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b442b8-2a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774696187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696187, "uuid": "5479027a-0bea-419a-9eb3-103c749656ea", "comment": "Malware payload (Mirai)", "value": "3f792a93e1a59809c23f062b074890cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696187, "uuid": "35e13d16-ee2c-4857-9c4b-43225b3fe366", "comment": "Malware payload (Mirai)", "value": "72220c720a75cdca9b03171a34f0f608422f6e1fa51af07a91aa4bf5f8760985", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696187, "uuid": "c24e8621-f9c0-42ca-af8d-11c9b95b0cc1", "comment": "Malware payload (Mirai)", "value": "875d2d8390e4edeab7accd9aba1d7240692c9012", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696187, "uuid": "e14b7d60-87d9-47b3-9526-0f46d005c6c1", "comment": "Malware payload (Mirai)", "value": "c25071ec45a84ff59860dbe80dfa2a970ccd14122a2c66f356b578ff77f6e26f8334aacaea599c586e36c0824061edee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774696187, "uuid": "59f80e9d-e23c-438f-bf10-90a4d18b8348", "value": "T1EFA1FAE974B5A36B2DB0ED7371D6CA42F28060A7E0C91D0EE6D1F0E9458CF61F484B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774696187, "uuid": "a684bb17-b135-4630-a8d4-5ce19db48fdc", "value": "48:vpK8KMV4kuopKDK1V4KopKrOKrWV4jopKQKoV49opKE0KEEV4EhopKUKkV4BopKl:v3pdWb9XBTGEpO7LFKjsfNjTtcrYjb/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774696187, "uuid": "3ea694d1-a7a1-4c51-bc6d-89e906449dec", "value": 4821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774696187, "uuid": "aa556800-c4d0-44c2-b03b-4c93f3118c1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774696187, "uuid": "86b8408d-32b9-4b79-8533-321d47cd701f", "value": "zyxel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a22ad2e-2a72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774680578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680578, "uuid": "e7576a80-3cf0-41c7-ac9c-042a2e64e759", "comment": "Malware payload (Mirai)", "value": "4cfde97b856bb92e01a709865e18d6c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680578, "uuid": "bc170832-f9c9-4c5d-a0ea-df578ea41ea6", "comment": "Malware payload (Mirai)", "value": "723212cfa41292fb9f70f282e6fbffea53c03a888b9fe681ef105bd3f5c8c1ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680578, "uuid": "185a3b0f-6768-4b09-a6bc-a319869de4e9", "comment": "Malware payload (Mirai)", "value": "6cf39a39d1629cdd3f4d52eb799523636cfbcef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680578, "uuid": "2756e0ed-5adf-4f4c-b506-17ba9580079b", "comment": "Malware payload (Mirai)", "value": "bb833c585801d2088eeddfcbd2d61e66fea1e625b2870d74c646ffd7b6ca55c561697c47ec7b92581a0e680ea1787b04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680578, "uuid": "02b331a7-e205-4459-84ae-c89cb1dec79a", "value": "T16CF46C6377218F64E365D67005F387119E9521A30EF290C6A2BCD2207E6066D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680578, "uuid": "422cbcfb-42e2-47c1-a79b-c8cf13ebb5c8", "value": "12288:gpEPKmln4Dzrs61rwSWnWv48nGNmzzuf0eXbtEgp9kMToBid3:iwKm569Z48nG0uFXbt0eoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774680578, "uuid": "0a312d3f-6186-497d-8605-7e19bd972a2a", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774680578, "uuid": "8ae1c00e-d38b-4dc3-bade-c820371e5459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680578, "uuid": "ffaf8658-8d43-414e-959f-2dc9eb1da78d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca896c1b-2ab8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774710858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710858, "uuid": "bb284a47-969a-4514-964b-66ecb5080f46", "comment": "Malware payload (Mirai)", "value": "1eafe94b5738cef64b22875ba7b886de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710858, "uuid": "af3a478a-560c-4fc1-9771-c51f5feaae62", "comment": "Malware payload (Mirai)", "value": "7232a5ad9ce9d88a550feded86700ce9ffea03121499ca26bea4a3f2324fcbd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710858, "uuid": "5bb0ba6d-39f6-4c58-8d5e-5ba1d234da3f", "comment": "Malware payload (Mirai)", "value": "d0d93b9d604c6daa456211ea5fc4f5089a169f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710858, "uuid": "1457e73f-2394-401b-95a0-335b9c21e923", "comment": "Malware payload (Mirai)", "value": "9352ba0f9160aa83aee045013fa892b28aa3afd4c61b8b6cf21f16bca74b903ab48fe1bfd8e4c0f8fdc877ae36c28478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710858, "uuid": "e460d1ec-ea95-4906-93ba-afbeabdb4851", "value": "T13C14094AFB804B13C0962779F69F43563323DB5497EB73069928ABB03F8779A4F62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710858, "uuid": "dc99d052-83e7-427b-ade4-db56b8967821", "value": "3072:LlN2dAj46Hv1IH97MDaFAfZba7EYBneetCfaQ2lV/GgMps:LIARHv+HZMDaFAfZbagY1tCfaQCV/G/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774710858, "uuid": "a95c3397-6093-4989-bc93-b3ad08439bcc", "value": 191184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774710858, "uuid": "0d19f84d-e433-4964-93cb-78043bcda980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710858, "uuid": "b49d83f2-1744-4ff2-88c8-d2dec21bbad6", "value": "net-workd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c3348d-2ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729261, "uuid": "dcab3007-492d-4efd-97de-0aac6971846b", "comment": "Malware payload", "value": "265c422de30fcbcc1de5e71eb313b59c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729261, "uuid": "30e1d3b6-b58b-4177-960c-ff86a2c114f0", "comment": "Malware payload", "value": "74cc3547804d89c2d08c65e101446e28e89196ea05544ec4de2c8ad030132544", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729261, "uuid": "747f7a8f-9459-4b7c-9b3e-211503cb5b25", "comment": "Malware payload", "value": "0f2bfc47e587f178731accf171d8981d7bfee677", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729261, "uuid": "7b564fef-79bf-42a7-9ed5-3768be9b7ab6", "comment": "Malware payload", "value": "a9cb776c1378f86a3776a187a78cf258876672172063079b3493fbd51106b20ab42262699805aa0e20104a8e7102ad57", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729261, "uuid": "261b5a0d-41b7-45cc-aa64-ec5549f247d5", "value": "T11FC69D27B38802B6E4FA9279C6D74617E2B2BC51177293CB05A531AD0F37BE15A7B310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729261, "uuid": "595d6fad-45ee-48fc-93fc-3d8938050f35", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729261, "uuid": "6060a7a5-30c2-426f-b6ab-6296f6a78fb4", "value": "98304:D0r51GxhiehH7MZcniemSG7OHtEB/oUbEtENYrqE8wu16FiWaVD:DkPIUZf7OHORzZYrBuMiWa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729261, "uuid": "f47473a0-b168-40fe-b310-b6008aeb6086", "value": 11775488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729261, "uuid": "a9143a6e-309f-4949-b351-1bf9713a373b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729261, "uuid": "1b4729c5-093d-4624-b0c3-6b417d05e43d", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bec91b-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774656631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656631, "uuid": "0cb12850-f512-4828-8757-a663e246f6a8", "comment": "Malware payload (SalatStealer)", "value": "c3b2715ca1db7ea601bd19c1caece52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656631, "uuid": "705b9d55-7c92-452d-b602-a0d6835cb172", "comment": "Malware payload (SalatStealer)", "value": "750e5ac3bb33d7ad4f9676ec40531b24c083cabe89683e40453f8e9d769ad1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656631, "uuid": "1ec8592f-125e-47e4-9226-e9ebc69b139a", "comment": "Malware payload (SalatStealer)", "value": "6504abbb5dfc7e4cc0e3a2249d02eba3f796868a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656631, "uuid": "5b0bbbf4-361b-460a-bd43-47669ecc6c92", "comment": "Malware payload (SalatStealer)", "value": "d01917f362880cfbfdd3b16c910a06453703a82dab51c7a45765f9f939b305fca59708581c285d4e8a9d4c4534b991f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656631, "uuid": "5d2ca11e-4110-4e45-a48e-a9ac89f1a7c0", "value": "T135C65C11FACB54F6F9036831406BB27F63315D048B28DB9BEB187B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656631, "uuid": "4116429b-7c7b-448c-9f8f-8ad71bf6b4fa", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656631, "uuid": "2ee308f1-7c78-4e49-a419-33aa1e7d3d3a", "value": "49152:Nv9mOJw97H2GUAt5k9x7P3ZCKL/JRbwfVkVMYf3tSdX9VeMNtV5fMgHjpwH76jdu:3m+wd5kDbpCEJmewnTw4Q4phEqO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656631, "uuid": "fe8c6c0c-cc27-4df0-87f7-94b61ba6f84a", "value": 12570624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656631, "uuid": "e7216059-c33a-4ae1-a018-91ba0230fde6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656631, "uuid": "2339d48a-7425-4e3c-9670-571938e71422", "value": "valonity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cbf89e-2a59-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774669837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669837, "uuid": "1e3ce803-aec0-4c93-9955-a727ee256da7", "comment": "Malware payload (Mirai)", "value": "cd08c04d0cac59e9f12512eb9acfbf98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669837, "uuid": "c288f3f5-c2a9-47ab-89c6-4294a379fe8c", "comment": "Malware payload (Mirai)", "value": "765766e8e80c0d6d5443e93b5516f8391b63bb08fbc380418fb10019022959bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669837, "uuid": "0b6535bb-9964-4ef3-aecf-3eda1b0a2016", "comment": "Malware payload (Mirai)", "value": "db3780a7930ad2cb26e823c5fb461f9b99fce964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669837, "uuid": "b8e7be72-1aff-4b0c-9794-9186a4b7211f", "comment": "Malware payload (Mirai)", "value": "7045539035468b5c9b2ade6525ff1d84c2434f74b26e665ef7d6a433a6456782e0f7e922ce4c59e00c604e91ed36e2d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669837, "uuid": "2a418a24-e39e-4dab-97b0-093981f2d0f8", "value": "T1DFD34A0775C094FDC8E9C1B88BFEB126D972B46D1278B21B2794BE321E8DE205F6C611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669837, "uuid": "c45f198a-2c8f-42bf-a9ce-3299e500d4e2", "value": "3072:LdCEUfO9LM472hzmrNZg1CCm0ymJ/IfX2rmzK:umizxPJsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774669837, "uuid": "44f9e716-c486-48fb-b623-b76bd84eda51", "value": 141480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774669837, "uuid": "4a4f2ef5-9803-4e9d-94fe-2c5386f03765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669837, "uuid": "5529f88b-ec84-43a2-b429-711fd078b8d9", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46981e0d-2ae6-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774730394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730394, "uuid": "16cf166a-5ca6-46ac-b0d0-d6fa91a80540", "comment": "Malware payload (LummaStealer)", "value": "b443f7cf8e557e8d4de330de0ce6cc26", "object_relation": "md5", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730394, "uuid": "ccac76ba-b4a1-4467-af4f-4814b4369112", "comment": "Malware payload (LummaStealer)", "value": "76c9bd1b1a29a3505bf9362ad11c327ef6dc9f7c0cc686501a1bdc815f2fda17", "object_relation": "sha256", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730394, "uuid": "589ec342-b58e-409c-ad47-a036b156b61f", "comment": "Malware payload (LummaStealer)", "value": "058678da608f62ef01ab7c6460dc0f1261a253a4", "object_relation": "sha1", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730394, "uuid": "9951f310-3acf-4cfd-8f65-371075de7bf1", "comment": "Malware payload (LummaStealer)", "value": "ad32850025dfa150f4b2931fc245e083d6ac71f4d5cccd7abc05e51d3de878e660c5f4740a9a8a2afb0c2d5017b512ad", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-236-29", "colour": "#446042", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730394, "uuid": "4966c4d0-6279-4bed-88c0-6cf89c58b285", "value": "T1CA954B01FECB54F1E417163669B763EF273898090F36AA97EA403A7DFD762D41922309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730394, "uuid": "baeef664-910d-4a8f-8119-8fa80e21e310", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730394, "uuid": "9b695201-5276-439f-b618-aaef0dcc64fb", "value": "24576:3FoEpn05mXxg/L05BNPwe7ZuY3WT7izn5ngS3H/ChjA8eO5aLY3nMKLirk4xPb31:3WKblweFnNahjxJn5irZbQmu+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730394, "uuid": "480c08ff-4592-4514-b42c-e45511f3fc68", "value": 2035880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730394, "uuid": "9b62d922-6deb-412f-8854-b18eed8a7d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730394, "uuid": "611948bd-f14b-4af9-a665-eee8f5237f60", "value": "w9WJfpWNM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58402cbe-2abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774711955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711955, "uuid": "3a7fe009-853a-46fe-838b-6c5d43b62fa4", "comment": "Malware payload (Vidar)", "value": "f5b7c70d1a7d9729c8dc5e5b67f23cde", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711955, "uuid": "3916dc68-092d-48f0-95a0-33f14c6b1197", "comment": "Malware payload (Vidar)", "value": "77c18af2a5280f9cfecd1a82f2a50aca6dfeba8858130b0a544752126e130d33", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711955, "uuid": "2fd8d3a0-d0c2-4d1f-9bec-a6c475bb236f", "comment": "Malware payload (Vidar)", "value": "d245121937e129c383f1f95428b149cf29ab7dbb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711955, "uuid": "f452880e-8fd6-422b-92bf-0a7230eb2d0f", "comment": "Malware payload (Vidar)", "value": "0b280a1729128e91091259d61c7caeb700466b4ec556497c5cbd9c5b86c9372ee209f42ba98d1a8303f918f4e1bc9d6d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711955, "uuid": "6468d881-0007-4f14-85ff-4df4cbef7562", "value": "T10F958C066CE104FAD0AA63328CB7A2917BB1F8490B3223D72E507A793F767E05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711955, "uuid": "1448dc2b-61d6-41ca-aa6c-5527c500d2bd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711955, "uuid": "1f8d5884-37fd-4b3a-b30c-5d871a58a975", "value": "24576:9qvRkgstC5X/2vPo7ADxvhw8NfbZ3O2fPSQbsNiwrXfzwPM4nhele5nK23TdGK6M:9qpk3C5+vPCshTNl3OKPS6mi6sPVdx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774711955, "uuid": "5e07e9c6-9b24-4a09-9f38-976d70716d66", "value": 1917632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774711955, "uuid": "87d04c33-3ee5-4f80-9ba2-4fd1a69ada55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711955, "uuid": "b57b3b7a-93d1-4ff9-bd9b-5136ffab1ebb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408e9be2-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686575, "uuid": "e12abae5-ab7d-44de-82ce-f6d8ae593d38", "comment": "Malware payload (BPFDoor)", "value": "eabcbf25031a1984a8205568700af8ff", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686575, "uuid": "150bcb43-f95b-4c0e-9c98-e84a3d595781", "comment": "Malware payload (BPFDoor)", "value": "785538b21bf8c9f142bb5565f42d5da5e5150dea63eddd5c1b714dc6306c96ae", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686575, "uuid": "2d48d7a8-47cf-4702-a04f-29d8f26e0b1b", "comment": "Malware payload (BPFDoor)", "value": "ac32deab6f02db231397458b7c53eca6f96b7009", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686575, "uuid": "a8bc3329-2609-41f0-b09d-f2d5db5b202b", "comment": "Malware payload (BPFDoor)", "value": "46ab2a7936b616c5f3785ef6bb6171c002479376bd86bf082b3967c00b76ac4ae47f28d888cc08f52a9b02a9ba4aca57", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686575, "uuid": "a129c187-b4b3-4dc3-bb8e-91489ee52f47", "value": "T111F2631EF391CE3CC8C9A2316ECBE5705560B0B0AB32211F379167B73AA679D0979E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686575, "uuid": "4bb39a6f-d5aa-4d8d-adf3-09168c986e4f", "value": "768:bvqoAYwIg4QoAYwIg4QbTLD7zrjbTLD7zrjbTLD7zrjbTLD7zrjOm+Wuzjsn42mi:bvEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686575, "uuid": "afa031b4-c688-4b40-ae94-70b200a1bc3e", "value": 35680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686575, "uuid": "19bc8d99-54e9-4fc0-a718-2fe03340d6d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686575, "uuid": "ecfbf6a2-e959-4220-ae43-a8cd75a18c8f", "value": "785538b21bf8c9f142bb5565f42d5da5e5150dea63eddd5c1b714dc6306c96ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9eb54bd-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720360, "uuid": "b2f6f4a6-4a1b-4531-af24-0aa8daa4dd47", "comment": "Malware payload (Mirai)", "value": "f274843f966f951d6610bb7f8e50a2be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720360, "uuid": "8a1e30aa-1452-4115-9896-6cf1c708d84d", "comment": "Malware payload (Mirai)", "value": "78e7832fb64f89645b65e7d32bb2b0ac2533c9250fcfbca0ffccb823c5f2e42b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720360, "uuid": "e5d8cd27-756e-46b8-8174-ce16f34016cc", "comment": "Malware payload (Mirai)", "value": "e63abb012647a708cb954314d7d7fbadd0a021cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720360, "uuid": "6974580b-456c-4433-83f1-55630f09a1b5", "comment": "Malware payload (Mirai)", "value": "72651772a2d96762472e1bb1c24ecf5ea65bc1fdb49eb79ddf3763fec8f4d445f6b30e072d215e084a06eee16e4c7d75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720360, "uuid": "e19dc13f-36cd-4540-bce6-451eef6d0886", "value": "T163336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720360, "uuid": "2f464b69-e5e6-42a3-99aa-14569411d7e4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720360, "uuid": "ff0dde15-0afb-45c7-87a6-90d1ab8ceb54", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720360, "uuid": "48d4adc3-a4fb-4fcd-ae05-8ca975a95aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720360, "uuid": "48ba6743-bb49-47ec-8a8c-542b0864d963", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac0bb07-2a91-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774693974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693974, "uuid": "0084ebad-92b8-4d38-829e-4745bc3d1b93", "comment": "Malware payload (Gafgyt)", "value": "1d1b210c40c7a382ac5db48b04fd9c22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693974, "uuid": "e15aea23-7613-449c-9896-634d605031b4", "comment": "Malware payload (Gafgyt)", "value": "79da68d310cde7b54e086aed576e61793946d4188946a31ffb68351ab8c6f2c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693974, "uuid": "18c83e09-48e6-45c1-b02a-82c92c798b7b", "comment": "Malware payload (Gafgyt)", "value": "bd3172af82f9754b8b1d0de0f5b1f401ae09251e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693974, "uuid": "096e2e86-c567-4ab7-8c74-841dfedef9f7", "comment": "Malware payload (Gafgyt)", "value": "4d1049a71ada1f3dc0da7cc695f7fd50cc12e6e081bf8a618d345b0a487a65658847d3e41b9c5f5192d7fa028a798ea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693974, "uuid": "b3aa2201-2aaf-4751-9f4b-d0bbd656d8f4", "value": "T10844155B2E328F5DF671C63682B78961E39833D712D1C685D5ACFA101E2064FA42FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693974, "uuid": "65dc83f3-3f4c-4baf-bc4e-32a2294823b6", "value": "6144:Dw2lRVI+p+ulXlTDJd3yvE9s7kCVaR+mdNN5pqvkwZ:DwcFvj9Szm/JqcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774693974, "uuid": "e55a8fac-9a0e-4ec1-afc4-216f24988b45", "value": 263928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774693974, "uuid": "b5919f5b-7558-49ad-87c7-71f64817df69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693974, "uuid": "2b7977a7-c93f-43fd-aa07-bafa1a17988c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47857342-2a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774691311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691311, "uuid": "db1e83ff-9718-409c-96c3-8f2f66d05ede", "comment": "Malware payload (WallStealer)", "value": "ffd6305e70bd78848e5bd9d049d8fadb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691311, "uuid": "0b96e88b-b848-4a6e-9003-d763012c09c0", "comment": "Malware payload (WallStealer)", "value": "7a9fac54f8535514662da9d95b22b38c0da86d1e59e77bfb65cceb19e232a8a8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691311, "uuid": "590a212e-806e-4525-b7aa-4aa3360087e2", "comment": "Malware payload (WallStealer)", "value": "d0f9bfeb4d0a991da98eb3c0c08e61f71ea88c6d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691311, "uuid": "f1597aee-d5fd-40ad-b253-d9c14ab3950b", "comment": "Malware payload (WallStealer)", "value": "0de6276d2055cccbd1c7ef0674c8854d2e8809c6ca0771c64cacfd13b461feece34ece7d65ac0906a1eb435b82939684", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691311, "uuid": "90afbab9-3005-498f-9009-14b35f3f5013", "value": "T1B516DF0AACE999F6D8AE53318CB626927B70BC190B3263D31B40B57C2F767E46C71744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691311, "uuid": "9fd90a84-3729-4bcd-8924-2a7a8b2c95b4", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691311, "uuid": "1ee10c43-8a0a-4e75-ae6c-6f468fae473a", "value": "98304:BhDl7vTdBhkNm0MuV/islZOf7WXhc4xPwqckhj:B3PRkk0WUaWXyIIqckhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774691311, "uuid": "572fc370-df74-42da-ba72-3f8b0bb8cbec", "value": 4259464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774691311, "uuid": "d8fd5e33-eea3-411c-9d2c-abcc8b9298c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691311, "uuid": "ae40ccd1-bb4c-44d3-b4c4-729d547f1e03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1980a54a-2a4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1774663316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663316, "uuid": "0b19ea98-ba82-42a8-a6af-7e061bf44051", "comment": "Malware payload (Phorpiex)", "value": "0c5a5c179487c02cc74a840025a49596", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663316, "uuid": "fde80d78-e0ae-47c6-8e6d-6004db7ebbba", "comment": "Malware payload (Phorpiex)", "value": "7bea83c3f297716ea901b8075d062bb02ce240ab6c5f6fa40ea8ce3f4ffef226", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663316, "uuid": "ffd31cf9-775b-4c36-906b-7c0d7ced7ed4", "comment": "Malware payload (Phorpiex)", "value": "421ce880a88e63756ae1cc170e247cef2795d7e7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663316, "uuid": "414319af-5cf8-4ecc-88ea-05b6b7f944a9", "comment": "Malware payload (Phorpiex)", "value": "09c2268ee325f0036e2e32d558ef4f4cf802e8824d824ef0b548fcfd1cbda2dfe60b0ae2e3122936ed1008564fbe591e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663316, "uuid": "260ec792-58aa-4edb-9d6c-aa5db4ede6b4", "value": "T1CC825B0FB8824626D1D100B59A62467BDAB89472339858DFFB904EED0B6C6D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663316, "uuid": "dc057c66-68ba-4ce5-954b-0060862ef806", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663316, "uuid": "24aa72dd-ca21-49bc-8cdc-41180d2619f0", "value": "384:M+GIUVp9sHsXwvBfR0jfbdAhZ+DYav8U9cvi:NECHX0jf5An6Ya0UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774663316, "uuid": "72c65617-8427-4c20-ab16-3015104fb89c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774663316, "uuid": "74fd07dc-4339-4eb6-971f-1cbef0b36ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663316, "uuid": "0915d486-6fb1-4dd0-8db7-e0c2d1f180c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d2c7df-2ab6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774709995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709995, "uuid": "5d9367ab-cccd-47e4-af56-0155c0a3ff7a", "comment": "Malware payload (SalatStealer)", "value": "fff4867b75ce7c0fbdf89e30d0180df4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709995, "uuid": "8752fbfa-9055-42a2-9f6e-693938bdcff4", "comment": "Malware payload (SalatStealer)", "value": "7c739f32adb9201b722064b8064f0c42a2f71312e9e2524f761037a6b9bb52bf", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709995, "uuid": "f28d6134-0ccd-4c9a-a7ef-60a2562635a4", "comment": "Malware payload (SalatStealer)", "value": "52a5d3ff4e2b923bc47ca056a4cecad1bacae6f3", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709995, "uuid": "9486181d-496a-424d-8a12-2b28f0d4d962", "comment": "Malware payload (SalatStealer)", "value": "d86c21a3cd15eb9c5b193b11e7dcd27558a10d29748f819b89fc6d4bac975345f37a42e8471fb14f76f0788b5608769c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709995, "uuid": "742d1a27-0d40-4c35-a08a-140189135ed2", "value": "T1B506334665E093F5D99F4C70DD38836A0E7FBEA05F91C9EB0789059A0EBA6F00134B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709995, "uuid": "9e9c2aab-d01f-4bfd-9239-8399ab1be377", "value": "6fba8ad2a21961482089257f6f306087", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709995, "uuid": "4df57146-0c51-4fdd-a396-fda6f9d8fa8a", "value": "98304:bA4g8maW0urOAKVG73uP4otKfviS2+LyGNis2d:bCwW0sOVGZDySVyG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774709995, "uuid": "01666546-f3c7-4ac7-a833-c6dd90126561", "value": 3806208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774709995, "uuid": "ff192f57-42fe-4a37-9f6e-7eb01691245a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709995, "uuid": "8d4282fa-fe82-419b-8825-c80b12bbddde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498c9c3e-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681865, "uuid": "653f9696-c1b5-41b0-a7f2-e3eeb7024f43", "comment": "Malware payload (Mirai)", "value": "847fd8f3495915ecf6a7d35037aa0be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681865, "uuid": "1ad25bae-9398-433b-90db-ad8c722e9188", "comment": "Malware payload (Mirai)", "value": "7d235334a669faa5d2b6e1c1b1bd59f38af7bc555a69e17c732617ed101ff055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681865, "uuid": "a5fac618-051b-4fa7-a4d0-e548aa123174", "comment": "Malware payload (Mirai)", "value": "4d9a65ef0686187df0a075e84c19e6276a3fb337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681865, "uuid": "990813bc-f6e9-4d55-9860-111dee864f02", "comment": "Malware payload (Mirai)", "value": "fa9dfc89ffb05872fb0a21ca4973f9186da53df494cf57bddb131e8b8f6b6cbed09af55e98b02215cfb43f36821b76ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681865, "uuid": "267110a9-38f1-4919-af14-cfece5b7c1a6", "value": "T19F539EB3C4295CA0C6A94139B9E9CE382B53B10492736DF55D568FB6A007EECF1093F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681865, "uuid": "3f2575c3-e297-4c5b-8a19-140a7f3aa0ad", "value": "1536:s/MM0k1EvamwtYBbLridkodwhniUDo3SQCmL:sUMvqvR3vGUiUDo3SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681865, "uuid": "8f7b294f-130d-45c4-b447-73124121f4a8", "value": 66580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681865, "uuid": "c7242b1c-0bb1-4749-9421-bc2f85b4c01b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681865, "uuid": "79d9a0dd-6197-45bd-a852-5eab729b5cb6", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18ed01f-2a5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774670927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670927, "uuid": "862669ff-7202-4905-bc47-9120702fb226", "comment": "Malware payload (Mirai)", "value": "709d579c13a5b464626d1919d74ec2bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670927, "uuid": "9cb943a4-6bf0-45c6-bc10-4f240e6e2b11", "comment": "Malware payload (Mirai)", "value": "7ec1c424d2bfcb4b08eba5fe31f2f3b20fdcd13b84cffefc2d0d53f017f7420f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670927, "uuid": "427a0dfc-378b-401b-b293-d9d2aeb8a418", "comment": "Malware payload (Mirai)", "value": "a2e4be99dcc128e1611986abe04252848e9c59ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774670927, "uuid": "6ee36f7d-9e22-4d0a-9225-759595e5a890", "comment": "Malware payload (Mirai)", "value": "7a93a16be8b66f8a8ee7d66b1f375cbf1bc4d6aa7b8b6998eafa0567aad1ef613deffc69df38bfa90ce8fc327e4e5186", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774670927, "uuid": "f0cb35d0-b037-4c21-be0b-6e9036003671", "value": "T131A1A5E974B5A36B2DB0ED7375D6CA42F14021A7E0C91C0AF6D6F0E8498CF61F494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774670927, "uuid": "5f3235e1-0508-4360-ad4a-cbda130aaf1c", "value": "48:vpK8KMV4kPpKDK1V4jpKrOKrWV4KpKQKoV4YpKE0KEEV4EEpKUKkV4kpKDK1V4jp:v3FdsbxXdTGEpE7nFYjCfhjPtSrGjX/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774670927, "uuid": "911d0871-0848-44bc-842d-ef5685ecc5e6", "value": 4863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774670927, "uuid": "22a7c85f-d93a-4b4d-bfe7-31fe9467752e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774670927, "uuid": "bdacf32a-3c56-46b4-a9f4-7ad0a8bb5fa6", "value": "thinkphp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9582a9-2a72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774680580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680580, "uuid": "63567435-3f60-4dcf-85b8-a8b6369b14fe", "comment": "Malware payload (Mirai)", "value": "e2f85f1bf6d08b696827b3ee4b7e3032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680580, "uuid": "edd548de-635d-46f6-ad69-9a0584e39190", "comment": "Malware payload (Mirai)", "value": "7eeaeb2cc70cd4f05f7aef15715a292f6e5ed0be4550f4338ff611bc5f7e0578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680580, "uuid": "cccd702a-3993-439e-8e8d-e9657a2384e3", "comment": "Malware payload (Mirai)", "value": "125bcf209d66763cdab20bac8a1b859472426512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680580, "uuid": "c36934e6-32cc-41a8-9eae-d82dc7ce2dc4", "comment": "Malware payload (Mirai)", "value": "3e1b068599b1180cbddbe74fb4caf470f1e2da4b8e828f8f67e1507ddc62203deb0cc42829a8577c25fa076975d5fe16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680580, "uuid": "06c10698-8454-42d2-98af-0db5657a233f", "value": "T1BFF47D59FE4E3C41E3CBE3789B4E87E1E22FB190D32351623981534D94C6AE9CBB0656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680580, "uuid": "ceb09dc3-7d77-4fd1-ae32-2471220e3817", "value": "12288:aA8gXcv9wvK7ktrJHbyMYF6auLV5X4Wqv4Rw5lmtKi:NjXrK7UHZy6f5XNzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774680580, "uuid": "2819ca24-bef6-49ab-9408-ca4e6028c1a3", "value": 729320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774680580, "uuid": "c5fc48bf-7f45-4663-923e-a8cacb7de779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680580, "uuid": "3368d7fe-5264-488f-a9bd-c306eb14aea9", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed6559e-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681874, "uuid": "54c8ff88-6113-422c-99fd-40a72a7748a3", "comment": "Malware payload (Mirai)", "value": "7daca70d951d4000a75e8df7e023c672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681874, "uuid": "a98ffd33-09c3-41af-94b8-5f1ae82281cc", "comment": "Malware payload (Mirai)", "value": "7fec9a423202af508020fc2d69e5ee58ffe608f3950495b92bc1eea7a7e68e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681874, "uuid": "95d7fbb3-1e07-4d62-b3a0-5f2eedbf9ff6", "comment": "Malware payload (Mirai)", "value": "8084ad0454d68b4a827b3c314d6191dac040f074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681874, "uuid": "600f24cf-7fb2-4a85-8fdc-45a4a8455a35", "comment": "Malware payload (Mirai)", "value": "bda8149c712ce192645f4aa674b6825868516745f2b181acacc03e1c1bdbf6bdd98ad74c70ad2e6449757fcc88ec6058", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681874, "uuid": "967fab66-b025-4739-a620-5b020e30fc85", "value": "T1D183F846BC818E11C9D823BAFA2E118E331263B8D2DF7223DD105F64778A96F0E77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681874, "uuid": "dd7bbd1a-c5c5-4cac-af5f-5b76c4a79381", "value": "1536:7on6OecY2dFcrfQ7OBDUzdAd2SF5u0V7nb5HyAlY7BAcEUIUi+DiCbn/p:NOHFIfQyBDUxi2Kg0HSAlIDiCbn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681874, "uuid": "c679ba92-d436-43e6-8034-922199ab5cda", "value": 83808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681874, "uuid": "15d7a5d0-210c-486c-b3b6-b5a0c321e41a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681874, "uuid": "165948f9-19e2-4262-a89f-7b275dfb335e", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfe2607-2af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774737276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737276, "uuid": "90ebf96f-05aa-4c36-bcc4-54b56895356a", "comment": "Malware payload", "value": "d6f073c1952d2d3981dfa789a9168a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737276, "uuid": "a2c867af-75e4-4cf4-acef-efc9843f39b1", "comment": "Malware payload", "value": "80b6e950105fd600077421de8415319441813e24748bb9f5c60e36fe6ea6b490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737276, "uuid": "647fd17f-5c9a-410b-92c8-51e0082bfb69", "comment": "Malware payload", "value": "1b60c355e4865b5a3d199d2eba0fbc4b653ecaea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774737276, "uuid": "9b94e28a-03be-4b78-aa72-47cfc2561280", "comment": "Malware payload", "value": "707f7c76c1cc6d226a0292bebec05d9348a4104f2e64817a0a50b5211f60c0ed89c668f8bcef97fcb6bfd34f0938d8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737276, "uuid": "6fb7d6ae-2f55-45b2-a8e1-fa422724e0f5", "value": "T13A364B5BF85151F8E1ADE270C6665213B6703C881F3223E72B01F3E52A36BD45E797A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737276, "uuid": "c97a7aca-9c36-4e8e-8681-480319b94739", "value": "49152:kB41BZmv9rb/TnvO90d7HjmAFd4A64nsfJ+RH8deEkYig14qFHksjB2/KqxnR5WJ:VKb1g1FI/qEBxVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774737276, "uuid": "e121c35e-8718-4449-9b88-e58747382f0a", "value": 5259264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774737276, "uuid": "743987ca-2217-486e-be46-c32822cfe5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774737276, "uuid": "3d246e3f-5fa9-4345-a65d-a402b88652ce", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44995bda-2ab4-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1774708915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708915, "uuid": "36755490-ddd4-438b-a9ed-75b52f1b1526", "comment": "Malware payload (Arsink)", "value": "57b65f03c6ab572f147346b3c6fe2a80", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708915, "uuid": "b534dcef-1d38-472f-9543-69e3781c2a47", "comment": "Malware payload (Arsink)", "value": "8314ece95207ff28466d4fc8bf6cef22cc6e28fef47e9bede381b502f038b552", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708915, "uuid": "a115078f-5391-4b19-b9bb-4339e047790e", "comment": "Malware payload (Arsink)", "value": "6020d23049ee55cfe27108e33f6999ce8c0e4342", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708915, "uuid": "cbbbeae1-d4bb-4f60-a1c8-e49613c047a0", "comment": "Malware payload (Arsink)", "value": "68f1839384bc1752cc733c954e4907769dfa9b9f9eb0948579d0e2fdf6edccec0c4629ef04b168379f530feee295fbe4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708915, "uuid": "688668c2-b231-4c5d-ba32-042ae90412ee", "value": "T1A696028AF789992BC873553345BA473652478C068E839B83AC59730C69BB6D41F1EFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708915, "uuid": "6117c2b8-ea56-49fc-8582-c05487be1d38", "value": "196608:b75dG0eiFr88NKLBEkrwzL/VmTXvmNl4smel05:b7q0nci8MoTOf3L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774708915, "uuid": "efa7970e-a2f7-4542-b325-132dfd30cb40", "value": 8680367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774708915, "uuid": "3f685104-d0d5-4bc3-9978-2b7f43b98630", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708915, "uuid": "11160451-b3e5-4cd7-847e-42041bd9852f", "value": "my horror Android 6 Chinese edit.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ad6b8f-2a56-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774668707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668707, "uuid": "1f4289d7-9e1c-4c13-b3c2-7e5bce818c3f", "comment": "Malware payload (ACRStealer)", "value": "bbf60f034f41f461da14deb731d2fb54", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668707, "uuid": "05adfc40-e349-40fc-adc6-a26c23c5a350", "comment": "Malware payload (ACRStealer)", "value": "83481e5adbe08e6974be76c7e46311d73651e9f23aac230b6e31cf073e4e6c2c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668707, "uuid": "13f6f708-9e23-4a40-bfce-da7d6fa84122", "comment": "Malware payload (ACRStealer)", "value": "0deae8784dba06448b93dba74ad3ac6486b7ab5e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774668707, "uuid": "d58315c8-3b33-4c5f-aa85-f065c9afd2c7", "comment": "Malware payload (ACRStealer)", "value": "5a8deb4bcee196265117ae393b856c1c0c2e5f5b7ae96d94c4755efda98ebab9204c6bbb5decc90cb10821b8b0f9346a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668707, "uuid": "9980684a-3b77-44bd-acfb-36ae53a7ac4e", "value": "T1EB66E70BBC6106A0C4A89134957F41567B753C486F2027DB269FB3642FB3BD76AB632C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668707, "uuid": "fa728950-425e-44a1-9a5a-244ae030f419", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668707, "uuid": "a43a2572-3d3e-43d2-9953-030bc42f6782", "value": "49152:6scN4UWK4SXNRUCVqxt5DENn53v2zp6jKFfFRfavQclsnOpcW:6sYMSd+OnWbaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774668707, "uuid": "081e22ee-f1f7-420d-8ccb-480935890876", "value": 6480896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774668707, "uuid": "7e4552c3-e2e6-4e9c-973b-f1f6f846015a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774668707, "uuid": "d0c2cceb-c75d-42cd-89a9-baa7268bac37", "value": "SecuriteInfo.com.Win64.Malware-gen.16177178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4abf14-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720367, "uuid": "b567661d-86c9-4c38-ac76-430ef9b67c94", "comment": "Malware payload (Mirai)", "value": "954b93efe471bd1842109ed373650ddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720367, "uuid": "a63e6d8b-f6b1-47c1-800d-aa3170ec1112", "comment": "Malware payload (Mirai)", "value": "834f044290c2451ca77633d938b1e360eb117aa2a01e25418e7ec0fe197ddcca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720367, "uuid": "217ec14c-31b9-4f42-83d4-0044dcb7f3af", "comment": "Malware payload (Mirai)", "value": "92498aa93f802c6b734a829b261bc24123de9905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720367, "uuid": "5ee8ee69-4de2-4d6f-8f1c-356beb8aa701", "comment": "Malware payload (Mirai)", "value": "8f09f8836fd90de2bd49de598b2b7dc7865364d7cefcee624a232d31e0358c895c39996d0cca555490349222345a041c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720367, "uuid": "b6e50905-5ee4-466b-94a0-620f937354f2", "value": "T1CCA2D028E3456EF4DFEF9D9092C1C2C276F547C6278AC8E240EEAF01750A056FB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720367, "uuid": "79e1a1c1-9f10-491c-8096-366c9e6920a2", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C519PM4uVcqgw05VxJh:9RxsSVsMD6xiJJE5zRWNP9k4uVcqgw0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720367, "uuid": "8ca830cc-0d25-4bdd-9446-9e5cc725aff8", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720367, "uuid": "3556b65b-8307-4f99-b94d-5286c834839d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720367, "uuid": "58b96993-772d-4e7a-b25e-f173a1ec284d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4369879f-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774706766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706766, "uuid": "f4a62503-21ed-488e-a944-8f86debab041", "comment": "Malware payload (SheetRAT)", "value": "8b8dfbf08412bee00364ebd93ebbe15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706766, "uuid": "668480e8-edbe-4a2c-9b86-5b26575633dc", "comment": "Malware payload (SheetRAT)", "value": "84108e806e5ed5c95697325aced793aa8374c624bced23c77dcfb5d79686c83a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706766, "uuid": "e19b0a7c-7c1b-4223-a7ab-1573cfafc308", "comment": "Malware payload (SheetRAT)", "value": "73c72db3e9097c5797bcb1dd249273bc9a75050d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706766, "uuid": "9fc591c2-8c00-430b-9643-e43ebf6e181c", "comment": "Malware payload (SheetRAT)", "value": "06e5794098f4744d4b143672ada0414fe9009682a06f49ed7c21a4ba5ea2367c24772806e3eb90306fc0369a49ce97b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706766, "uuid": "89e3deb3-cda6-4568-bac2-95e81c89acc1", "value": "T19D25237737E9B368C9FC17BD84962B0A47AAC4552F352EDADC19B25163E364A810CBC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706766, "uuid": "67fc306b-d76b-45a9-8d05-11091f380a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706766, "uuid": "31dc5b06-4a27-4294-850a-820a7be67056", "value": "24576:0+83+bnfnokQo2psU3mLEkse/3OecmadawAEz2usMJzyqc/:09Wnfn3bUbmaIwhzFyqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706766, "uuid": "5584b5e6-f4b7-4fdb-89d0-523d2f019f8a", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706766, "uuid": "4baf6c99-e893-485a-863e-43ef68697f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706766, "uuid": "a53551c3-5e8c-4fd5-8047-0305dc8040b3", "value": "Optimizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec64ebf-2ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774731776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731776, "uuid": "a5850e3d-ce24-4ec7-bf8f-3db50d8b6a98", "comment": "Malware payload (RustyStealer)", "value": "7e7193cc48c6de37a399218529246ea2", "object_relation": "md5", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731776, "uuid": "bd056e14-c7f7-483c-80ce-8c97b745349a", "comment": "Malware payload (RustyStealer)", "value": "8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df", "object_relation": "sha256", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731776, "uuid": "4a18f842-b80b-43f5-b049-d177ec92314f", "comment": "Malware payload (RustyStealer)", "value": "541091b3d1dfa4fbfd7a1c03b3ebdc9abf07c07f", "object_relation": "sha1", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731776, "uuid": "99d961bd-1651-4c19-9cd6-923987d281cc", "comment": "Malware payload (RustyStealer)", "value": "f5abceaf20ef5c63c9b84211c4ee05c7fc8b35e638e4a2fe9479760c5323d7846bc6d7f605071f5e6bbe06819cadfe2f", "object_relation": "sha3-384", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731776, "uuid": "245c279e-7c50-458b-81dc-fa656de0b92a", "value": "T145F733D9917502F3D3398F38D30808D6095BBE352A595DEB2AA6331B5503CDBBEB4C89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731776, "uuid": "4b4469f0-203f-47bb-b87c-0a2007a9f585", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731776, "uuid": "cd901ab5-3123-4880-9cc4-16550e98ac73", "value": "1572864:LswyBODMEgUINiCmpYmHIgVG1SF4JelKb2mk86MqadkLmX8MCE:L/yBCGbNxmKmHZVQrJe22k6MXqLra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774731776, "uuid": "f9443fa8-b3a8-4e19-9097-22c6a709b022", "value": 74603772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774731776, "uuid": "a217464c-3603-4aa6-84db-51427f890cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731776, "uuid": "73427638-0c57-46e5-9d3c-e1cf8b6f8f46", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1ba0a5-2a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774671961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671961, "uuid": "aeadedfe-22f5-4a4e-909f-497a9fba8838", "comment": "Malware payload (Mirai)", "value": "320530a75afb8af64549b7c69e4536ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671961, "uuid": "ac0479b3-ff3c-48fc-8fd3-59e56f469104", "comment": "Malware payload (Mirai)", "value": "84783a9fc4a17cdb2e679ce3c4b13507450b5d35e46ccb59e17e6b8972d3a638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671961, "uuid": "a90d34f8-7e39-4a33-9eb9-f025e9b4bbcf", "comment": "Malware payload (Mirai)", "value": "bf34b347cee7a4f44adc52c9898cd08e9e4d3bce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671961, "uuid": "2b55411b-4f66-44e7-ac6f-a60e85f28f92", "comment": "Malware payload (Mirai)", "value": "b60fadf74c77785a92ee77c161cdead8911fa7adeddbb7c1c29218a5b8830fcf775f432455012359d35ec695cdd80e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671961, "uuid": "9f93b44a-5a65-43bf-9d96-c57c2c971918", "value": "T195E329C7F900EAFAF80AE73744534909B130B7A149925A377257397BED3A0D84477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671961, "uuid": "f03b100a-a7bb-4b64-a040-f4bc6982e287", "value": "3072:Ij+5hRZSZlujHP64R4iQ3ymwFf0fbQSKVajbi1L57GnyP1py:LhuB5iQCmXjQSoL5IyPjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671961, "uuid": "b79fcdf1-8d06-469f-89f8-c48d904983a9", "value": 154444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671961, "uuid": "cb1018c3-848f-4498-b26e-dfcb892af215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671961, "uuid": "b9eeadd0-557a-4b3a-9fc5-d445761859b7", "value": "acppid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5729326-2a7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774684623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684623, "uuid": "dbf25294-92f4-4da0-b09b-46d446981d20", "comment": "Malware payload", "value": "6ee5e18357dfdd5934b9ba7600d6e62b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684623, "uuid": "e2b5f461-8ebc-4a09-ac97-ef40ac3a5982", "comment": "Malware payload", "value": "84f41ea0816b650a5311de96281f2921e6e13c41f2d6d0528367362cad986f4d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684623, "uuid": "07d65906-a4b8-40fe-9ee7-3ed2704b9075", "comment": "Malware payload", "value": "47bf842fd83ef47714fe3786b8b471ec12e5fb88", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684623, "uuid": "e7e0012c-e330-4968-84fd-3b88fe8c6dd2", "comment": "Malware payload", "value": "efd63a8c4845dcb3336858ecfb42d1e71211dc5d7c295f547db17383a95291392a0fa4c5597d1eb93abbff2234c86d8a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774684623, "uuid": "1422f422-9b0e-4f10-bc56-79429f452ba3", "value": "T196D0233973D7E35D06064775D0345C19CD01D40855288E8172E54C0BCF1113CD21469D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774684623, "uuid": "d9a0188d-493e-4838-a8b8-f8a6e81acd24", "value": "3:pFAzXbJJFIShsTY7CM8beSEetmAOBbAVWLczhYJC1Ke0GgEfVv+GabM7pJwJJFIN:pFw98SAYV8bNEFcOzelfVib4J88wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774684623, "uuid": "0dc5c36b-f5ec-4248-a222-2dce623c9603", "value": 201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774684623, "uuid": "64edb09b-cb8c-4640-af16-423fedbaec26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774684623, "uuid": "a107292b-8370-4e04-855d-76057c573059", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377a3621-2a54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774667662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667662, "uuid": "deaa9f82-4df4-4e1e-9206-d5bd465fd814", "comment": "Malware payload (Mirai)", "value": "f5e6215a0fdaa4438849cb8a9d243d3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667662, "uuid": "db736e55-0046-47e0-9876-3aa05ec9e81d", "comment": "Malware payload (Mirai)", "value": "852dd373631acd9208ef126ae206a127cba84a359f8791610ea76a4655c8ce7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667662, "uuid": "c7416be9-1aee-4b6d-8c06-b41f34e752bc", "comment": "Malware payload (Mirai)", "value": "784f749129e166deab0fd0283f0d3b938b8c3403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667662, "uuid": "6588483f-0671-45b1-baee-4883ef4471f9", "comment": "Malware payload (Mirai)", "value": "b76506b1208a36220a2fdff6de81e92da22a3c2552ba630056df5eac181f25cb3f66dc855282718558217dc25b5c20e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667662, "uuid": "0fe54fa0-e19a-48d0-bf91-55ae99691c57", "value": "T1EBF2D8A2B7B9172BC4E0637854B26703349A6FE404B4C74FBD540D5E6BD63D0AA27BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667662, "uuid": "6c864f5d-90d1-4ed3-b713-6d42ec194a38", "value": "768:MUEAg7UMJNQwutJJlQQMb4361KLjXJ9p7JVJH4TwMIZ6D:VHg3kwutnlQQMm7Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774667662, "uuid": "c973e765-1dff-4fda-8bb3-9ad2ab755e75", "value": 35908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774667662, "uuid": "1718b6ef-e159-435b-ab0b-f3625bd98687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667662, "uuid": "57af7693-53d5-4984-b8ec-83b870e74bb2", "value": "attd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7094daee-2ab7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774710278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710278, "uuid": "3e1dfd6a-5861-41c6-9b8f-855d02f6fdd4", "comment": "Malware payload", "value": "8739d52c8f7dea142551d0f1b1c9b9da", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710278, "uuid": "e3c76248-906c-4e50-8d3e-5d9b91dfe9c5", "comment": "Malware payload", "value": "8571603d2099587d1b91b732695bc025a7fa3c2a6303b8472e6e390944e4f3e8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710278, "uuid": "14e8de49-96e8-4ce2-98a9-025986a2754f", "comment": "Malware payload", "value": "ec267927a0e8aa4f404bcb80af333a5bb8f6991e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710278, "uuid": "6f27214d-7206-484b-ae19-f553e6d6f054", "comment": "Malware payload", "value": "efc5785f0dc67d7b8e76cf511e54a8b524f1080f79eb526d40d370f007bdd3e3163f8c9ada18307c4530a8ed5036ddb8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710278, "uuid": "df99666d-7bcd-4314-b558-eb28fee43b4f", "value": "T1D58633A1547032531D470F93A49FD9EE6ACB9AC36A6E6CCC34036C14F06D287EEDE265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710278, "uuid": "4b9d18c8-80da-4417-8e26-56642d89e77b", "value": "196608:JNADWqDzVoHVmNEeI8CgcfsBJn3x4F0m+:JNAaq9IsI86kJ3xwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774710278, "uuid": "aa89d910-628b-4307-844a-b5374388e3a0", "value": 8434434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774710278, "uuid": "13a0011e-cedf-43af-81de-585a12e3b88b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710278, "uuid": "0c349125-e605-4d02-b4f5-0eca361d8b3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814a8e24-2af5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774736934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736934, "uuid": "710c5699-a4a2-4de2-8d6f-603f27947ba9", "comment": "Malware payload", "value": "6bad21c34ec5dff3ba31c7ae387ee07c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736934, "uuid": "521c30cf-7b3f-48f3-9d3d-e73444ad6e6d", "comment": "Malware payload", "value": "88775d9733d62cb2c16aeaee6862fc8af44c8b5afa389c6d91f14c6b90256981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736934, "uuid": "d4820797-a1a0-4ec2-bafc-d62e861a2cfd", "comment": "Malware payload", "value": "f7fae9bb30b2dce72f7d425e1bc4bf0088b9c3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774736934, "uuid": "5a4bf2df-4c66-467b-a5db-cc9129863d5c", "comment": "Malware payload", "value": "433e78d2833c34f17b0d627513641a252d89f6422fceb8b8bd462e98aed1fc0c464570e42b2fdfd360bcd86ee2a61dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774736934, "uuid": "a5e6011f-4dc8-4b6f-81bd-6a0e47f2719e", "value": "T18B36FA15AD812B66C2DC137845EE675622503E499B95072323A8FBF83E3733DAF5788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774736934, "uuid": "fa10810e-9f3d-4a46-8bcf-f32e090c3923", "value": "49152:VmvdLv7slfUSjixN0AuL4l/EZlWSfJjdj11:V+7EfUS9Jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774736934, "uuid": "fbeb7a48-5e59-4424-b0ab-51e519091e26", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774736934, "uuid": "0630077d-d429-4c46-be6f-07e45078f438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774736934, "uuid": "efb93884-87c5-4ebb-9470-18350082f07a", "value": "linux_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4c4852-2ac1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774714490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714490, "uuid": "89e3947d-c099-437c-84ed-dfb2bcdd0949", "comment": "Malware payload (Mirai)", "value": "fb44db2cda2b81e34d334106f6d384b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714490, "uuid": "ea894c46-1a05-432f-ab7c-ccd9aa4b2876", "comment": "Malware payload (Mirai)", "value": "8a0c64eec3fb3f765dde08d95879d9efed9d47de1d8ec286137104ab6028fa72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714490, "uuid": "4ebd1a65-7af4-4603-9e99-d6d28344d3de", "comment": "Malware payload (Mirai)", "value": "47f2835b6104c066be5094ad7a07c7490385c628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714490, "uuid": "1a700e6c-216e-499c-87be-c33e555947b9", "comment": "Malware payload (Mirai)", "value": "1f709a01eee45e48ca8d88a1a2300ce1466045454a78abde8188c986b42b85a4e1ddf8edf2d9245605a7d212361c578e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714490, "uuid": "731c3d57-3714-4529-8f59-4d27517e3efc", "value": "T11DD32917B88080FDC8E9D1784BEEA136D933B46D1239711F27D9BA366E5DE201F6D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714490, "uuid": "eeff89b3-f6cb-4979-8cdd-739160c57747", "value": "1536:7Z337aNz6D4HUMdPRx25dlSqD6heqZhWkJhIrIRS0sifV3e3rOAi:7ZH7EnHUgx2zv6gChWkJrRS0rt3irO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774714490, "uuid": "9a77673d-650f-4f8c-b52e-8f919b5f4687", "value": 134936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774714490, "uuid": "7242478e-fc39-40af-a51a-0519f47b3b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714490, "uuid": "db1d7e5a-9edd-4c09-b196-d46a63e848ad", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e183116-2aa6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774702945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774702945, "uuid": "db88b589-e6f0-406c-8204-d9818ea8b5f4", "comment": "Malware payload", "value": "b6801592c80ca7a37da547a13376d6d6", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774702945, "uuid": "ce1e7282-7211-48c4-bae5-765eb4a1c99c", "comment": "Malware payload", "value": "8b745bc6bc088fb106cea5d5a467a1efda6ea5a085e1733f17bd54b0f54d34f0", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774702945, "uuid": "e5c9570c-6aa9-4275-97bf-1c3cf0125f56", "comment": "Malware payload", "value": "aa36b1ba7f74fdad2468f0fed4ab01820e304479", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774702945, "uuid": "4a36b612-3f8a-4b81-a183-ed7733d6a692", "comment": "Malware payload", "value": "10265ab8def222111409c59a0e10d73e3882fcaaf41020308532888b1641ea84d9605dc6f18343683abfd93feea50740", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774702945, "uuid": "151b5ac0-75ac-4684-b749-15a839428e5b", "value": "T1ABE4231CD6199D62E7ADC8FF2B452E332D8C0F3CBE81922E3E24571E664A0907D59772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774702945, "uuid": "c621a9fd-e788-45ae-95f0-866285ac58cc", "value": "12288:MX0jdQcmkqAqmoOC0NXVBfEbt+hYhyYaI/UMWpykngYDzlGxQFFuInJ3U:MXkdQcc6NX8hH+/lVFACU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774702945, "uuid": "1f7d568c-36fd-433b-83b4-fe903bd3c374", "value": 697868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774702945, "uuid": "41be311f-c8a8-4e5c-b2de-b106ebdbfa9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774702945, "uuid": "9aa335c4-6e06-4fdf-8dc8-52eef257f3ce", "value": "kek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7088e2b-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729723, "uuid": "583d15ed-1d0f-43c1-9be5-437e782c272a", "comment": "Malware payload", "value": "9a64444f9e1152deb8038455f4214e16", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729723, "uuid": "1c3f80e1-7b8a-47bd-9d65-02a8a9fe082d", "comment": "Malware payload", "value": "8c074302c958da156585c02265d99c984b79998ca87ae20bdea4710056bcfe21", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729723, "uuid": "0f745476-b39c-4e11-820b-0196f7679fce", "comment": "Malware payload", "value": "0ee4c214cdfe4e4d30697002e3c64f9526bd9105", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729723, "uuid": "b4cc3cc6-fba5-46ac-beff-600fb257356c", "comment": "Malware payload", "value": "ac302d586921ee439259d1f84a0790b4f65c0ddc44768ffb3dc4d7c1470067985cd53d3714b03a18642ab50045e3f39c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "foot-trxzidan-icu", "colour": "#1D8456", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729723, "uuid": "d1923aa1-6864-4eef-ab1b-beedca68c508", "value": "T1B936AF32F942A431DDF210F3E3F60ABA456B7C546F25A0D3648C78E696326D315FA28D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729723, "uuid": "b6235e37-f0bf-47fa-bfb3-22dd43af2535", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729723, "uuid": "c0cc8ac1-a5c0-410d-b608-af1e098919a9", "value": "98304:80k51GxhiehH7MZcniemHCvEicSGa78OVDWPFrvL:8LPIUZVsEicSjn1WPFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729723, "uuid": "87a7554d-b8c1-4648-a2da-24367186806e", "value": 5344256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729723, "uuid": "fd93b34f-eb0f-4a84-9de5-73dca12e56ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729723, "uuid": "ca249edf-c147-45df-8883-bcee16a46e86", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855e178c-2ab7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774710313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710313, "uuid": "fbf4a030-5866-42cd-b28e-75b7c5020d38", "comment": "Malware payload", "value": "1d5e3cd52477fec95153e5f2cb6e0d76", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710313, "uuid": "d2031ea1-c443-4c30-b802-c6c20b881aa7", "comment": "Malware payload", "value": "8df3a4da6e7a020cf344c9b7a4696fb35792e460a85b8e9189244ac396966421", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710313, "uuid": "63036c54-ab02-4fd1-95c4-3c4694d57aa1", "comment": "Malware payload", "value": "4db458355298267888d55b4f7f3d3d44a3ac048c", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710313, "uuid": "37641f7e-6f97-47da-b526-9fd001ddc69d", "comment": "Malware payload", "value": "247a78ea105e66ecd1213538fef4863b55de89429baf9288e55f59968e43b073a4198fba784bce86998f9de0606c0b7d", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710313, "uuid": "2ce22a2a-0aae-4697-8a80-0644df89149a", "value": "T1BEE21304BAEC1255F1B65A39D5B02B49957BFB3AEBA2C31C0164F45C29B9620CD3873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710313, "uuid": "ca584b19-2d09-4722-8d44-6340171e32dd", "value": "48:DI24Vznz55NC2dRPazXm/xvBPazXmjPAPxjIplcl/x6o/Gw0vBo/kt:cxzz9xizoxvBiz44Pxjj635vBtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774710313, "uuid": "d34c56d9-a6c9-48e4-9e47-094730bfc556", "value": 33055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774710313, "uuid": "e12b1681-f339-44d6-95ae-9fd0eaa85903", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710313, "uuid": "72bec9ca-52fd-4bee-90ce-b244437d30be", "value": "\u041f\u0440\u0438\u043c\u0456\u0442\u043a\u0438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe516f5-2aef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774734570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734570, "uuid": "04df32c5-0b58-4a19-ac5e-bfb593bb6c24", "comment": "Malware payload", "value": "142beade804a15a25c0ccd357bfc2052", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734570, "uuid": "7d18819d-ef80-4a88-a858-fd8df077de15", "comment": "Malware payload", "value": "8f625abaa5df8ca0116bcb79ca0fc875a6e4a2bf2a97c3930815f2cd8a6b6f89", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734570, "uuid": "b4913388-0fcd-42a3-b386-b31248df1b0e", "comment": "Malware payload", "value": "4b8b80673b733f18a4339b5ccf7badf2220e21c7", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734570, "uuid": "997a751e-4006-4632-abe0-7f421725b010", "comment": "Malware payload", "value": "f4aee3750c4bb67d1bf7cfb147a7f71c8220fb2a8d83df894b89ab53020dba0428efdaeaff998f4154279e999101a81f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734570, "uuid": "21dda81b-cdd1-4b2f-8170-60cc78009006", "value": "T193D30E8B4A8E84ECC74F6026C91F5E138F4E5717261ED5A17F9EBD802F26D70B06A9D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734570, "uuid": "a76829cf-159a-45b7-9af2-bdb6092286db", "value": "3072:eTQMQKIf4Gi92GsqP9nX4iKzOBBr5CoD4xFQvQdRjE/CrTaIrys8BSFsIV3jECL0:eTrhbLwA8I7oTbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774734570, "uuid": "9c565641-b281-41da-8634-1799695c4d4e", "value": 138510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774734570, "uuid": "b07adb6c-2942-4220-98a6-439e2231cff2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734570, "uuid": "0bf81a5c-1b65-4aa1-be32-db69a767b9d3", "value": "Journal_Monthly_v3.2.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048bd2fc-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720404, "uuid": "3a3d4748-7e93-4d3d-ad9f-1203ff38b6d7", "comment": "Malware payload (Mirai)", "value": "eaacecf4e6fd11a0aa2fac4a840b365c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720404, "uuid": "04761919-6525-4c9b-bf00-cbce93c29cba", "comment": "Malware payload (Mirai)", "value": "90cd250adf1a77514a261c8146090c778403e3e6dfff9c5087519e69b08c4c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720404, "uuid": "2d6bfc58-9c8c-4982-a499-5abf3d7d035d", "comment": "Malware payload (Mirai)", "value": "38e3f942dfe5800f710c25649f55df79d6526d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720404, "uuid": "372999e3-7e40-4223-a055-a122970413a9", "comment": "Malware payload (Mirai)", "value": "6d80a097ac91129d332dd3b801e8db865fb170b7c221a2ef933e8b8b8576570f14b9e64f8766c987eed96771cd23d542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720404, "uuid": "5cd2b4b5-2e5e-4119-8a96-6004bb5dd8c8", "value": "T11D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720404, "uuid": "d71a1876-e543-4871-bbe1-45a11a3cf35d", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStZ:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720404, "uuid": "6df02ce2-1d51-488f-bfff-ab725f9c1c3b", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720404, "uuid": "40211673-bd16-4dc5-a954-9a465484679b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720404, "uuid": "d36fced2-7af8-42a0-9258-d4157fcc97ff", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1eba878-2a54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774667867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667867, "uuid": "405b43eb-f159-4710-9d7c-4a56a43bd540", "comment": "Malware payload (Mirai)", "value": "276e792e22f7d43ce2cb64493ae2755e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667867, "uuid": "b0b359ed-789a-473d-b3a1-161b7b9e6b1f", "comment": "Malware payload (Mirai)", "value": "914c5c2be9f5018f420b45ca9dca107f5159a85de66d51b1cdc8c44ec1265dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667867, "uuid": "3ebc3d69-ab8b-483f-bf88-e2ab295f92d2", "comment": "Malware payload (Mirai)", "value": "de2283dec5e0a72bdc2530e7309da9e35f3932cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667867, "uuid": "42b31463-c5bc-4610-9a06-cfb6d2b3cac7", "comment": "Malware payload (Mirai)", "value": "df8624257eef39b865f9d7770d3490aed107314c5e555bcf5777f820c6572d69012f8b5eaf2edbd7283b63e84cdbba12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667867, "uuid": "ec094689-31d3-45a4-893c-a99426673171", "value": "T199C35AB3DC662E6CD616D4B8B0B48F7A2B53996092871FFE156BC2B08043D8DF5057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667867, "uuid": "3eb7dbb1-dc5e-405a-a34c-417f863f8d0f", "value": "1536:Klocd7K0tYGYYIzqPFkCrKfj7/23BN4hkgWyK3Qr0158xz8c:i3iGY7+PFkbfABW6gW/gr8Goc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774667867, "uuid": "751ed55e-b1f6-4286-83fa-b8a94cdcbcb3", "value": 119056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774667867, "uuid": "97e39e32-928f-4bc9-a15e-81921fca743b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667867, "uuid": "118a2036-8e6b-4a64-86ce-c2702c77d9dd", "value": "udevdpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329aaf0e-2ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774729501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729501, "uuid": "9c19f441-9255-43aa-b50b-d7bf8afa4a2a", "comment": "Malware payload (LummaStealer)", "value": "a18c4a0ae48fc46635f0c9087112521d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729501, "uuid": "2edd5e36-4178-484a-a874-b9588271a8f6", "comment": "Malware payload (LummaStealer)", "value": "9190047583e7e2e30a3f4cfdb946302ee4fa172583667e323285072adb92e18d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729501, "uuid": "521fe2fc-fc97-4c75-9299-7d75a40eba1d", "comment": "Malware payload (LummaStealer)", "value": "32c356c67ef0b8ec646a40ca692469c07e674a3f", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729501, "uuid": "bb4cc85d-adc1-4abd-8ee2-197508aa6254", "comment": "Malware payload (LummaStealer)", "value": "65eddaebb4f1210fe5677280d323286dff8ed40141b1437daea127594f90c778b0a165bd31af15b2044ebc4565246c65", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729501, "uuid": "a8bd3976-8902-44e8-8f57-d3d87d013b26", "value": "T1E4654A45EDC709B6E112133259BB62EF3335AC090F329AD7EA44763AF9776D21832316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729501, "uuid": "1e09d26a-943c-44a2-9175-26ad47f1e9c2", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729501, "uuid": "60595a5d-9204-4973-ad79-3e48e6dd2f60", "value": "24576:ZyQ+bIGSlwVIg/LetD9eKKTiWuOqHmHAA8Rz2aNLlK21i7GDYEIJIT+Vqb3cuVtG:ZDCPAgKKu15K21aGYEIJTkbsuab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729501, "uuid": "737c9436-73f0-45c9-b303-c2e87a80d200", "value": 1530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729501, "uuid": "dea6d865-9eac-4ed8-ab54-531c4fc29207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729501, "uuid": "57db80db-ced4-4053-902c-d1dd18b40428", "value": "cx-programmer 9.1 free download full_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7180e92-2ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774731924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731924, "uuid": "70e81111-955b-4271-b314-96c480f50d73", "comment": "Malware payload (RustyStealer)", "value": "13ab8cad9b39f5310223a3752ab62316", "object_relation": "md5", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731924, "uuid": "96fe48db-5d16-41aa-87aa-6d7df9000ebb", "comment": "Malware payload (RustyStealer)", "value": "92ad2bd320a490c54307dae1689df039c27fa122ffd2c68d52312ec8ac0a7224", "object_relation": "sha256", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731924, "uuid": "28e9aeb8-17b0-4a81-9938-69a3df93e8d0", "comment": "Malware payload (RustyStealer)", "value": "9e0ebb482b9f9d997e2d21d615e51218cf59d673", "object_relation": "sha1", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731924, "uuid": "f6c334ab-d994-4159-8fb7-e7ca96dc6740", "comment": "Malware payload (RustyStealer)", "value": "93539587570341a2c529181c67b5fb0ff9cc4d8d2c8b129bae982a4d8539a2e6bfb6d776cb789c83fe36df5c7caadfd1", "object_relation": "sha3-384", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731924, "uuid": "44c1f8d8-6601-40d6-a56f-c6b1c9a982d5", "value": "T12E66BE74325868F5E72F427FD9526CCD137226334396A8DE9274E3C22653AB5FF26808", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731924, "uuid": "aba52f27-1d8f-4d1c-8e70-dce7c29a3419", "value": "2f4d91ed3b24f3259ed13cc890451227", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731924, "uuid": "30608c0c-a84a-482d-9f60-58c418cc0c74", "value": "24576:ClovbTkkeHLB93hLAbxWLdv2B9XfrhxNHVkA6c33loB8fGiZBRbxbCNQl59Qj1ke:CIHkkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774731924, "uuid": "a565e292-51a9-4dd8-9f3e-4cfa767aecc9", "value": 7108272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774731924, "uuid": "b0689f3b-83fc-4722-9bab-7ce041adfd65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731924, "uuid": "2beda398-35d8-4598-8261-96e769ab2219", "value": "father5345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa8718-2ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729216, "uuid": "0e73d29b-f85b-4dc6-8200-3b4b5b7863b2", "comment": "Malware payload", "value": "e0dbd95b7f36bf8b393d329517b60f03", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729216, "uuid": "a4f72edd-7741-4e2e-884f-0230e7cc501b", "comment": "Malware payload", "value": "92d529b4cfb8f18306c982089662d9d44aae5deb9e4b3548908a83e5dbd56a2b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729216, "uuid": "d69e08d6-7c80-4ce9-80b7-ff1e60a12524", "comment": "Malware payload", "value": "4c478e471f7e0180a4ab6054d749fc6b9243f0ac", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729216, "uuid": "1fb094e9-dda0-4c45-b70f-7a0d657ef460", "comment": "Malware payload", "value": "c43816d7971eefea447823a697a55fcf93037dcc3e12e1f4e672e98f92644076758c4c3cf0550b5a714514b45b4b62dd", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729216, "uuid": "3b2540d8-63c2-4f1f-9e74-b0df5f087bcf", "value": "T1AF57338ECC8162B37F37C738707492D5E29DE6CBC5C78D2A9E6E024211D2BD97E19189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729216, "uuid": "52eab1ea-ae4a-4c34-8c21-4e27ef5c891f", "value": "786432:wXyNO5JujKptRrQOM/byZY70cWiLhAilvZzIM:S2UJCKptBm/ueBldJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729216, "uuid": "c05c7b76-28d4-4737-930f-3a4a44035e2b", "value": 28476899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729216, "uuid": "e4f26ad0-945f-43b1-9f39-260fcf085471", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729216, "uuid": "d4b7b9c9-6861-4ebb-b0ce-97e5c8f438dd", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83ffeb6-2a4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774663663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663663, "uuid": "3403f518-d299-4d4b-8ad8-f5d59b150a44", "comment": "Malware payload", "value": "1559dd5e1002e55dd0ebe4d3537206d2", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ti-pontapora-ms-gov-br", "colour": "#055A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663663, "uuid": "8de46134-2f71-42ac-90d7-e5489b1794df", "comment": "Malware payload", "value": "932620b4b6f1d2336b6bbb6e11ad85391cce459db49552dfeef86fb5504acf03", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ti-pontapora-ms-gov-br", "colour": "#055A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663663, "uuid": "b2dcd8bd-2d1a-4d5f-bcc7-16fa886cc653", "comment": "Malware payload", "value": "5a7f3d31f237e37875e187d95655f7b18c24e6ab", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ti-pontapora-ms-gov-br", "colour": "#055A5F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774663663, "uuid": "9f9372dd-f0ff-4558-9a1f-c32bfcb0e4df", "comment": "Malware payload", "value": "e751c284568605a469492c0bb76f392865bf448211edb4fc543723beb7b84ae4eee8a056e86c4e5f21f72aa05658fe42", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ti-pontapora-ms-gov-br", "colour": "#055A5F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663663, "uuid": "043685df-4885-464b-b2d2-49973b378d5a", "value": "T142F7333BE18F6039C0AA127925B3D920897F296164625C276AECF8DCCF250755E3F6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663663, "uuid": "2904cabd-0289-4483-ba2d-875dd790f489", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663663, "uuid": "dda434c2-1647-4c5c-8f90-ea99b8ee800c", "value": "1572864:gibp32FzeZjKmqyQvJOhcnU3LODgOlh2C5xIkLi:AFCWm4hG4U3L3OOoLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774663663, "uuid": "4810b6c0-3abb-408d-ad20-c67e78a19dab", "value": 71704640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774663663, "uuid": "dbbbcd1b-c70d-4030-8889-1c68135f2cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774663663, "uuid": "76b38b0c-80a3-4b1c-9557-00350e41deb4", "value": "932620b4b6f1d2336b6bbb6e11ad85391cce459db49552dfeef86fb5504acf03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ed342d-2aae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774706421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706421, "uuid": "a0c0de95-eb31-4016-bc91-6dd9a7d1f1a6", "comment": "Malware payload", "value": "6c2a3cc76a09b273cf67eade99082b1a", "object_relation": "md5", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706421, "uuid": "2e892f65-1f51-45c6-be07-ba6607f773bd", "comment": "Malware payload", "value": "9432a23723d9d6d93e8d7fdd5fa8b5270e73caffa7f00b8e2b276ab09ab8b4cd", "object_relation": "sha256", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706421, "uuid": "447d4ec9-4cd8-412d-ad7e-bf50a698dcd4", "comment": "Malware payload", "value": "1d39261fc32d2b3191ab9d3f25480bb59049d9f8", "object_relation": "sha1", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706421, "uuid": "2c9aa5fb-563f-481c-82ee-c2ad13bb268b", "comment": "Malware payload", "value": "f456e31c0f578abeca3bad5ccbe8c2465df8a4c1fa447a775cc54c2d4b382e063d353eb9f36f2e0f502243acac1f1b5b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSword", "colour": "#08D553", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706421, "uuid": "32a36351-7279-4ccf-a6fc-2047a6ae338a", "value": "T19B13A7095E3516824273B36FDF5FE418E87AB127B084A7897E4CD6101FFA484D987EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706421, "uuid": "53a91c61-3e3c-455e-bc96-68fd8afef5c6", "value": "768:lTIMBgnwQWFhXYzr/5/f2cJrbkj7hCiMsjnirwbmcF6kMfKedCkMLiLEh:uMBgnwQWFhozrx/f2ErboCiMsjnirwbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706421, "uuid": "f1353151-b6cb-4ca5-8c47-bd1efbd47f2a", "value": 44148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706421, "uuid": "72b3f329-048a-433e-9591-1d3dc599df30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706421, "uuid": "98051767-e61f-4725-8751-5ae08fb50734", "value": "worker.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6fc71b-2aec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774733141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733141, "uuid": "ec7b32e9-0dac-4228-a176-3803aee4e545", "comment": "Malware payload", "value": "0020d3c502902efc0aa97d69e7d4b3bf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733141, "uuid": "435caa9d-1211-4a90-b07d-f0b790948eec", "comment": "Malware payload", "value": "95d82512226263464d5e5378d026a402ec638043e3f3a32f44bb3e291ba3fc72", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733141, "uuid": "9d02b337-8e0f-4504-bca5-8e23bfacdcbc", "comment": "Malware payload", "value": "1f1d613e55a7fdbf59cfbd8e3b8939535746a798", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733141, "uuid": "006e9113-3a93-489f-8e8f-127b36d4bcec", "comment": "Malware payload", "value": "b01e5e7c0b22fc7295995e6f26147d36bad21297a5e3fc78ca03534c7a49013d57151ccff98a3cf5b40dfad5805c7653", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733141, "uuid": "8ae75f18-43dd-4965-a53a-ffa4d9dd053c", "value": "T11D139C10E6A0C477E5F203721D362B6B9FFA992616A45B0B43902F1D3D63AC3CA1F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733141, "uuid": "67551b3b-efd8-4fed-874f-f98e7b06c18d", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733141, "uuid": "bc7dc77e-2bbe-4e30-970b-52aa454789d9", "value": "768:zmnC/TPHQe06jEqUN+noI4+EuGUPPBNaznWDKmZCX0s0D3w9ipGeuGpaSl1pe6Q:zT4HrN+noJHCq0Zs0s0DAVeuGpR1pHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774733141, "uuid": "9c0a9b9b-f8eb-4ec5-8ed5-6e301c2f5945", "value": 44774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774733141, "uuid": "6f327341-a61b-49f7-8dbe-eb490373b316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733141, "uuid": "a3cc614a-4363-4c8b-a41d-806872dacaca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b36a1fe-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681868, "uuid": "bc1dc333-cf35-4c13-ad1e-5772ba2f7917", "comment": "Malware payload (Mirai)", "value": "2c7d9a3eb5492decca304d75e5a233ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681868, "uuid": "8b927e10-85f6-4047-b579-eeb54f6f28c7", "comment": "Malware payload (Mirai)", "value": "962b3b3843cf7519d82f748d09ddbc63817ddc23418211281913fb25b54b391a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681868, "uuid": "270d50d2-0d1b-4e83-ac07-9eb8dafd83ab", "comment": "Malware payload (Mirai)", "value": "41cddda57d3491fad8a06f00940a2caa61478153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681868, "uuid": "7c2821a9-097e-43fb-935e-e03f1eb866f9", "comment": "Malware payload (Mirai)", "value": "b33ec5cabe7d5746adcc643021a03a33f0d16994940539176fb61005c6091f88dceee905f423b0c0ece662b76532ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681868, "uuid": "5c5a9660-5036-4508-9c9b-284c0751aed5", "value": "T18E730746BC929A23C6D423BBFA2E11CD332573A8E1EE3207DD116F14378A92E0D77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681868, "uuid": "a489fe15-326e-453a-bbb2-97cb927023de", "value": "1536:Y/68BmgyP4Z1695AW15QNBp8Wf21ykhmhpeywJ:Y//mgyPgymNLuUThpe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681868, "uuid": "76d01137-28f4-4f2a-ac0e-3d5acb48cb49", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681868, "uuid": "bfc32418-cd85-424b-9790-96df7091a6ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681868, "uuid": "9e443193-8347-4dcf-bf4d-ecc00ffc7ab7", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e8c22c-2a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774667443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667443, "uuid": "021d1fc2-96db-4a58-be28-1d27cdc7c50b", "comment": "Malware payload (Mirai)", "value": "b82a7a7d65412a7a47fde7f20cd63e34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667443, "uuid": "99b369c9-b006-4e00-983c-594dc0c40fd0", "comment": "Malware payload (Mirai)", "value": "994438a3a3a7db851dcff7b27d1fabd9922e3dd3d5c092abff4b4424d197371b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667443, "uuid": "f39c92a1-13ed-4d52-b376-8ad0dfa0f43f", "comment": "Malware payload (Mirai)", "value": "add958da0cbf30b8c727776bc3208f9486a7c29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667443, "uuid": "f099edc6-ebfa-4a9e-a9aa-263108b6d25c", "comment": "Malware payload (Mirai)", "value": "de1bdacac32ead9d9c6918f4669129a412a0d14446ce2865eb5e004228ba4a8febd3608f82377a0766b506001fc49a40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667443, "uuid": "9237e961-d26d-4cdb-8aa8-550a3ca1d5fe", "value": "T1C3E20896B4E19A6FC4C4133A775A061D3756A3F4D3DF3B03DE496E42318E62ACA36D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667443, "uuid": "ed3c2217-5293-4929-8b8d-e5523946ee53", "value": "768:9kGUWpnTfphJSPIehXHu9M1LoLRESc4M6dK1JKmzGn:7n7pTKI8XHu9M1Qjc4NdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774667443, "uuid": "18743801-66d3-4360-b0be-62ae96256871", "value": 31648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774667443, "uuid": "8e6a35a1-ffd3-4b5e-ae98-9564d0c1f9dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667443, "uuid": "51a24dce-93eb-460f-9498-cfae9011cb56", "value": "dbsu-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e8cb59-2a40-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1774659252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659252, "uuid": "7bdb3ca4-6d7d-442a-bb08-59c604cf2691", "comment": "Malware payload (GCleaner)", "value": "3b525d2ce830c562641b1bf28f7b223d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659252, "uuid": "6869c33f-fe5b-4c7a-a7cd-f18932f04423", "comment": "Malware payload (GCleaner)", "value": "9a0e440840c77c7858f15f99a59bbb121d59ea65c9832aa7bd2aa0c62acf7d86", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659252, "uuid": "bf8745e5-16bc-4ddc-8783-e48842c62669", "comment": "Malware payload (GCleaner)", "value": "b667fea9547e753b33cd6541e9433e5bb0ef74de", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659252, "uuid": "9999ba30-e4dc-47b3-b030-e177ea5a484e", "comment": "Malware payload (GCleaner)", "value": "d6f04ad43f8ef6c535f594c694a2217b400ff6a046bce690d11e7508019f0002b1aea8a771d346d8f9c4885be0962161", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "logger.file", "colour": "#A68073", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659252, "uuid": "526e88dc-525d-43a2-9167-e3a5ee3846f3", "value": "T134627BB388646C46DE1BED30B5C4C927FE72B2916DC1C1DB2249C9404BA07C77BDE1A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659252, "uuid": "8b95d65c-2ab7-4836-be65-656ad99b122b", "value": "e13d1ae0a2d96c4ad22442e33bfbb444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659252, "uuid": "96615817-e266-4813-804a-b299bb08d942", "value": "192:o3D5r8DbnPb7MM6epPqidfx4ULc8pq8RuwdmL4pUQrNyrnkrHe:o3DZ8HD5dfjy8RbmL4nNyr4He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774659252, "uuid": "7520db1e-57ac-4090-bc31-01eea5fcd88d", "value": 15000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774659252, "uuid": "ef09211e-84fc-476e-a131-320dab6f9fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659252, "uuid": "e296c9ed-5925-48ba-a0c0-c9f2541eb251", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b1e641-2af1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774735380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735380, "uuid": "fc83d9d3-ddb1-4505-a527-62d895b1d9b5", "comment": "Malware payload", "value": "01949a9d48dcae488e340033a85c8df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735380, "uuid": "4244a7bd-5fd4-4173-9e8f-dc53f14d3c08", "comment": "Malware payload", "value": "9a8267ee382a67b7f05fce31664d3774e8ff827b37eff2974111975e37d7ba24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735380, "uuid": "050fc80b-cfd7-4a45-9028-da1839b3c66e", "comment": "Malware payload", "value": "ef72ccf3e60f4189aba871a316394db437a32e8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735380, "uuid": "c7a99f7d-2792-4364-bd50-138b63ff8c26", "comment": "Malware payload", "value": "8b3cc59b761067399f76b2769e55aae5f240aa4b1de96f8d7f13b7e417786f6add101bac4d6bca1dcd1c1f6334c66ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735380, "uuid": "924febcd-80c5-487a-a89e-bcf4bbe883f3", "value": "T163165C95FC2DB452E9E87DB83F2602947139FD889F81C3176614FB9DA9F23148F22660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735380, "uuid": "23145a19-c60f-405c-9700-608d30a74142", "value": "49152:qxLcp2PMSjPnYxD4YuUsXoqR5ELkMO029tz1V:Acp2PMS4/uUsXogEuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774735380, "uuid": "c2fe990e-eee8-4581-9763-158df7ab78b4", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774735380, "uuid": "6c93628a-5394-47f4-826e-b38d77fdcc0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735380, "uuid": "712296bb-0d45-4b87-addd-7bfd92b9fddc", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e4bb28-2a72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774680816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680816, "uuid": "5fde1dba-72d0-45ed-80b3-a3c66b719c2f", "comment": "Malware payload (Mirai)", "value": "89eb77c91d70bdb6ef6bdff0abf7c1d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680816, "uuid": "173fb84b-9e52-428b-b306-9df2267e7fc3", "comment": "Malware payload (Mirai)", "value": "9dd949ced0093c610de5afd142bd711424c5c9ff73cb2d33bae87f4e60ae58c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680816, "uuid": "26703fdb-4e80-4dcc-a39d-949ec3ce0383", "comment": "Malware payload (Mirai)", "value": "5882db6c8b1ff7ce64647dcab61fbc6d0f888414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680816, "uuid": "b0c7c778-ccf8-4df2-a1c6-0a3d037182ad", "comment": "Malware payload (Mirai)", "value": "6c856c5390d0009ed3683b3abb234d76a81fedaa84b9f3a1739a119d91196947e3572bb8bfc4ab55320f85963aa5dbb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680816, "uuid": "6d4ea05c-aad2-4510-93e9-ee3ca8a4345c", "value": "T1C4D43955F880DFA2C6C12976F65D86A873174B79C3EB720689254B343BE786B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680816, "uuid": "1be3f3dd-f4d9-4514-bfe3-c46af79cbf25", "value": "12288:8DpY9o4Xztaco6Xtkm+gO92AIVynW+6gpkltah:EY9o4htZ+gK2AIonW/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774680816, "uuid": "1a190615-7495-4ff3-b233-c50a48fe85de", "value": 607568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774680816, "uuid": "0df78489-5ae9-491b-a3f4-f480e35533f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680816, "uuid": "9cef2aef-f650-4ea2-a430-4c070b1ff925", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c878d0-2aed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774733392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733392, "uuid": "5e86ff25-d79a-4d72-be81-be979aebf932", "comment": "Malware payload", "value": "0e8ea32b56f0859f9b7ff6bf0296bc80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733392, "uuid": "8697f7bf-4354-47b1-a24f-dc0f49d115e4", "comment": "Malware payload", "value": "9ef44beeee7c19cafa67ffeb622f1d636c040cdf0e1a4f53f4423046aaf502ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733392, "uuid": "2c26c8f6-2080-4184-bbfd-3ec5c88f3046", "comment": "Malware payload", "value": "94fe1428908f965c893ccd13cb914fd4485249d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774733392, "uuid": "3366ef82-41be-4753-ba0a-aa772f37c2a1", "comment": "Malware payload", "value": "eae9efbd51be010110cbed93f58a7c8aa5afc430d202add2e9341dadd14faa426f08f6892621773993770b4994df862a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733392, "uuid": "e210b060-7d9e-4b6e-80cc-8d28eca73688", "value": "T1F026D908BC842BAAC02C9B7894FBCE5523701D144AF55A366664FEE9B8762347F47CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733392, "uuid": "3fa8b052-618d-43cd-a64c-b1557b55d07b", "value": "24576:+gKaqN4CfxSUTlgo5y+A8H2AMvxcdl6Yl3RgGPHPOZWsi8U1lxd3BBzJddl5T1PK:+pxIo5y+A8H2AMKPhGZTi8U155T11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774733392, "uuid": "2bc88eb5-903c-4f74-aaac-8b24353afefa", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774733392, "uuid": "3eba908b-d650-499a-b778-4031237e8b18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774733392, "uuid": "31759cf8-9dc0-42b4-a1e2-63b3f0dfb835", "value": "linux_mipsel_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7768ad7f-2abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774712007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712007, "uuid": "9745e6bd-7342-4a68-9784-0c1e36120f4d", "comment": "Malware payload (Mirai)", "value": "847bde1b625150809eb72a22770e5470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712007, "uuid": "f4bf3724-ab4a-4455-aeab-11495d7e73ee", "comment": "Malware payload (Mirai)", "value": "a03f88de8b5800d21c4c6ba2e35441a32d5e185ca826e430ab8f9e2b9aa01b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712007, "uuid": "ec058df8-ec59-49ba-9ae2-cb19e7573daf", "comment": "Malware payload (Mirai)", "value": "8df91e7f4a49a13640ca4e011a9fa49271bdff0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712007, "uuid": "ff8aaef0-d997-4efe-b34d-cc8f0e61d9eb", "comment": "Malware payload (Mirai)", "value": "2597612e4bb24f26d54325ab7cee7bf7e835724b74c99abc13058f515da85e7606fe2937621c3d3fd38838a22bd535a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712007, "uuid": "79fcf0f0-0e8c-4211-a53a-f9003ba7afdd", "value": "T109E2189AB5E4C65FC1D41776675A416DB342A3F8D3DF3B07CE998A41328E21A8E3BC40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712007, "uuid": "a374c8c7-43f2-49a8-bfd4-fc6cbef98aca", "value": "768:wjan/aNogc6JvF/pUsuNrXQtck7AJ/ojnYCJMc7Hn33nH33Hn33nHrNYdCKmzGn:wjaniOgLN/CXNrXQttEJ21JbHn33nH3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774712007, "uuid": "9dd4c685-f354-4bb2-a4d7-231c04d24bd3", "value": 31312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774712007, "uuid": "99d36488-bb6b-4727-a5a1-1a1318e62a9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712007, "uuid": "2b78eb04-89f1-4d5d-89e1-2b11c4a3c420", "value": "dbsu-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba0bf53-2abf-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774713759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713759, "uuid": "49e00d74-c263-48b2-862a-67742f44715a", "comment": "Malware payload (RustyStealer)", "value": "49890004c195c9b5b802b69f7bcf9baf", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713759, "uuid": "c4135906-6a10-4f3d-9b3b-6ec1149675c2", "comment": "Malware payload (RustyStealer)", "value": "a05e91116924b22968c24301b793c8c3e02e490fb72c59b2503f8d35701ea627", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713759, "uuid": "fab6d0d1-4a5c-4ebd-9c36-8d3c7c881f21", "comment": "Malware payload (RustyStealer)", "value": "a3a28a4f7c440e58b408d99b866c5d6d45640be6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713759, "uuid": "c1d0911f-ddc1-4ac1-aa2d-43c4974e2e03", "comment": "Malware payload (RustyStealer)", "value": "4841e9c4196ae2814e8e326f159463fc211a95faf9005c00b43966ea3af7efa63fd120b671f067a2f1ce076be3cf89c4", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713759, "uuid": "3f203377-426d-4ccf-a38f-a5710369918f", "value": "T13A76BF78B218BCF7C72F423FC7951EDA53A21A5357A694CD6074A2C01A63279FE27C48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713759, "uuid": "1835112a-818c-481b-93a6-277f83bf1000", "value": "226327daa21813598299ecd94d82dd2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713759, "uuid": "d9e36024-5fa1-495d-943e-5125939fe23f", "value": "24576:aKiYL4pvpPB2aEE+8T+TGkuQCaIGQApEZYfK8gb52knj9NdJUcjKteKJJZJJEzU5:a3YL4pNBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774713759, "uuid": "792c4d79-f1e1-4d6c-b3e5-d1c0f568600d", "value": 7196856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774713759, "uuid": "7203e273-3d58-46c0-ac98-e7f017726109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713759, "uuid": "620439b8-9d10-454e-8848-6c5a9bdef520", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9699522f-2af1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774735252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735252, "uuid": "e031b4ab-254e-43ec-b3bc-d0eb0e3ab4a3", "comment": "Malware payload", "value": "9e8d5d16577cf244bcdcfdadc8a468b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735252, "uuid": "2be3fd0e-a762-4bd6-821e-30cd1e4414cb", "comment": "Malware payload", "value": "a079445d02a2f67598feac46a8def3985c2306bfc015d41810178523218caaa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735252, "uuid": "a3caf5d2-ee79-4f84-b163-6d79c5a91a6a", "comment": "Malware payload", "value": "32700451c4413c9431709de893f0fb21c6985bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774735252, "uuid": "4df42cd2-c29b-4414-9194-c310ccd05646", "comment": "Malware payload", "value": "c1a5173d801db4a10eb281480b74444328cb1287c94a79ee4063e0a8abce1043e456946019810b2b3db96532a8af8c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735252, "uuid": "0621963a-4228-44e4-8a39-7cc61de7f589", "value": "T1EE165B80B708D26AD99B0A368D270B7473542D42C6F4892F430EFB5F06B16EB5A1FED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735252, "uuid": "13792046-09cd-4767-ad4d-6f2cc574569f", "value": "49152:4hhPlcoJwP1683e2bBlLLUNKpdv3DqtHDNSV:4HPlcoJwP16LNUf2Zhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774735252, "uuid": "fa6a1599-beda-4695-8cb7-5c49214f8d24", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774735252, "uuid": "7f0703e3-c942-488c-951b-efddc2c52a88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774735252, "uuid": "655cdefc-3a20-4935-8791-d4ad50b98ae3", "value": "linux_ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de9ba6c-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774656586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656586, "uuid": "5adc13e4-a04d-44a2-a0f5-752721af0577", "comment": "Malware payload (SheetRAT)", "value": "7dabd1170aca6d9912dd231dcb097919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656586, "uuid": "5baafda7-ddec-484a-b256-7a83317bce86", "comment": "Malware payload (SheetRAT)", "value": "a28382be3bc2a5619e6787463416c182e88895eb93beb6264d324d4c48d0f597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656586, "uuid": "b84e7fff-0983-46e4-9e8a-f60e45abe5b5", "comment": "Malware payload (SheetRAT)", "value": "9940fe50f4e36dca8ee5d4b14aae6dce7c56f297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656586, "uuid": "91cda492-914f-497b-b1b7-8dc7945774ba", "comment": "Malware payload (SheetRAT)", "value": "eada94f3be0b243744ff475a184db099422afa9d3f2f69f4496766b0054455cf9f17df68c266c5d253bd6778a51a672e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656586, "uuid": "a6380303-cef0-4095-bb5a-7ddb46f4d54e", "value": "T18926F10CFE80E855CE2A3C77CEE615008B7174C1AF11864B22596FFE4F663B259A667C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656586, "uuid": "9e8460b0-cc2d-48ce-afa3-c3aceece642f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656586, "uuid": "5f8cee4a-7f30-477a-ab75-55ae0b9a0297", "value": "98304:4lHOmOIB1+PoB7UzgP6ElqHn0mllAwpYQSz6VNrNosZWI:4lHOmcDWweQ86fNopI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656586, "uuid": "7a0a423a-9f28-47b0-a485-88b42dd272bc", "value": 4703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656586, "uuid": "393975da-0dd7-4443-83f4-34f0ca57ba6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656586, "uuid": "0d5d4ce5-6a60-4e0f-9a48-bc2edc7aed6c", "value": "winrar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf25b2d-2ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729382, "uuid": "699bc9a9-7c9e-4bc2-93a7-1e8df9567773", "comment": "Malware payload", "value": "34f746d3dfcf365bbb589e074607e28c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729382, "uuid": "3d4ca66b-11e9-4e1c-bd44-fa83068e559c", "comment": "Malware payload", "value": "a44ebeeeeffe7e9d982532468d303aea0012bd5ec1f91b6c6608f437ab411e2e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729382, "uuid": "597e42c6-38da-4f4a-bb8e-a2cbf95815e8", "comment": "Malware payload", "value": "dd6775d15139fe0f56e216d3dfabad671cab9688", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729382, "uuid": "34b55bbc-7f78-4d69-b99a-04c6f56a189e", "comment": "Malware payload", "value": "3bf2acb63aef55bea4067793b3fa755c3d1e7c5d69bda4f076cbfc918f81797b16fe48fc0797e73a52ca07a38a63b84c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729382, "uuid": "b26ad42f-c0d9-4c69-a757-25e209ee702d", "value": "T1D117332495CEC6C0F6449AF18B479B9F16123F96C0A1AB773181FB0C673F626077DA98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729382, "uuid": "fbb52a6e-a067-489c-945b-cd84502d5724", "value": "393216:u1tsH23WtEXdvrPappy640Md0v/VHo0/y3qDBn482SxOux5yUdOi:uMwWtYzipvLfVHRMmnpDOuxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729382, "uuid": "bd45c3c1-d660-4e43-a3ac-de4f22036162", "value": 19937280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729382, "uuid": "59fe7562-a117-409f-846e-c25b6dfffd6f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729382, "uuid": "1c8853a7-b7b2-4800-9d6b-9cc73f94a3e4", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75efd637-2ab9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774711146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711146, "uuid": "429be214-cd44-45d9-96b1-af466dc7437c", "comment": "Malware payload", "value": "f353b77d67ee962bcb0153b073a22f71", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711146, "uuid": "fdf2959c-47fb-47e7-a789-c4db46d1f4ae", "comment": "Malware payload", "value": "a494a1d8d6df5ddf5d0fce26414c4e722ad985a2089afa34cd28a0de01e73f92", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711146, "uuid": "298ed795-4ece-435d-95c5-4cb0457e4b33", "comment": "Malware payload", "value": "aa01c814df075edeea7fc090103915c669bb5198", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711146, "uuid": "ad6e5b32-e141-4302-b861-083c1e136ac7", "comment": "Malware payload", "value": "34dfc4d9a306843f02ff18d2f3ee265552ad9038e9697778b9664e50ed7092da0dbc5e14fda686202c7e27e80f207167", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711146, "uuid": "b5d9f340-e78e-4f6d-ae17-5c2b70ba6395", "value": "T1052633E8325653D8E105D53A4BABB328AEC51C42B7DFC2F29ECA6E5518F93D1011DE88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711146, "uuid": "590ecd92-1256-4ec3-97dc-6e3ab3d4eaaa", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711146, "uuid": "e5fbaf23-1a6e-4834-9b22-701348d030dd", "value": "98304:002M9+NbxS/Qv1d3ZJKm9theSmfR+1IGSmNZP43f3j4Lsbj:002MoQ4v1dWitPmfwSGzvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774711146, "uuid": "bf6479a3-5fbf-4566-9d8c-051fa9b99062", "value": 4488704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774711146, "uuid": "8b367d71-1fe3-41cc-90d6-f71aaaabf113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711146, "uuid": "8a74c88a-0439-46ad-bc98-c98b1f2c9273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80567e8d-2abe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774713311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713311, "uuid": "f496e10d-2637-4cbf-8c2a-98f22282705a", "comment": "Malware payload (Mirai)", "value": "83b0fa7bfa9ee112aa75f8665e43267b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713311, "uuid": "6ac76513-b147-4ee0-a641-c39ec9db232c", "comment": "Malware payload (Mirai)", "value": "ab668beda6226575300320116105afcd27d4847bfd2565a7b882776ae326c6db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713311, "uuid": "4ff9e1a6-2a47-46a1-8626-fbf72dd0272d", "comment": "Malware payload (Mirai)", "value": "a8c4b39dec0201dc193a481efcd42627aabd1980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713311, "uuid": "e2ad8f0e-64c6-4504-abdd-26c945e0d947", "comment": "Malware payload (Mirai)", "value": "4f499c411f56a2cc0a5eba2fa2a21d456b9220988c832271ce8bcd40b8085351609b95ecbcd89d02a3f69dea37bc906a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713311, "uuid": "2ff6ad78-54bd-404e-ab10-3fce3d37f91f", "value": "T19FD3F846F8819F12D5C115BAFE0E124E37231BB8E2DE72029D246F61778B9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713311, "uuid": "6911de2c-54e2-4aa5-bd5c-5082409b13f6", "value": "3072:np1bR6NQdZF/XkZaPfC1jEVpPAyabEWn:p7SeXXkZaP61jnbEWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774713311, "uuid": "12432e35-a1e2-43c1-b673-e5dc118358e2", "value": 138960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774713311, "uuid": "e6251e15-95cd-42e0-8fca-6faf7f2d4535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713311, "uuid": "65066585-a5de-4cd2-b41c-5ab524adbc45", "value": "systmed-login", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dc5812-2ad2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774722036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722036, "uuid": "76fe9772-365b-4a10-a794-767b9f445b85", "comment": "Malware payload (Mirai)", "value": "9921b212a086ae56dfbd5432c0a2b204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722036, "uuid": "e13c7674-a034-4466-8a4d-77eb5c7abcec", "comment": "Malware payload (Mirai)", "value": "aca2256de68be264359106a4efafdf0d4622ded3702b5b573b68facbb89b7fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722036, "uuid": "7b8f4ee5-38a2-4c38-a41f-26fc78695aa2", "comment": "Malware payload (Mirai)", "value": "621ca4fd6613cd0e5e4f6dae48403d76c4c0e682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722036, "uuid": "e84b930d-de98-4cd0-b306-b1ff28b76edb", "comment": "Malware payload (Mirai)", "value": "de5bbf5539326cea412c05a6cf74323598a330beaffd634872b473e62cd9dcaf6dece39e48102f3b2d9450ef5f1da56f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722036, "uuid": "13b87ae1-de09-4d40-9d72-10cc6431b222", "value": "T1CD144C46EA418A13C4D31B79BBAF424533339B64D7DB33069928BFB43F8669E4E27501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722036, "uuid": "1508c0fe-c518-4592-a7a3-442e369966d8", "value": "3072:54Jvgwp1Lz1xIc1NJ5tHefmahEKHauOjwEzwzW6tA6rIvv72M/9ka6T:iJvTp1P1xISNJr+OahEKHauezwbIvvKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774722036, "uuid": "0e27c7d0-26f1-4495-b355-2f300c7a60a1", "value": 191876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774722036, "uuid": "8ff317a2-fca6-4b9c-aaea-c405366b5f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722036, "uuid": "60655d67-1196-49be-85fd-53d2f032d293", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7c0cc6-2ac3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774715373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715373, "uuid": "cd8043c9-61e3-4bbf-92fb-7dfb16a6043a", "comment": "Malware payload (Mirai)", "value": "07f3fcdd92ef8f3f31d9c15f1a8551c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715373, "uuid": "c2068c3d-d6b9-476d-83ad-74c229fbcfd6", "comment": "Malware payload (Mirai)", "value": "add7ee10ff8139acdaff2aad8e6c5710c6b25442dcc5380b81309a246dde55a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715373, "uuid": "70d69416-f948-4f1a-a10e-fdaf00b891ed", "comment": "Malware payload (Mirai)", "value": "d11872ba41773fe05587c57a0c028ac585079ab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774715373, "uuid": "97c5861f-308e-4275-9ece-92e7d99e6c6e", "comment": "Malware payload (Mirai)", "value": "14d9e749542d41dddc17abc48554a6c701a294ff601f3aeca2f56b115ce06a6531b24c1e0ac197dcf36830823714daa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715373, "uuid": "301da53f-6cff-44e6-b9a0-2167cbe9c6d9", "value": "T141D3ADA7B30F2461C82506F41BCB9B5D296325115E2F9AE77C6E723F2A335CA58053E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715373, "uuid": "391fd76b-ceff-4326-af0d-999733d5d9f1", "value": "3072:c5ma3o0yEACBTQcdy/v4BEyE+gKCHMiaN11lq:c5mJEAqQcjB3ESCHsNlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774715373, "uuid": "2db1f43f-4e3b-478c-bf5b-ffea2753be25", "value": 132456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774715373, "uuid": "3415f0d3-e216-4d67-8259-b90797065d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774715373, "uuid": "20915d89-a45c-4f8a-9316-8973afa921ce", "value": "lighttpdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e514b79-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686598, "uuid": "bd7aa536-5c27-4a70-98b0-a1c150cf3e3a", "comment": "Malware payload (BPFDoor)", "value": "5f6f79d276a2d84e74047358be4f7ee1", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686598, "uuid": "25296876-bcd1-43eb-8e65-9f9fd978dede", "comment": "Malware payload (BPFDoor)", "value": "adfdd11d69f4e971c87ca5b2073682d90118c0b3a3a9f5fbbda872ab1fb335c6", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686598, "uuid": "66c2a328-c939-4598-9194-f40f465158b7", "comment": "Malware payload (BPFDoor)", "value": "a778d7ad5a23a177f2d348a0ae4099772c09671e", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686598, "uuid": "ab6024a5-7127-4d87-b51d-4deb257d65f0", "comment": "Malware payload (BPFDoor)", "value": "29c972aa43d0131570bbaac87d4ea7325362d6201cbb657d5112b37a153821e3f2b38fa0f37bf68aa2c673645e16dae6", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686598, "uuid": "62cfb734-8342-4658-a434-91e5c02ad422", "value": "T1D0A57D29B9A714BDC5A7D470C66FD172AD31B46C43217D7B2180EA303E6BE305F1AB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686598, "uuid": "a9ec2cae-4e59-4527-9b9b-b0989558ee2d", "value": "49152:0v23x1DL/xGtlqVl+F+W9EXtyjdY5VwAsOfLWdpXV5M2IU6iCU84TUJ8u7:hLT+F89+YzuV4+f/u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686598, "uuid": "c68ab730-ca3b-4285-9396-2ec213c5aca1", "value": 2112440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686598, "uuid": "b6d9c739-3589-46d9-a33b-4eabd89e597a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686598, "uuid": "f161d6f1-4cb7-477c-b576-ca22bab78af0", "value": "adfdd11d69f4e971c87ca5b2073682d90118c0b3a3a9f5fbbda872ab1fb335c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6394c6-2a40-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774659271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659271, "uuid": "7bb37a0d-f392-455f-a3b6-f1b107037f67", "comment": "Malware payload (OffLoader)", "value": "f00058e1c4c67dd47bc962afe4c844a4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659271, "uuid": "1fc14a0b-174f-47a3-9792-c1e62266c42a", "comment": "Malware payload (OffLoader)", "value": "ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659271, "uuid": "a854b373-acd0-495d-b0b5-6477867aace5", "comment": "Malware payload (OffLoader)", "value": "1d27090ad2cd9702fc723d79e3678253150d5543", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774659271, "uuid": "29f41a32-ada0-4a67-a151-b8a331650fb5", "comment": "Malware payload (OffLoader)", "value": "014bca3bb720bb8e5875683a1652572f5cb9d40a026e7f411e2aadb2324e61972989ae51a120792c6afedbb064af1d5e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659271, "uuid": "3e438fbb-f891-4cd7-9eda-162c88a4252b", "value": "T12556F127A748A32EE4284977F971E5BC583F666F721E8C05B0E55D4CCB2F4A21D2E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659271, "uuid": "d5895c5a-c606-4705-af6a-2dbd2bbc0d17", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659271, "uuid": "ec9357d4-1b88-4468-adfa-14557ae7c1f2", "value": "98304:xN66naKaZqA8Mom9dwsKEjQTUfwZ5hDig:FnWENrBUYZ5hig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774659271, "uuid": "3b706146-c547-4ae5-9fd8-cffd7d41bb23", "value": 6394892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774659271, "uuid": "3c0ca19a-99e9-44aa-8f83-587523663226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774659271, "uuid": "120b5993-698b-4424-9b86-50e71817973f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7c1b24-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774706783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "3bc3ed37-b22d-49bb-9ae9-87314c68855c", "comment": "Malware payload (SalatStealer)", "value": "6a9e1bcca0434445e6ef2a2547e1010e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "32014b6a-8fef-4913-a7f6-313bdae099b7", "comment": "Malware payload (SalatStealer)", "value": "aedcb8df70bb5397fed35fd3036809921b86f92dd4c3772dba03452bd7e49d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "3ba1a091-e8b5-484e-ac02-e4af23235bb8", "comment": "Malware payload (SalatStealer)", "value": "e4eda34c276bafcd96bc1246c7b769eb9945becb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "6f44a3e3-7c2e-48ab-b74e-feb313f4aadb", "comment": "Malware payload (SalatStealer)", "value": "83f55e0095c80d07044ab489f8160e480011602b82311b16a4e74747e3f51ed253c8baf5788773ce7d54fab4d5f318d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "faaf6542-f825-4bd3-9b38-767257fd107b", "value": "T138C66C11FACB54F5E9035831506BB27F23315D048B28CBDBEB183B6AF87B6A1197A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "e457a251-9b90-4880-a4b0-8f89a4e269a7", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "de14eae2-73e4-47c2-bbc8-30bbd3a1e759", "value": "98304:qcnIiZ6JHtwUXioDufleDwVCSts44+G2IfLEpY:768UBDmdVCys4eQpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706783, "uuid": "65d75349-5240-40bf-9b01-bcee5643d64d", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706783, "uuid": "af53a835-7340-4137-9c03-fd65cc6c3736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "41d55145-33d6-4e57-8380-814a72ecc55c", "value": "MALTABexecutorv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e999cc67-2ac7-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774717353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774717353, "uuid": "caa192da-780f-46d9-b3dd-05ef5369acf1", "comment": "Malware payload (Gh0stRAT)", "value": "bdfa2dc91c80d43b9f5c4f2bb507665b", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774717353, "uuid": "eb1ec51b-d2fa-4131-b5fc-bcff4a7d7f8d", "comment": "Malware payload (Gh0stRAT)", "value": "b0200f4465268ef39969d5f3247f486ad30a6624df51283b3def05a17f3bd31b", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774717353, "uuid": "3a80ac4b-f395-477b-be97-9da112aa08fd", "comment": "Malware payload (Gh0stRAT)", "value": "93bcbf0dc3be97b62c2999a2d5bd63ecd42852ee", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774717353, "uuid": "b628d120-7161-40c2-80a7-26d8983c24be", "comment": "Malware payload (Gh0stRAT)", "value": "a4dcde47950f9ca958cf3273454625c2f0b8c9c1f0f6265af0b671410992da44835bede0441846e14c31d50880442da6", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774717353, "uuid": "e6733441-2bc5-4e71-bbbf-4f454752705a", "value": "T13C373311A6CBC432D5AD047BE9A4FF1D05B9BE730B3141E7B3E8B9EA48B48C15274B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774717353, "uuid": "f445b002-4a13-42a7-b8ba-8c4a37f35a6f", "value": "393216:R/VATjHCtnO989OObGc1ezx9mjnJeXAe66gszto9AfbUCqgtQm+pPLZ0A9KMutog:RNGCtO6rXeTmjnJeQ0OyAC3CTOAt9whd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774717353, "uuid": "c6e6f815-720b-4edc-893f-bc718a15ccc1", "value": 22712320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774717353, "uuid": "25e342e6-c03b-4ec5-a165-afe972b6eb64", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774717353, "uuid": "ccbdd721-518c-4c6a-ae58-a32f6651a963", "value": "Teams12.5-4346.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed32eeaa-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720365, "uuid": "990b76cf-8eb5-4ab7-b01a-29cdab06a32d", "comment": "Malware payload (Mirai)", "value": "9eb21397e2a8075d66121dd9ec6da5d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720365, "uuid": "a9d255f2-ed8d-4f6f-aa28-8a68db737560", "comment": "Malware payload (Mirai)", "value": "b1849c4e73d29f3fecde6ce63a54a14bcb30c1e81d0d782633fdf58204f96542", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720365, "uuid": "e2990e62-9b0b-40ce-b0a5-3ba23bfb771e", "comment": "Malware payload (Mirai)", "value": "09937d41d84facaaa0e7ea6a55e5d6eba951b281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720365, "uuid": "184c7e01-127d-4a91-b596-185f51d5c297", "comment": "Malware payload (Mirai)", "value": "974854ed4d91d33f4c581ad96d33ce2a04e05ed33539f554e932352fa81a2b8a1524c58d30336dd7e52f466d00115dd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720365, "uuid": "c69217ba-3ca1-4274-bc67-46d693df8b1f", "value": "T199A2D1BFE8D64997DDAAE53B011D00CA50BB5C5413A783C23FA535B389678E8F836640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720365, "uuid": "c27f05d8-3f2c-4683-8cdd-d0b757ce4e8d", "value": "384:MccDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/aW7MM+v1RpX:NMkKJFH39CBVQey7qsZoMTD7EpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720365, "uuid": "96f514d5-8bd8-4848-95cb-d9e555ed36b5", "value": 22448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720365, "uuid": "be0fc51e-a609-4316-92ba-ac62ef5ea6c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720365, "uuid": "edb6dbd4-3eeb-400b-b2cf-71febba3cef3", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0869fe2-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720344, "uuid": "75b06241-0d87-4c18-b481-67683c27d805", "comment": "Malware payload (Mirai)", "value": "7465c8ae64b715b79fae15e1f3f3bcea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720344, "uuid": "581218dd-d68f-4b4c-823e-ea62aebc8032", "comment": "Malware payload (Mirai)", "value": "b285660bd6e1efc1a5a2b5a1bdc6ff913f67b60f66fd1f79ad0f20daa47c02e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720344, "uuid": "a5a1dbd4-e27f-4047-bdf4-eaca892b986a", "comment": "Malware payload (Mirai)", "value": "35efc1592eab56acf4c4704714a995966ccbf08f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720344, "uuid": "a3899da4-ea4a-48a8-911a-6c8ad35f8856", "comment": "Malware payload (Mirai)", "value": "40715ab814147adf4bce40ee9d3ebc7f776447376356241594fb97ba11c0818f0098e479e775e48a1d9cbf61eeb34202", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720344, "uuid": "e9038338-afc8-4f37-97b3-8bf05e17d772", "value": "T17D330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720344, "uuid": "57de829c-f29c-465c-b0cf-cdc7e8ebedb5", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGT:r/hqaJMDg9eqK806MHdkfQX6HuCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720344, "uuid": "de474174-8a4e-4444-b54d-62faf1ac0eda", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720344, "uuid": "daa9b410-270e-4aa1-afd7-a4dbff6f4f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720344, "uuid": "5013a810-8d55-4777-a4a2-97071622c35f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1158eb4-2a70-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774679999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679999, "uuid": "df34deab-b8a1-4806-b382-54c99d562611", "comment": "Malware payload (LummaStealer)", "value": "aa7f5294ee2a39f23e14ed568188395a", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679999, "uuid": "664f479a-7fe2-4ef9-ab81-d2de8a396037", "comment": "Malware payload (LummaStealer)", "value": "b3ecf89a5c4230fcdfc20be7f0dd2fc5d33d7a7fe769e007a51ee9e26954707e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679999, "uuid": "b7128d82-57e1-4cc0-93d2-f7398d270939", "comment": "Malware payload (LummaStealer)", "value": "490664cf4fd0e06034e8bf5e5889c6bba5077489", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774679999, "uuid": "4ca210fd-a0cd-49ea-bffe-1fdd2c3d72c2", "comment": "Malware payload (LummaStealer)", "value": "95f098c292ccd51e629868a6e6e2c47b6b6e4470309f1c847b8bd37a9c7549854d3bfe565f7bc8601dd445a23e150e94", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679999, "uuid": "8542f9e9-a204-4240-a633-abb12397503c", "value": "T1E1854A00FDC798F6E506563649BB23AF2734AC090F329B87EB483679BA772D51D26305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679999, "uuid": "e60f6e3d-aa99-4960-b32a-ad100e5eccec", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679999, "uuid": "65e48f9a-e2a7-4236-8d82-a11ab1b4d1a3", "value": "24576:YAK5l7K9vHig/LZ28QJYK8mjimG44zJ2vTZzWdu/6aW+8UTFuCd2KsHDPpr6TuZv:YzPCe/jMcu68Up4bxyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774679999, "uuid": "080f3e21-2d12-4889-a5f8-dd2f5f00a27e", "value": 1750016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774679999, "uuid": "08557dec-7506-4f32-a877-5b2c92981ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774679999, "uuid": "e9c1dcf5-9b2d-48aa-8d5b-96602df944d4", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788e035c-2abb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774712009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712009, "uuid": "52804d78-ad6f-4f73-a75e-29c2a6bae348", "comment": "Malware payload (Mirai)", "value": "58a04dc9262368cfee21e2353ae15987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712009, "uuid": "ecc1c804-6258-40c2-a2c3-39c13e1454d5", "comment": "Malware payload (Mirai)", "value": "b9044552cba4ad20c61abbb817f3caf6d24e7b3c8e34260cc5d8fcfa1ac683a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712009, "uuid": "1dbb1028-b73a-4326-b32c-f3b284904e20", "comment": "Malware payload (Mirai)", "value": "52c77c084047fa820b553f2ac720d487e48fcdd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712009, "uuid": "46edf43e-5b73-4f7d-8853-df54cc3c80a1", "comment": "Malware payload (Mirai)", "value": "aff869cf1be6e13c2c2b7919a925abcee506754d58c77b8182b10f2df3a98e29b88440e536f0288c265dfe273eb3eb3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712009, "uuid": "1c05cac1-b7ba-45d0-808f-f7f1f93bb102", "value": "T11EF3C60AAFA10FBBD8AFDD3706ED0A4238CC645721A53B753674D528F54A50F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712009, "uuid": "924ba430-7775-493f-af6e-7070df298b11", "value": "1536:xmqIPeV1PFlt1fO3FuaLGa9pRD5jG1QmivAvJ5iei6w48em96PKv+b6e7VBPsj9S:xHIPglkjqa25ieVhm96Pk+r89pN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774712009, "uuid": "f6ed19a1-a173-4bd3-adc1-925ae65c6f1e", "value": 169468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774712009, "uuid": "bbe464ba-eda1-4534-8bae-2a020b4d031e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712009, "uuid": "bc4f2776-f19f-4a39-9eea-3539c52e72c1", "value": "miniiupnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6ac68d-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720418, "uuid": "2b3f6fce-a18b-440d-89d3-f6c940c9e0d4", "comment": "Malware payload (Mirai)", "value": "41ab4c89078728e0a552527757abfcc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720418, "uuid": "18adf94d-ed59-4c56-83fa-a148317e0ebd", "comment": "Malware payload (Mirai)", "value": "b99c07210fab2a54e476e8b879e50622480d2f4e6ae10d879be52f49825797c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720418, "uuid": "895c3425-1139-4ab7-b97d-3fd2a0938e73", "comment": "Malware payload (Mirai)", "value": "56362fce41032a0bfd5d00900f1f736e4377c0d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720418, "uuid": "1d72750b-b208-4eb2-91d0-e7c8ee9ff426", "comment": "Malware payload (Mirai)", "value": "5ca3ee6ff88e161e64c0183eb3baa34f10da6cc4bf23268b71b722250c5ab9b4c624594716e3d868450304630f365ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720418, "uuid": "bb60d518-e222-45c9-8db3-d7c4c6bb54e0", "value": "T18A630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720418, "uuid": "a5a5a6d0-a2ef-4529-9c64-a72a051bc71a", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720418, "uuid": "3e65cda1-6e0c-483c-93b4-195cb87b906f", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720418, "uuid": "64a2d60b-8ace-4d88-9c21-21dde47a1c5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720418, "uuid": "17d84200-9a46-4d66-bfe9-f6f0a3985104", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0ee1a5-2a74-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681603, "uuid": "2f7f6a43-ddb8-46b8-b1c0-daddb4534502", "comment": "Malware payload (Mirai)", "value": "960bb7df12fdce1d459ccd66d3395f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681603, "uuid": "2977ef7e-99b2-4575-a63a-1191c462d942", "comment": "Malware payload (Mirai)", "value": "baa57a1cc7595718da139ceba6afa34f4dbbcda23757c6139a9c15abfe024975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681603, "uuid": "5f1a37b3-687d-4c6a-9214-fc220cbd4cc9", "comment": "Malware payload (Mirai)", "value": "bd99b1505654e82343d060fb995e8956702b61a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681603, "uuid": "75573e73-9c04-4762-8375-2bb26fa80d54", "comment": "Malware payload (Mirai)", "value": "772acd0cdfd2cbfa85f4768bd10972b06f957906824e983af45fff6fdb1a6aa922f99ee19e18d5baab85216fd0dd52cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681603, "uuid": "3e98ce5c-321a-412e-994b-3f4968219c71", "value": "T162732AB41A96B27CEDF140B8F85720D628A20A1C3BACD2E3A5C7503AFF75B0C7169D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681603, "uuid": "2ac82d53-a983-4994-8d29-0f1e4fc79bce", "value": "768:GgUWix2EZgU/5h2hZg+OTvKZg0Kn13NZAf+/W4LzLU8JIoPiWs7lhX2ZvB:XUWdEZgTAjTg23ZAf+/WSJJXPihR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681603, "uuid": "c3d66667-2528-4fe4-905f-e102eb3b0c78", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681603, "uuid": "3cfb486b-8e97-48fb-853b-e312b49defd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681603, "uuid": "769d4860-9e6e-40f1-ba66-29c1b735902a", "value": "db0fa4b8db0333367e9bda3ab68b8042.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd64f63-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774706730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706730, "uuid": "05987a6f-b1e5-4e89-ba92-936750c36f22", "comment": "Malware payload (SheetRAT)", "value": "f64d3ac245737a95db62f218333203f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706730, "uuid": "f9c54549-4397-410b-b571-99eb1043427e", "comment": "Malware payload (SheetRAT)", "value": "bc52ec570a125a5ac7ab3841661e68bea1e5d2c625c5ec2509ade267c97667ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706730, "uuid": "ddee8319-508b-4ba1-b126-fb496277d902", "comment": "Malware payload (SheetRAT)", "value": "d52eda93be5da4e5f6dcf670d26e32625200cfe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706730, "uuid": "d88cf282-067f-4ecf-82fc-d2117e85f7e1", "comment": "Malware payload (SheetRAT)", "value": "c3ceefe1294f53c3690cdc47b6d03f0cbdde967bdd09f947f872daed0e08673e6acaa42012b549ec92f1e78a0739c684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706730, "uuid": "3fc1abca-faa5-4708-892c-b432a06f02c9", "value": "T1F6D4B30CFE81F804DD2E3DB7CEE911044B7165C1AE21959A2159AFFD8B663B34AE217C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706730, "uuid": "344de057-db09-419a-a22f-4ba6324397b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706730, "uuid": "92ddeca8-cf17-47e7-85ec-a2daf51c99b0", "value": "12288:Np76NFhLjrcfPVle8vjgmCK3o2oyScBg:NENFhnrctjg63o2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706730, "uuid": "74278a60-88c7-44a6-b024-56a881a1a4b5", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706730, "uuid": "5db7d40a-2344-44ad-b457-9878fd8e89a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706730, "uuid": "d52fb41b-cd91-43dd-b2eb-5dff8f076a37", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c0963b-2a54-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774667865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667865, "uuid": "4e07624b-6179-46aa-95b3-61cb0e739998", "comment": "Malware payload (Mirai)", "value": "6f7b8821e099f96dc33c2ee1172372b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667865, "uuid": "087a3fb2-aa32-48cc-ad8c-a4617a8bcc96", "comment": "Malware payload (Mirai)", "value": "bc5e4f1197ea957d1958b59f2709e91026418a5b340e300e55a062144aa87557", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667865, "uuid": "2438b6c2-a74a-405d-b93a-64200de71cf6", "comment": "Malware payload (Mirai)", "value": "125bc711aa827bb2f80f50ff4e09b3ed4d1f5320", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774667865, "uuid": "109572b3-619b-421a-ba47-1569fbd7ebf0", "comment": "Malware payload (Mirai)", "value": "adce71720b218fc8fc49a355422d684acddbc61505e1be08ee112909087f3ab684b8887cc77332f34daa02a0d4c906a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667865, "uuid": "d9fe5d65-6314-4ddc-9edd-005dca1a9244", "value": "T143A1D2E974B4936A2DA1ED7371D6C942F14060A7E4C91D0AE6D2F0E4488DF61F484B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667865, "uuid": "5384d2bf-33e9-434c-b948-ca6556e821f9", "value": "48:vpK8KMV4kCpKDK1V4OpKrOKrWV4ZpKQKoV4HpKE0KEEV4EbpKUKkV47pKDK1V4OQ:v3IdDbcXATGEpb7aFHjRfsjCtBr9jq/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774667865, "uuid": "c7b807a8-ced0-49ff-b5d2-87d7bf9e87fc", "value": 4737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774667865, "uuid": "ebad7296-0100-489a-bed1-6b1c765857d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774667865, "uuid": "02f648a9-6f23-4935-b2d7-3b7675a9b9ca", "value": "76d32be0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74e5e50-2a57-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774669245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669245, "uuid": "692e99dd-b8e3-4067-ae54-813f98c524fb", "comment": "Malware payload (Mirai)", "value": "43cad13eb38b1d3a619da8f03e2b2004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669245, "uuid": "0483b8d5-2141-40ba-8dd7-0698b1b59615", "comment": "Malware payload (Mirai)", "value": "bd6d556aa03d07255dac1831adf63ac800ae2c07d1223f1735e7228b3644101f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669245, "uuid": "c32522ea-9e80-4ae9-8fbd-bb0832f16f1b", "comment": "Malware payload (Mirai)", "value": "74497c4d2489e57f03e8ace507c91ccbfd3f9d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774669245, "uuid": "fc83429c-c5a1-4894-875f-26bb4165dccf", "comment": "Malware payload (Mirai)", "value": "7871f02d0d879f8b1d88964b1b28c18d60ea33c2de3d305458ae278e207b8088802f331bdd17a637cc9e1df46902ed2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669245, "uuid": "053be0d9-c13a-4279-af5f-d22307bd785f", "value": "T143D39DA7B34F2490C42547F41BC7875D296324018E2F9AE73C5F367E6A369DB58063E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669245, "uuid": "c0a4683d-b6da-4ace-8e95-629af99c99bb", "value": "3072:5lJy6/6dHEpQ/Afowl+kPiz/Pj7xOglCRqzZrlAdq1:5/y60EGFwYkwb7xdCRqzZBIq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774669245, "uuid": "f30e48f4-7d89-4fbd-8e16-155a8399fbb4", "value": 132816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774669245, "uuid": "48969ca0-325e-4504-8c59-02076428508d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774669245, "uuid": "ac773162-3dc1-44b4-bb24-ad3690db09f6", "value": "lighttpdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cd5c51-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (AphrobyteRAT)", "timestamp": 1774706694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706694, "uuid": "f8e90ca1-834c-42f0-938f-f04a163def39", "comment": "Malware payload (AphrobyteRAT)", "value": "657db9c8689e01766a6666120b70f3b4", "object_relation": "md5", "Tag": [ { "name": "AphrobyteRAT", "colour": "#775CCA", "exportable": true, "hide_tag": false }, { "name": "DiscordBot", "colour": "#AADD48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706694, "uuid": "5e4531cf-e26b-4a6c-8b93-50080440beda", "comment": "Malware payload (AphrobyteRAT)", "value": "bf07ed08c0eec9bc0dfb8ec5f2a1940129ddf1cd1854a5f724f2c5ac36f56124", "object_relation": "sha256", "Tag": [ { "name": "AphrobyteRAT", "colour": "#775CCA", "exportable": true, "hide_tag": false }, { "name": "DiscordBot", "colour": "#AADD48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706694, "uuid": "398c1cdb-1694-4b4e-a277-0c7583346f0d", "comment": "Malware payload (AphrobyteRAT)", "value": "920b47ac4d1ce9eec58ddf534fccc621674eb8c1", "object_relation": "sha1", "Tag": [ { "name": "AphrobyteRAT", "colour": "#775CCA", "exportable": true, "hide_tag": false }, { "name": "DiscordBot", "colour": "#AADD48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706694, "uuid": "21ddb395-79ab-4538-9ff7-1edadfaf1728", "comment": "Malware payload (AphrobyteRAT)", "value": "8e441c7a7b67f1a66f616d29a1d178823c12373ef18afcafe2b5f3d885d06a70393cec5a4d314ecf1d9f2f5368eef5b1", "object_relation": "sha3-384", "Tag": [ { "name": "AphrobyteRAT", "colour": "#775CCA", "exportable": true, "hide_tag": false }, { "name": "DiscordBot", "colour": "#AADD48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706694, "uuid": "a17b65ca-f8e6-49ac-852c-337359a9e9d0", "value": "T11E0833C97F8465CBF98A833B958298565EB2F39C5B0741274BB80C723E673D9C96D230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706694, "uuid": "687c6b1b-1d0c-4707-8868-a460418533f2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706694, "uuid": "44943a2e-93bd-41f8-a752-2b89d2301dac", "value": "1572864:k9zGYxhQL0wEWuWuIK3P3R8fNknAnZ2yOogqTcaNH21A/QNNeaV+BbnYz1QSW9eR:k9aYxGL0wEWuxIK/h8fNknAnIdA7lxGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706694, "uuid": "5ab90775-c740-414f-8d79-9a00bda79ea9", "value": 80563425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706694, "uuid": "b2363399-db5c-4e76-96c1-74bf24352cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706694, "uuid": "5cb2749a-27e8-4d55-9fa8-5c8b778ad454", "value": "Rivalware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2adc4d-2a72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774680583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680583, "uuid": "fc027708-892d-47fc-85ad-0b50054d97fd", "comment": "Malware payload (Mirai)", "value": "66b920d3e4b86a72843cf94685919da0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680583, "uuid": "32ee7596-3239-40d3-a667-ee93550dea0b", "comment": "Malware payload (Mirai)", "value": "c0010979f20a987dafd6b6f709d0b47978f700a1713b529d153926511fc1bd0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680583, "uuid": "78c56b56-5bda-45b2-9957-77ee5cb70d18", "comment": "Malware payload (Mirai)", "value": "a30f5a065d6646532e7f5c2fbf79e6cae2950f37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774680583, "uuid": "f103a36b-0bf8-472d-9056-36cb46cd4ead", "comment": "Malware payload (Mirai)", "value": "b979d285fa93245c7ee1bc736e03cfb7de74d83dd74c9cbff6407c15174800cb3bab32e14abb005a65500e1ca849daea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680583, "uuid": "55ccd136-f9c2-4f0d-a897-14c13caadee3", "value": "T1D0F47C46EF850FEBC4AFCD30452E834705ED999706C1A63861FC8D8CBA9D6A94FD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680583, "uuid": "63bb1e01-f7cf-4781-b3bb-2f34764c8f47", "value": "12288:p1b1BSF8F0DZp5D7M0Gkvz/eV+44KAjrJQMbj4YmlqCb5XjHUW5MNjVRnxJLKQFM:LvW4RTuhj0D5sfk3o6PdPIDX+gqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774680583, "uuid": "81a48677-1c0b-4111-a8eb-09510e268121", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774680583, "uuid": "82494fd1-d776-4ce3-96d0-c206f1266eb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774680583, "uuid": "b62dfe24-6d3b-47cb-a662-039a1c4bd8a4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e2d876-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1774656566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656566, "uuid": "09a0d475-7d6c-45f6-8a11-38fdefbbb5f4", "comment": "Malware payload (DiscordRAT)", "value": "fe733dada611fc7bdfec61d534253c6c", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656566, "uuid": "565fadce-9422-4e5f-91bd-81a0b7924fd8", "comment": "Malware payload (DiscordRAT)", "value": "c0970259c47b61e6afd2acc234fdcbee619cfe63f6104e3214b2674b466814c1", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656566, "uuid": "1d892504-98cf-4474-a65e-082009f5411d", "comment": "Malware payload (DiscordRAT)", "value": "f26288e9e26790d41eca80de0c4eeec48545264c", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656566, "uuid": "aac33c15-6387-4363-ad30-22ccfbb1ab71", "comment": "Malware payload (DiscordRAT)", "value": "f3e58bcb9e3335165840eddc9412bf9e774673a6a9dadd84c9306f8ef0a4c16a85de78b8ef590f3626489c72f13200b5", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656566, "uuid": "c29e5641-8c9f-4ff7-8247-315558fa0bed", "value": "T1A273B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656566, "uuid": "e3d2dc66-71dc-41bc-99fc-94e966daaa35", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656566, "uuid": "65c9ee0e-25eb-470c-bc3f-bba795310320", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656566, "uuid": "6d4fe448-244a-4510-8719-b508f3d2c40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656566, "uuid": "cba4c418-1bae-4025-b686-6ad0cc5ba8f2", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019b86d9-2a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774691623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691623, "uuid": "5d339b28-e56b-4f8a-b909-3275f6279bb4", "comment": "Malware payload (Mirai)", "value": "489633a192dc57aaa974fd9c01136db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691623, "uuid": "02d604d0-ddbe-47b8-acec-fa86011e954d", "comment": "Malware payload (Mirai)", "value": "c0b100c58436263927df63243256623067787f970a9a26dba68f12d5698bedd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691623, "uuid": "74926618-7aef-41ea-9bbe-192c1ebeec21", "comment": "Malware payload (Mirai)", "value": "c8ccae1cd6bf20862446831833e9e32ba45b2da1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774691623, "uuid": "0bb7cde7-64df-4928-89eb-fddec1cc3a57", "comment": "Malware payload (Mirai)", "value": "3b1092c46b7329a5e79ad5167988c106b9b94b52eceba06d5d94b4dae630cac9e443e4148169718ffc9b44eba63a169f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691623, "uuid": "22e1d334-b2cd-4405-9508-0726bb47666c", "value": "T11AF34A13B89494FDC496C2784BEFA226DA25F84CA035B52F1B947F167D9CF20AB1D702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691623, "uuid": "131d7ceb-bf0f-477d-8319-db11eabf5100", "value": "3072:0+xTGNs+s6daW20T5xk+8QbFlFshfoEpPda9M6OyO61RqN89:JTGXwWJ5xk+8QW8hOSbqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774691623, "uuid": "681a93e2-260b-4579-8dec-98d095499a23", "value": 163968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774691623, "uuid": "51c25a1f-182e-4d02-bce4-6a5060423641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774691623, "uuid": "170e389b-15c9-4612-89da-e4eb8658107f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad82cf64-2a90-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774693629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693629, "uuid": "b6c248fa-37a5-41cd-adc1-612c6367ccbc", "comment": "Malware payload (ConnectWise)", "value": "bac7928006f07d680f919eb59f5a73f7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693629, "uuid": "02940bfb-44c8-4d33-951d-0cfa93110304", "comment": "Malware payload (ConnectWise)", "value": "c0ca7788e9fc8e7f59059aa53f9a0ee460f0c4b99308b8213a2fc3439b49467d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693629, "uuid": "6c6b0b1d-6ca5-4ed2-a8b7-022f1ab8ba4f", "comment": "Malware payload (ConnectWise)", "value": "3599840b2124fc23a7bf30edae0434aa83503652", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693629, "uuid": "23bed4ca-cba7-4bb0-acec-5c5dd0fb2bff", "comment": "Malware payload (ConnectWise)", "value": "de7b38c0324bb929da9e8623616098baffbcec0bb4dd6f309f9b7e8fa294d53d1fbdff26f16b10c2963fb20a076b110e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693629, "uuid": "90be0304-1503-4c55-bdf6-27e59c8fe130", "value": "T1B0D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693629, "uuid": "804b93d7-9095-48fb-bee4-529fb0968cc7", "value": "196608:3Hxcp9ym3nltDUJVhHxcp9ym32Hxcp9ym3MHxcp9ym3WHxcp9ym34Hxcp9ym3oHH:hGplpeGpEGpqGpkGpGGp2Gp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774693629, "uuid": "ac04fc6e-d924-4ca3-b347-c3aaf74a593d", "value": 13537280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774693629, "uuid": "f29fbe4f-e7e6-410a-9937-6ba2dfdf3a07", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693629, "uuid": "3052437b-cb78-4db3-8b43-dc8de33fdcb3", "value": "korbitdue04.25.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3ddc28-2a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774696907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696907, "uuid": "c4bacb52-81b9-47f6-97b8-d7201c601262", "comment": "Malware payload (Mirai)", "value": "98647a552e3e2ad7d1c3eb54be21ed97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696907, "uuid": "ed164ffc-4fee-4848-add6-eb7356a75b8e", "comment": "Malware payload (Mirai)", "value": "c2fdfce419267542c98066a78e578644c5c95f6bb877df5cbac00f65d8b5d34b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696907, "uuid": "0dfa208e-70bf-461e-8a16-9e74566f5ffc", "comment": "Malware payload (Mirai)", "value": "c51e62526bcd264c978e37852462025b97b037a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774696907, "uuid": "1dd644ca-d26b-4964-b3c3-5b0c9eafa564", "comment": "Malware payload (Mirai)", "value": "c6d600c354306ee6433771388c3bb0506a31513869d5913764172ead1cf7e2584ab3bacc6225875336ef0b09caba77d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774696907, "uuid": "7293c405-bb6f-406e-8362-204bdba99745", "value": "T15CA1B4E974B4936B2DB0ED7375D6CA42F24061A7E0C91C0EE6D6F0E8498CF61F494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774696907, "uuid": "f6646aaa-c287-4401-8d6c-f358f0b931e0", "value": "48:vpK8KMV4kEpKDK1V4opKrOKrWV4bpKQKoV4tpKE0KEEV4EppKUKkV4JpKDK1V4oa:v3OdRbKXmTGEpp78FtjTf6jEtjrnjs/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774696907, "uuid": "9cae2e02-4133-4759-9847-a635ca015339", "value": 4793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774696907, "uuid": "61a5b785-5b2e-4bcc-ab66-cac3ce79600e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774696907, "uuid": "90370b64-8b34-4ebd-abab-e68c7e9fdb82", "value": "aws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3654dee8-2a91-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774693859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693859, "uuid": "20ff34f7-445c-4276-918f-0f83972d5abc", "comment": "Malware payload (Mirai)", "value": "7fc0290be937420e62d7dbf6c4d5ee93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693859, "uuid": "7941b711-9b92-4be8-94e4-b794fdc9cb78", "comment": "Malware payload (Mirai)", "value": "c572346eba32c3fcdba6500871f90660c69602b33554a3e043934c5389f1e1b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693859, "uuid": "4c7bccab-1d0b-4658-b883-66c7f3b7d5aa", "comment": "Malware payload (Mirai)", "value": "f8253da7b4131cc87a43ed3063cb5f3103f825da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774693859, "uuid": "8328928c-7664-43ae-8382-b5a890fa7abd", "comment": "Malware payload (Mirai)", "value": "e327d8bcc5294d92b1550e5a7695ae31e54d29b7f83057ae7b549d50b4dfa02ac2c288dfe8e4a9aab819b33ba1f2dc5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693859, "uuid": "600ee8a8-b2c8-41b2-994e-41140b7635b1", "value": "T1A41429557E409E23CBD0677ABBED42CD731223FCD3EA7113EE014B25369A52A0E36592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693859, "uuid": "6507ec99-92f6-49c2-b025-c33fc2f6f7a4", "value": "3072:TZG2E+gVb28g5Ua+KQZx0cklRZak9tw7sSA8kHpnDAZTkOdeynO53JlvmD2DbiP5:N/zgVb280Ua+KqqlRZltw7sSA8kHpnDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774693859, "uuid": "6817510e-6c30-4436-afce-fdf3acc10433", "value": 192652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774693859, "uuid": "ab2ea04d-de46-4225-9c02-50eeda23d6ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774693859, "uuid": "df0f52d8-a6ee-4eec-b4b4-0ed404675b71", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3594fefe-2af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774738525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774738525, "uuid": "822ec6bd-9eb3-46dc-83cc-21aa872c931d", "comment": "Malware payload", "value": "a5137b279d36192e033bd96d6be6e805", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "orcaanalyse-com", "colour": "#21C3C3", "exportable": true, "hide_tag": false }, { "name": "t3-ch-com", "colour": "#40DC7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774738525, "uuid": "7ea98088-dc1e-430a-a2ea-496026bac9ac", "comment": "Malware payload", "value": "c577e555067b875117ef87f01de5b2305dfb794cfbd8cbc1107a95ca143a9aa1", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "orcaanalyse-com", "colour": "#21C3C3", "exportable": true, "hide_tag": false }, { "name": "t3-ch-com", "colour": "#40DC7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774738525, "uuid": "288964de-1ff8-4d8d-9204-55caa5b0bd9c", "comment": "Malware payload", "value": "5ce9dda4c9bd8b5c26f1829cb724b4143b620009", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "orcaanalyse-com", "colour": "#21C3C3", "exportable": true, "hide_tag": false }, { "name": "t3-ch-com", "colour": "#40DC7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774738525, "uuid": "1a1ed4eb-53e5-48a3-a24a-4f823d4d356d", "comment": "Malware payload", "value": "b9060fc5f8974d16b60186a60dbffb6f191d87ea17da04bdc337a28a9aaa3a094458c405ac850f8a0ff36d846d2b026b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "orcaanalyse-com", "colour": "#21C3C3", "exportable": true, "hide_tag": false }, { "name": "t3-ch-com", "colour": "#40DC7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774738525, "uuid": "f9e4b9e5-fb1f-432b-93cf-cf24185d2377", "value": "T1B2766D81FC1D3863CAC975745F7612A87639BC089B82C7276B28B73DAAF17548F13261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774738525, "uuid": "2fa05477-61cd-4661-9a0e-e995d792f672", "value": "98304:lcP4G553lYOMKAm50JD1yY2jE4v7wF2BzlRRkcuOSm2QT2uJUEK:lcnE4v7W2BecX2Q6uJtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774738525, "uuid": "360e6abd-3b86-456c-be65-b3660167806f", "value": 7798946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774738525, "uuid": "97f25f75-36d6-4853-ab0c-c1e95735e9e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774738525, "uuid": "afd85d5a-b466-4869-ab2a-b43519c8253d", "value": "ll-arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1eb368-2ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774724928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724928, "uuid": "0d20bfd5-d6fc-4fc1-91da-17a8379d1dfb", "comment": "Malware payload", "value": "ac765f8ce26fe50587c260dd0207a780", "object_relation": "md5", "Tag": [ { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "QKeyStealer", "colour": "#DFECBD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724928, "uuid": "a1187187-9ae1-4eb8-a7d0-6179a2eeb591", "comment": "Malware payload", "value": "c65332f378d5c69ed94dd30d833174903b5db4c1521d0cc598dd7bae6e7898c3", "object_relation": "sha256", "Tag": [ { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "QKeyStealer", "colour": "#DFECBD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724928, "uuid": "9975d461-5a9a-4dea-9d65-6d60b1cbe468", "comment": "Malware payload", "value": "443fd8215b17b978556d0977c7d676380fce9046", "object_relation": "sha1", "Tag": [ { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "QKeyStealer", "colour": "#DFECBD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774724928, "uuid": "dd38dab9-8d62-4c4b-be41-0090c6c642d4", "comment": "Malware payload", "value": "86ed13e98a4a2a895b71e1090d2c88cfacc9243065ddbdc5769161caef8c2b4614e4140ef19d6aaa50b259a76524b8c9", "object_relation": "sha3-384", "Tag": [ { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "QKeyStealer", "colour": "#DFECBD", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724928, "uuid": "24e62683-6384-4b54-91bc-56876b553a1d", "value": "T149F5232A98F23D132F93441FB8D97BB06B8F1A78B2E394B65DC0D473025B51983E5993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724928, "uuid": "4cd51ccd-8506-43f2-b57c-91ddf780729a", "value": "98304:dSbrzLWXl4Yu6RPxPwLLwd+KKm0qEsEA/Lce:d+reXkQPx4LXm00r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774724928, "uuid": "f8264f9f-4eee-4e0e-adb3-48431d760c26", "value": 3411147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774724928, "uuid": "72ef43e8-a766-49af-a27a-6d0d6ac38f8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774724928, "uuid": "510c01bd-e120-42c1-918b-9a14f6d451c5", "value": "\u8ff7\u4f60\u53cd\u5408\u96c6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7ccbcb-2aa9-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1774704201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774704201, "uuid": "06b6f937-893c-4f75-a87e-2a96b9aea355", "comment": "Malware payload (Phorpiex)", "value": "5433cbe93a9a3250a71e16ec22538f20", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774704201, "uuid": "9f9c02b1-f8f2-4654-9622-5fbdd02cceec", "comment": "Malware payload (Phorpiex)", "value": "c6bc3654e32d7d7c0b038e7c882705d169f87410ee7f2533a8c998b2209297bd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774704201, "uuid": "52aa205b-6fb0-42dd-95df-2ed76d70eb07", "comment": "Malware payload (Phorpiex)", "value": "9e634e24755675ead9e099a1673bbd9e44d8867a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774704201, "uuid": "d9902cc6-03fa-425e-9657-7d4751875ee0", "comment": "Malware payload (Phorpiex)", "value": "cd10a95b082f0f68883aabdae833e7ea311d83bebe2aa509c95fe84270307eba0812cbe3e80979dfdaec3276a69cf1a1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774704201, "uuid": "8bcb53b9-1ee7-4323-9198-8e416b56427e", "value": "T14C825B0FB8824726D1D110B59A62467BDAB8A472339854DBFB904EED0B6C6D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774704201, "uuid": "7f8d1c76-7cca-49bb-9618-83cafc6f6d89", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774704201, "uuid": "ca779e75-b567-40db-8c09-63d9bf3fba59", "value": "384:plGIUVp9sQofwzBfR0jfbdAyD+DMav8U9cEi:rECQH0jf5Aw6Ma0Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774704201, "uuid": "25405994-20bd-4c6d-a6a6-466d88038ad3", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774704201, "uuid": "b99cfc39-92c9-443c-b00b-b9febdbb63ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774704201, "uuid": "55683107-fd21-4b34-b078-89ee9c2e34ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ee2347-2ae6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774730654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730654, "uuid": "b12223cb-1274-4b5f-b622-c88972e404ec", "comment": "Malware payload", "value": "1833dbdec1b0b15d174f35e68e431453", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730654, "uuid": "64006115-a864-42ba-acf2-c1b11c048c95", "comment": "Malware payload", "value": "c6f88aeb852bcd8188ad5b07271c524c4796717a98b506673a7bffc260b3fb74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730654, "uuid": "372843c8-eb04-4337-9def-4e732a53066c", "comment": "Malware payload", "value": "c4394063c304ce8ba85456a731d68d8c1d8cfc74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730654, "uuid": "3f442905-109e-4f94-8758-f3575263f36f", "comment": "Malware payload", "value": "8a59d186644d0d93259c165238ad31c7976cca16c8e1cedff60810b3887ee2e09edebb52fec46393a865a820cd7f06c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730654, "uuid": "af80f2c3-2a45-4899-8137-a605ae0560ea", "value": "T1A5353385928B2393ED3CD23BBE4A645064CEE3D4C011B87A9D43A5905E5E8EFF320797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730654, "uuid": "8b3dae34-4ebf-4419-945d-8cebf2a17a4c", "value": "24576:R/6HpLwwG1jsQrndl7+WVulaMygDXDLVICmsQQRV7MJF801NcVmHIkqYNM43:RCJu1oQrndpcaMvfam/iFpcVmHIkqYMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730654, "uuid": "0ca74eba-d610-43bb-a2ce-589af9bb7b10", "value": 1157167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730654, "uuid": "943b6e88-4a5e-4dc8-b53d-c443e1d9f374", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730654, "uuid": "cabed46c-856a-410a-839a-070eca6899b1", "value": "d22d9a91_drifter_apk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fe2e4b-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720407, "uuid": "ccfebc87-7f60-483b-9f53-512f7b189c32", "comment": "Malware payload (Mirai)", "value": "401e705508f504b89a3bf484b83ecbc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720407, "uuid": "547ae6dc-d6be-403f-a5e6-b49c9e14b8fd", "comment": "Malware payload (Mirai)", "value": "c747ec43994dd16d5012441be8e88cb008962ed980beb8249e0b5cd4088830da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720407, "uuid": "98e0a9c8-bfdb-40d9-b102-e69252fec5f2", "comment": "Malware payload (Mirai)", "value": "e568070926f0e46c7011d0c3708675437bd6676e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720407, "uuid": "c08ee037-2fba-4aba-a044-a685a3322d34", "comment": "Malware payload (Mirai)", "value": "103025ec3ed8ceb018399ceb2199167ea8ff77709b055e21341cbb700e0db9eb2d024a09a19d4ba235ca5aceef41706a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720407, "uuid": "076df854-c0f8-44d0-b279-832cf3fb2d6e", "value": "T172431891BC819A23C5D4137AF56E56CD372023E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720407, "uuid": "54356f40-6a4f-4934-8903-2dd3d2dfbd29", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720407, "uuid": "8de98ec8-fc9c-4bf0-b3ee-5a0606191ed1", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720407, "uuid": "0f1e85d9-82f8-4328-bb00-497737170c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720407, "uuid": "8455b724-59ce-44ec-b6d8-02c81fae91fd", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30c1c6a-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720348, "uuid": "6a80b294-e403-4e53-a123-febafd723222", "comment": "Malware payload (Mirai)", "value": "d0625fc2edadd6b5a92ee69e85573830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720348, "uuid": "c6446e0d-1186-49db-9eee-299944d8fca9", "comment": "Malware payload (Mirai)", "value": "c813e79c04601e2751c8b9643d329f335bfae30ff294c40d179b7705b25fdc03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720348, "uuid": "58293d57-eb6f-4118-9644-f20751297de4", "comment": "Malware payload (Mirai)", "value": "b3f4831709250510bdd133284ad3a5d28664b1bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720348, "uuid": "0dcd71ba-69a4-4a42-aaa5-7cf980b4be6a", "comment": "Malware payload (Mirai)", "value": "714f7d7ed07a04a166881a30633ebff8853b1a4ec467e427ccbf1c14552e33d1533fc295be567690659285197f3bf923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720348, "uuid": "b5116fc9-6e7e-4db1-8cce-2c5f2542cb1e", "value": "T1F4B2CFCC61543484CA8D7C7C678D4A674F6CA1C0BAED9F16E360CD98B3BAA8B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720348, "uuid": "9f22e0a8-3444-44d2-959f-89fef33ad341", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBppZqSWvO:4QlS07FUXqIYSXQKqu/qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720348, "uuid": "30f24eef-ddfc-486a-9dd2-62adc7789d11", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720348, "uuid": "42220617-9b6f-41d4-9d62-0222b6b1de25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720348, "uuid": "cc5303f7-72a3-4f66-a2df-a3a2b3d96794", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6c7cee-2ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774731858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731858, "uuid": "132e7cb9-7df4-43b1-abae-38c19d1fd177", "comment": "Malware payload (RustyStealer)", "value": "5aa8950ae30af9e2ef26d123f4acb4e2", "object_relation": "md5", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731858, "uuid": "f52118a0-f47f-4547-9fdf-1abaa15c4cc7", "comment": "Malware payload (RustyStealer)", "value": "c853d5e9c61de97b2b6f8676a1fe34f41959e5493c9008e9a5c05b17de700977", "object_relation": "sha256", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731858, "uuid": "a147c491-ad32-4435-a061-70de40b01e7e", "comment": "Malware payload (RustyStealer)", "value": "c45afd4e757fdc3516d1ea1c62e8d9c59aa94fbe", "object_relation": "sha1", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731858, "uuid": "0a51adc4-cbe3-4d7b-a2ce-e0b1aa9415e2", "comment": "Malware payload (RustyStealer)", "value": "a9e62c58d7f211a579ed2ba5b97be5695816582281e87a9d3d8eb2f75e66f74490e6c6d31acf7fd02560cc0b43928ffc", "object_relation": "sha3-384", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731858, "uuid": "66e8ed28-2e97-4b10-9375-9571a021f2ec", "value": "T1B0C59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731858, "uuid": "a32a4e6f-d7b9-483e-8352-9af93f3df18c", "value": "44968aba445081de5cf91bc098461354", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731858, "uuid": "08be5d3a-869d-4628-b8da-031f12a0acd8", "value": "49152:2avY1Sn5eVNo2i3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZryjWsdGG:xY1aOJIig1VwkNU/mIzb4bpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774731858, "uuid": "ce2b5195-cd8b-4b2f-a39d-8d00122c42ce", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774731858, "uuid": "7ee85039-35af-4418-8503-1a7147343ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731858, "uuid": "fbdd6589-b50b-4703-a13f-b9d4ac1f95d1", "value": "b152957d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50814a3b-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681877, "uuid": "227d974a-89af-4a62-af26-da64750cf51b", "comment": "Malware payload (Mirai)", "value": "205ca31871f6a0b6e1dc919af5a5227a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681877, "uuid": "1ebdd322-7762-4cc9-8893-0d3f008356bb", "comment": "Malware payload (Mirai)", "value": "c88e8314b162dd34a64a8486b16f532d1c49cd472b3445c9e5c9c78f2bbaf2f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681877, "uuid": "8bbe7206-f1ae-4e4e-be59-00db2f966c7d", "comment": "Malware payload (Mirai)", "value": "d7b0bb32e4a99a18c7dbc606a6f967f0ea9dce96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681877, "uuid": "c0c7a4c9-7c4f-4a8d-8578-f898df462805", "comment": "Malware payload (Mirai)", "value": "75353223a9bc3531460224d4ea1fc148fc5be83ac596dc98923ce319fc133dbbe42868fd241fa49eb65ccee93586141d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681877, "uuid": "22614033-65f6-46b4-aff7-26130b922718", "value": "T1A893540D2E718F7CFBAC863957B78F21924933A536E1C544D16CEA421EB024E742FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681877, "uuid": "cdb14f85-43d5-42d7-9427-3487a6aa9fe7", "value": "1536:amc1p57mJoXIyIsHtnWhsYc6bmJac0jnKQ8xKP7olMNXvoJ4j:S1HyJoXIMwaYc6dJ8xKPclMdva4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681877, "uuid": "ce738d4e-8f47-43da-917d-dfc45f36ed77", "value": 96408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681877, "uuid": "8d9242ab-f272-4d71-9c21-44b777af3f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681877, "uuid": "c73655af-50e7-4d1d-ad55-3b5026896c73", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d28d09a-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774681871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681871, "uuid": "65326014-f70c-48ed-b626-a90f1b3af548", "comment": "Malware payload (Mirai)", "value": "dcb9f6ee078c423ab7c1d4f7141845b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681871, "uuid": "3eb65b16-749c-4092-9caa-1af2d18db592", "comment": "Malware payload (Mirai)", "value": "c990fae684b215cdedd79223ac1e0da674ae011cbd63caa8e7b0f67db871ebb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681871, "uuid": "0b996dd4-e58d-46ff-9681-5052e6bdf6b7", "comment": "Malware payload (Mirai)", "value": "546909800fc2aa8e84d991990aadb4331923ea92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774681871, "uuid": "044f918a-43bb-42c0-9e13-f247b595e5c8", "comment": "Malware payload (Mirai)", "value": "a1e80b49f0bd5ad38e3553ec85ab23d445f0adeeb67f2cb606706ecb7682b0940a86cac6dbc66e4c2e6abfab634a9c60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681871, "uuid": "c374a050-4c8e-4278-859b-06bf0a27e983", "value": "T1EA634CD5B4008E7CF957EABE81164E09F92173045FA30F2BAA67FC936F631999D07842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681871, "uuid": "01cf5328-e14f-4eb5-800a-06aa0bc16d87", "value": "1536:3XoMCyq+8o5qqpODv08RaI4psFjaqMqnggYp+xBeVHQ8++p:3F8oSjNaZsN3gWB0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774681871, "uuid": "d9b51b15-39aa-4b54-a33d-be5f6baee681", "value": 72692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774681871, "uuid": "72a6f2f5-2646-4a33-a337-f927ea1068df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774681871, "uuid": "7c0dda8a-568f-4d0d-a062-aa31d1241f31", "value": "db0fa4b8db0333367e9bda3ab68b8042.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2472ca17-2ab4-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1774708861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708861, "uuid": "11453bc2-e683-4046-a182-3902a405dd88", "comment": "Malware payload (DarkSideRAT)", "value": "648d1fbfd92b3abc4806f2066a9532cd", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708861, "uuid": "ca1a29c2-be33-4a22-88a5-3b6dce1c6b65", "comment": "Malware payload (DarkSideRAT)", "value": "cbf79383588f6caa31ff2f8ecd26a4ed49b3cc21df67bffc2d171e5b3b4a25db", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708861, "uuid": "97e78473-ddbb-45db-a3e1-7e9ea64f8eba", "comment": "Malware payload (DarkSideRAT)", "value": "fa2ec3fc0c4277c46e34c93e4326effeb547c737", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774708861, "uuid": "4713d64c-0e28-4ba5-a3b4-b520deddd67d", "comment": "Malware payload (DarkSideRAT)", "value": "77c153f806c5c8e5cc8b6b77d60b9e886c9b69552d297c9c21ba6cd45e0218f05698ea00bb3bda8ffa3bd2c99dad7931", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708861, "uuid": "67034584-0606-4b1f-9457-2058f6e51c90", "value": "T137430A39E95AB06FD359C870EE470D16CD52BCCA96A0BBDB57910CD20DE6F209B2D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708861, "uuid": "e0e585a8-7852-499e-b5e4-54ba363edb67", "value": "838ebf00106c790e199157fb51d61b1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708861, "uuid": "ab39cb5b-f549-414b-89c9-32e4039d1e33", "value": "768:ObZ3ptJB4Zpfsn35XUX6MyswTOeLzEOWp54vg5d5YP98yxA1XbX/7kW7rCVr8Z0g:GZ0jfstp6OWp0g5rBSmjYW7rCVoekP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774708861, "uuid": "7b01b527-e4a0-4a10-b671-13c2cf22a9ec", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774708861, "uuid": "b4a9dca2-2abc-4dcb-8b3e-110281b1d852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774708861, "uuid": "23fc06f0-590d-4218-b225-16c94228ce16", "value": "StatusRotatorv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace565d4-2aac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774705654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705654, "uuid": "2f888a4e-bf19-49aa-8d84-357a0a90d85d", "comment": "Malware payload", "value": "ad3907c64c632a47d7f13a32f14debcd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705654, "uuid": "6baa9fa0-9468-4283-a2fe-1d6ff45d7d55", "comment": "Malware payload", "value": "cefe4982af641fcbb0a1a30faaa639f0de617124bb282aa9394aa2a8ee4634e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705654, "uuid": "89feefe1-5c44-4b79-bc72-267636aa0d78", "comment": "Malware payload", "value": "c8d071af1de6481fb054aefa19d777f11cdd6254", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705654, "uuid": "e1a7e532-7a33-45af-bc74-0cd0c40e600b", "comment": "Malware payload", "value": "2b7e475cab62c18b2ae65218d61ef5be874f4939a361bf17a0e20760c59b90ee39315adb5bf2d4b7a527452e42077087", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705654, "uuid": "fb13f75a-b98f-45cb-b465-76822b971da4", "value": "T12F31B7475FA83A336D7D85102866191338151A821A7D37E17AAF21B84F1360CE291CDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705654, "uuid": "1eb3ae4a-6502-4a25-acb7-5be58fe1f5eb", "value": "48:x0twX+F8wM/MSfMdM0fQnny6nzyyDhPst:Wte+F83nny6nzyyDlst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774705654, "uuid": "7368fffc-9f52-4111-9ef9-3eb7a942c5b3", "value": 1718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774705654, "uuid": "82920814-1b0b-46e3-8e00-d93141950f6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705654, "uuid": "68b2750d-e39d-4fdb-ab6d-4480c6c13e58", "value": "cefe4982_installer.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbca3cc-2a78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774683054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683054, "uuid": "bfdeb604-cf20-4273-86f1-207a94a4d9e4", "comment": "Malware payload", "value": "e8f1e538bf5bfe8cc20b6623091bcf87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683054, "uuid": "acd9f87d-874d-4b2c-a622-7f4dcdfc456f", "comment": "Malware payload", "value": "d10d547745c83b4d633ee0acd3fbfab332bcdc273665f667fb164fa06d173945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683054, "uuid": "b443e17b-e7d7-4c89-9eb1-0335d4fac91c", "comment": "Malware payload", "value": "9976ca9662d304a4da3c430925a686deaa22e5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774683054, "uuid": "c8a6359c-1215-4626-add1-32ed6ac46d08", "comment": "Malware payload", "value": "91e58b74fe41cd8941796ccbaae46cb2d21be04ba61fa1a63c129490f44184607eab7c6555ee8314854ba82ce7ab7486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683054, "uuid": "f7abfe38-8873-41c0-9a02-0edb5a0113fe", "value": "T1786501442356DE02D86A0BF10930E27017799E5D9912D3438FFBBDEFFA29B80B955293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683054, "uuid": "23ae2025-afdb-42d2-84dc-13944cf3c8ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683054, "uuid": "121071a1-8bd1-4273-9825-2917f7bdac00", "value": "24576:EZjXxPjGt+O1bmeCowbqRIIkPSP6IZHrQuvvRnYm9bzvgKrpT:0XxPqVPCowW3kKPZlEM1YIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774683054, "uuid": "f52ee991-5901-458d-b9f4-4db960a66935", "value": 1484288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774683054, "uuid": "79f9beaf-f30a-4e08-be77-39d7a0a50652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774683054, "uuid": "19bae75c-530f-4351-b3bc-6e2e39dbd6e2", "value": "00645530059297.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b7619b-2ae5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774729884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729884, "uuid": "b3781c21-5fe8-490d-9a86-e901c1886d5e", "comment": "Malware payload", "value": "a8f9cbc5645f5b8aae780e83851f85e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729884, "uuid": "3fa35eb5-7fa6-46b0-8c48-00b3107544ee", "comment": "Malware payload", "value": "d234e31380aeead2ce5318acc262b658b3149badd9b02e8858e28cef87dda931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729884, "uuid": "aac39ed0-874a-43a1-82ea-5bf18b45ae25", "comment": "Malware payload", "value": "752bb72e3fc914717a15358a03648327b707816a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774729884, "uuid": "babe5290-cce4-4e53-a183-919abe268bf0", "comment": "Malware payload", "value": "7241e0f28cfb9e215d9e1f5449c49ce11a8e115e3da1658c5431fe77c3f08d7839c8052ca53cafa2d505c77e832c7c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729884, "uuid": "6a78c76d-8aee-4d0f-bf46-497e5e20a336", "value": "T1E6C48DC4BE8360B7C8241C300466A6B72E741B625325DDFB815738D2E7F6E73A2725A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729884, "uuid": "e190dd14-567c-48ac-b64f-e6d163a9e786", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729884, "uuid": "c5d8c9d8-fd0d-4392-a60e-592ed68fed91", "value": "12288:i4bZS+74XGs0vyBTbjcA2usBmdOcDbNbzIG1bK6q137vakhXDCpcYuPj61:i4bZS+70Gs0g4A2us/ezIGm6qx7SkhWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774729884, "uuid": "a446b212-740b-4d64-8df0-5174e5170a4b", "value": 553296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774729884, "uuid": "8da0c8fe-0e9b-4a54-b2f0-5f442bcae6da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774729884, "uuid": "331f4246-8d8e-4b0a-9012-4a085eecb9d6", "value": "d234e31380aeead2ce5318acc262b658b3149badd9b02e8858e28cef87dda931.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a94465f-2aea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774732011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732011, "uuid": "3f8a1648-1113-4592-b523-4777edbedac2", "comment": "Malware payload", "value": "b372fe0847112f156e0ba39318a7fe54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732011, "uuid": "9302cd09-d99e-4dbc-a37f-59b50b4b8b70", "comment": "Malware payload", "value": "d29e268b1d568e942e5b16e020398a8a888d2a693f725478bdf4e9865463b79f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732011, "uuid": "7721e167-af4c-4962-bd8a-0804b19e5dc9", "comment": "Malware payload", "value": "423076476247ff4264298296ff0f6edef3f9ad14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774732011, "uuid": "4ff81401-67dd-4f4f-b2c5-dacbb7e04867", "comment": "Malware payload", "value": "f033bbbd471b8f109d9ea7e9f6942632a4a6708a89efe80c2e081fdf969771758e5b92c526c6aadc9da275e52564a613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732011, "uuid": "1f35047e-1a6b-4c7e-a692-33a48148691b", "value": "T1A356CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732011, "uuid": "429b731c-0956-4c71-acb9-d3da82c6e020", "value": "072c6874d508f803422eeec69b73ce5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732011, "uuid": "06875952-78de-42d0-b07e-b03736f90362", "value": "98304:IQiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:IzFytO1s/ihSxJAyJh3E5uBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774732011, "uuid": "ee60e489-f8aa-43e9-9285-8e000d7c22d6", "value": 6288896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774732011, "uuid": "39b105fd-dd00-4dce-bcef-d967ee755ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774732011, "uuid": "4eb3637b-5e89-4395-a3e8-e2ed29aa598e", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a395ef7-2acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720414, "uuid": "7129caff-7606-4753-b0a8-9fc38e294fda", "comment": "Malware payload (Mirai)", "value": "f37a615155158a1c8b1292fe35b68745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720414, "uuid": "b2942eba-1254-449a-a6ec-2e9f693af020", "comment": "Malware payload (Mirai)", "value": "d3a84feaa095774fab2131f49e26298c1a980e55e979fc105e63a84264318dee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720414, "uuid": "ec001db6-229b-4f62-8d81-25c03290f9a8", "comment": "Malware payload (Mirai)", "value": "c966c6d790dfdcf978acea15ec7e3d6f6e7fe14c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720414, "uuid": "4275bcf9-6e85-4199-8c51-3b7e46cf1698", "comment": "Malware payload (Mirai)", "value": "f8b470f1d78514ac64d8eece4ee0c511e40fc0e3829ab7fe094e234c14f1f3c69c408f0ca582f80ba2ac139afcf95fc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720414, "uuid": "a6db90e1-5d07-4307-a80f-3d2a05225752", "value": "T18333F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720414, "uuid": "40ac5881-ce33-41d7-bf45-5a53ca0ddf1b", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHJYC0QkiuVn4P:yHlPZMEcTFZ2A1HHJp0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720414, "uuid": "52bf61cb-4af2-440c-972e-1df1626a0ee9", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720414, "uuid": "c954a90b-218f-4aee-ad63-4a684b58a7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720414, "uuid": "c9027c81-6310-43d7-b9be-ceadab0399a7", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370f6294-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774706745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706745, "uuid": "957eca33-b204-4617-8962-5da6202b7737", "comment": "Malware payload (SalatStealer)", "value": "95600ffa4beaebe6165579a9de802f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706745, "uuid": "d891a985-0852-4500-b07e-7d951d7413d9", "comment": "Malware payload (SalatStealer)", "value": "d50ede6722095a0601a2f6c91f4cc9cbca011e59a494b86ee393acb696402848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706745, "uuid": "455d8f7c-96f3-4ebc-970f-c5fdf99a6c29", "comment": "Malware payload (SalatStealer)", "value": "6f3942c581148dd623b032e9bfb2bf1984125b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706745, "uuid": "a9b76a2b-8ef0-4315-8fbc-3a12cfe7a4b9", "comment": "Malware payload (SalatStealer)", "value": "d205c6522cbab4e479376c71660313f1d70ab5026ba667b8c81c65f8ea7dc28f5ef163e423b645fea747fcf1d7f6a7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706745, "uuid": "54eb4fc9-3775-4d20-acb7-b385bc6e6b0a", "value": "T16CD65C41FE8B55F6E903183140ABB23F23346D048B29DB9BEB587F2BF8776911876605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706745, "uuid": "e03bfae9-6bb7-4e31-bb8b-a08042f39a1d", "value": "49152:FZGNWdMRtdg6KpBZPc4J6FZylY8jd6c+6AdwvDbZdLO58KoObBZoD7FzRVymHk5x:ON+MoZPx0/yvjcseVKVMbaM4VUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706745, "uuid": "c21a3c63-e59a-4e69-8893-b904f83bf5c7", "value": 12923392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706745, "uuid": "18786f90-2a5c-400e-b779-18e831bfaed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706745, "uuid": "99be3d22-f868-4302-8b0b-9af355daaac2", "value": "d50ede6722095a0601a2f6c91f4cc9cbca011e59a494b86ee393acb696402848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730096f2-2a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1774656595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656595, "uuid": "20e89f7c-c129-4dc8-9357-b4347a1e7557", "comment": "Malware payload (DiscordRAT)", "value": "9381646e9572f49811cc3770df100d43", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656595, "uuid": "edecfbc6-83f5-4a6e-aa93-b834da98dbb3", "comment": "Malware payload (DiscordRAT)", "value": "d6f4dfa54b2135eb55861371819a5ca950b59af9b9202a5ee4d6d3dd652cea15", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656595, "uuid": "15860c6c-772e-4efa-9f17-ce61e73620a8", "comment": "Malware payload (DiscordRAT)", "value": "5e6878d6898611f39948e4c7dcd717e1ae4be19e", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774656595, "uuid": "207a3231-94be-4e18-8200-43db3143e686", "comment": "Malware payload (DiscordRAT)", "value": "b8032edca0bcbd602aa3f7eeb31c3ec63fc4a396873a9123625407540ce671647b369d7091972b963f15f6e3e509b290", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656595, "uuid": "2261b824-9d55-4df1-86ef-ac65b6abe7b8", "value": "T17593F88CA3AC8913F77F9E7C647185278732B62BB529F65E09CC41FC15A2741C910BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656595, "uuid": "e978b7cc-cdcd-468d-8ca5-690e26908bf9", "value": "1536:48KwINrRoksmYHtV0PjSnkO6BklTm2sg+2pA2xmJgYWbjhxvmtqf2TSmjZ66+gNs:RKwe1oksmYHtV0PjSnkO6BklTm2sg+8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774656595, "uuid": "36bb6f78-d361-4217-b8b3-d941b94d6098", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774656595, "uuid": "7fbd74a8-b251-4fc9-b81d-b32ea479d2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774656595, "uuid": "7c415615-86eb-4eaf-8018-f0cc2a12f0c5", "value": "xxx-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b37e5e-2abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774712672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712672, "uuid": "7fa81c6d-e722-4ebe-ad19-4eed72930de0", "comment": "Malware payload", "value": "bec9189a603b0ee56b6818eeeedb81f5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712672, "uuid": "d3cca567-b4f7-4605-9ef0-2d4ac2e880e1", "comment": "Malware payload", "value": "d92f3c45df6fe93f08ed957450f3d34be4791ef176e9d4685945c26f16e3d1f8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712672, "uuid": "c673eaa2-7630-414d-ae3d-10abb160ca61", "comment": "Malware payload", "value": "f8c43952359f604e52b0bd86c195882716db53ce", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712672, "uuid": "3bae8f16-70f4-4bc8-9357-3e66e52bbcf1", "comment": "Malware payload", "value": "1e8ae6371daf2d19eb1441d336f16893cb60ecfbf5b50fde3225f8a4102fb1db2808aa408c1ca8ce2504aab660a4dad3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712672, "uuid": "3c05caf7-1aff-48c7-bda0-03404450465f", "value": "T15AD3E1C8AD9E88A58B1F7479051F5C078B8EE127061DC9D0BADEAF443F115B835BADE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712672, "uuid": "3a837f61-c854-4098-84d0-35c80a3c4fe9", "value": "1536:g9996666zzzz+++++IJF+1hXYdxjQLi4X:IzQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774712672, "uuid": "2b52cc01-bca4-4624-a604-5d9e25d4328c", "value": 132471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774712672, "uuid": "97f3d82f-384c-4bb0-8b34-7a1fda154487", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712672, "uuid": "2f4c4c1c-a22b-4dd3-865f-9f7225c8064d", "value": "Office_Logs_New_190.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff283f5-2ab6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774709874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709874, "uuid": "45a49f31-1a88-435a-b1cf-4423fea6087d", "comment": "Malware payload", "value": "8742b2458284e4d0b66f22648ffd68f3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709874, "uuid": "f4a7ff24-e1dd-4123-8d1d-3178b7ef05df", "comment": "Malware payload", "value": "d937c5e462f41b5db3954ac322236b8356f6a03385a5daf112a4ac014a86e9d9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709874, "uuid": "f2d7ffb7-5d09-4ef0-830f-1e0c038a79c3", "comment": "Malware payload", "value": "169b718664c2d91e9c7772f8c52f96756d010d49", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774709874, "uuid": "f15a81e0-252b-4c75-823d-76e4be19b196", "comment": "Malware payload", "value": "9c7535ca6f4d0deaf22c2ae06a6bcf0154b9c0cc26246e9839f403c5b0f4f4f5f020ed395da71c8ca986834e9a14c621", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709874, "uuid": "2a469552-9c1a-4dbc-8692-72697fdff5d1", "value": "T1B3079E47E8A106E9C0AED175CA669153BB717C884F3063D72B90FB292F76BD06E79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709874, "uuid": "2d1f794c-889a-47bf-8976-e47c364a851f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709874, "uuid": "8cac86ae-e882-45d3-b7c6-317cc36b79e3", "value": "196608:xMqAMybEAM+bIJd2AVUVY/UJB0HXZYZ5fmXq4kBYuItlscEhxR:xMqAMyb1pIb2Al/S7ufyYLt+cEhxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774709874, "uuid": "9f9f70c9-545f-4c2f-a473-06d8342f547b", "value": 18205696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774709874, "uuid": "398d30b5-3c64-4d8b-b2d2-e480ceb5b602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774709874, "uuid": "eaaec22d-08ce-4bbb-9d93-3c8ac0616dc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38566d69-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686561, "uuid": "c00fd219-81f1-40b3-9cf0-1e50f7449e76", "comment": "Malware payload (BPFDoor)", "value": "3519460043945db8cae025e1d60a0bd5", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686561, "uuid": "4610d814-c166-4ca7-882e-ba847d7ed945", "comment": "Malware payload (BPFDoor)", "value": "dcb4872d437a14dc814015bf749fb2caf4cc5cb1776118c7e1748a4f657b303e", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686561, "uuid": "4b496a24-d910-460c-8b3c-69f760281f1d", "comment": "Malware payload (BPFDoor)", "value": "6b7d8f590cf7d607182e8dc896fcf61ae0bb5d13", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686561, "uuid": "9a3a4528-63f9-4c66-b072-570ca55e0482", "comment": "Malware payload (BPFDoor)", "value": "711c15d586be8e3f37d3a8fe4f4f5a123569b3b8a3b4905e603bb33f51fa3d48349d92420a5d56c046af01ccbfa385e6", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686561, "uuid": "08106484-0b93-46a6-bee2-6d3a1067cdb6", "value": "T185545B4AB6AA18FDC997C8304A2761766DB074A962127D3F3486EE306D16F301F5DF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686561, "uuid": "b91edb23-6c1b-4383-9f23-1fed920a0597", "value": "6144:V5yJ6+erPj5H1JL8g3zyPO0q8iv87n3Wkl29dfArs1u5:/qFCZ1JL8+zyPO0qFvmnGklQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686561, "uuid": "10cc1e40-7d0c-4378-b50e-03bd6bfd37bd", "value": 303058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686561, "uuid": "ac77b621-6be9-4a83-b9e0-0ebd6ccb5ce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686561, "uuid": "b5aec98e-a18f-471a-b53a-4a7beda2e819", "value": "2025-12-14_3519460043945db8cae025e1d60a0bd5_bpfdoor_helldown", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08366019-2a7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774684762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684762, "uuid": "6a2f1c55-3288-47e2-a843-a63c5414c52f", "comment": "Malware payload", "value": "d8fec40c5a7c8b6e1b5ac1663e19abb0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684762, "uuid": "2ffd36d6-aa07-4da8-ba2e-ec431d7ee3e5", "comment": "Malware payload", "value": "df31bc8662984ef8204c422a2f99cd2480dac2c998058181dde3f4dfcfc0558e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684762, "uuid": "79e81cc7-bb30-41df-b443-d1f27b0d3bbc", "comment": "Malware payload", "value": "1384ee8cc708ef38bed53e98b697c42a2b07392e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774684762, "uuid": "44aaed97-b58d-482d-a005-675f1fcde72f", "comment": "Malware payload", "value": "66604fd8ac88d0b1abcdacab095673b625c64cf5d33417dc2ea675ab5d2cd3f0b6acf1930d24f2997982581ac733961f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "surosystem-net", "colour": "#220AA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774684762, "uuid": "d2773d38-8536-475d-a61d-bb5c375eff92", "value": "T18C92B71669B300226917C0BC67A79746333180079645CE2E3FAC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774684762, "uuid": "d9a54251-49bf-44f6-a558-8fabcab7f367", "value": "384:XHFTAsXe7FUF6/+9MAdksb7Rdsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xl8sXe7FUFz3PsafWkkg1kVKUO6IkV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774684762, "uuid": "2d97a41f-a6c5-436e-bfc5-beb76e592c36", "value": 19821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774684762, "uuid": "a55f8bb4-ea4e-400b-8584-c7440f3c7e57", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774684762, "uuid": "94307978-d59b-4e4b-80bf-9693b846e241", "value": "bkng-id2958572165912.com.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba926dbc-2aa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1774703959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703959, "uuid": "d2ff63be-50ff-4f02-8491-6386e0ce007d", "comment": "Malware payload (Phorpiex)", "value": "1979671a27c1e3346484acbb2382b018", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703959, "uuid": "04b86d2f-802d-4582-940d-facf221cfcb2", "comment": "Malware payload (Phorpiex)", "value": "e2c3ef4c8c11ffbeef78009833dde5c44b343ffdf1b314e5f85a3dc270a6e264", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703959, "uuid": "2ede8dc2-7fce-4364-bbf2-2c3fb34b6639", "comment": "Malware payload (Phorpiex)", "value": "2062859a9a569a681070f6f09881b47ad644cf5e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774703959, "uuid": "0d650ac5-6c62-4d2b-939a-349d7cea4de5", "comment": "Malware payload (Phorpiex)", "value": "dac025ed847b3b31f68e2aa0f0ace09b6e831b3b20bca51cb7fadf0017172ab8cb226623f855f612de5c1c0e99f00ee9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703959, "uuid": "f9a704f5-c511-437f-90a2-49dfb1a33dd7", "value": "T1A1824B0FB8824626D1D100B59A62467BDAB8A472339858DBFB904EED1B6C6D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703959, "uuid": "6dbe7668-ebba-4fd7-b4bb-c720aa6d2a53", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703959, "uuid": "d2817d80-f1c4-4945-b25a-e01b206df0fb", "value": "384:PpGIUVp9sQofwvBfR0jfbdAyD+DMav8U9cfi:BECQ70jf5Aw6Ma0UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774703959, "uuid": "522b3e11-d852-49f0-99f6-3f86c9e1937f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774703959, "uuid": "08803dc7-3de0-4700-84b0-ca287f0cfd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774703959, "uuid": "34e1928d-c80a-4e5b-9516-7bb77c05e972", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324033d3-2a6a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774677102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774677102, "uuid": "5cfe8749-9369-4464-a1dc-ef913c643258", "comment": "Malware payload (RustyStealer)", "value": "7d7015746e5dbbac3b28594c6f30fb13", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774677102, "uuid": "349aa040-a267-4165-aa49-f08680f844e7", "comment": "Malware payload (RustyStealer)", "value": "e8082e3c0d63f83ad95af88f50e9ae26512e89113339b66b24068648363d676e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774677102, "uuid": "f90e9211-274c-40c8-b687-57969d5a7d4c", "comment": "Malware payload (RustyStealer)", "value": "bb0f7f7090fe23b712369101a5572d9c99330fec", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774677102, "uuid": "25e7781e-d792-4ac8-b38f-262b777e5552", "comment": "Malware payload (RustyStealer)", "value": "64652e9d2b1fde746acb5ffeda8772ee6b1d50e1ae7f520311bbac850b5a9e52a8bd18f439ca63f948ce6920dfc0d589", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774677102, "uuid": "533cbb4c-35f8-41b2-ae1c-b6ad8778457b", "value": "T1E8051226BA5169BAE119C0B8935587B36E71B4C70B227DFF06E461383F686F13E3C605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774677102, "uuid": "5508d22e-775f-4b2f-abe0-4999272e0447", "value": "93047321cfe14ac165cf7cf25f00d372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774677102, "uuid": "37de83a9-c7a1-40da-92a8-ab4b7bcb265e", "value": "24576:c4YNmVgfiYwkJAN4MBkCaZghFhoRy8vdh:c4YDANOIhOdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774677102, "uuid": "3dd181ae-150f-4d98-9918-9c24e72ca2e5", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774677102, "uuid": "8964b2f0-699a-48f2-8100-51b9afad7b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774677102, "uuid": "a0dff271-0c1a-45f5-8555-e0114d64b3c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17caab7-2ae9-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774731969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731969, "uuid": "56670f4c-5e15-413c-9fab-852d8770d852", "comment": "Malware payload (njrat)", "value": "d36d1bedaae5e54df6700bbb57c6c176", "object_relation": "md5", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731969, "uuid": "899c137e-9004-42cc-b01b-d5f3805f8820", "comment": "Malware payload (njrat)", "value": "e8e71e9cdd4f978f6010ad374b3d6fe91039de7591ea07d965d50cc883d4968b", "object_relation": "sha256", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731969, "uuid": "5bfc853b-e14c-43b4-880c-97cfea4c0df8", "comment": "Malware payload (njrat)", "value": "4ed182e50a3164af91c7a8fe6810044b23081a3d", "object_relation": "sha1", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774731969, "uuid": "e78d5cfd-b7c7-46a6-ae2e-f7343088e34f", "comment": "Malware payload (njrat)", "value": "0c550c03b0a364080f1bd127ba8c7ca211ec3583cb7e43141c870b8d996c13df1e27dd3f386be9017ad6994a319700f5", "object_relation": "sha3-384", "Tag": [ { "name": "193-222-99-18", "colour": "#975370", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731969, "uuid": "647c5a65-9059-4f08-95e6-168e20a702fd", "value": "T13525CF9473F4850AE1FF1B79B4B249494BB7B9529A36DB8F0C84D0AD1EB37408E117A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731969, "uuid": "025d61f8-7877-428f-8233-5e2155840811", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731969, "uuid": "0fc2eb04-0c80-4cb6-89a4-e70ba5754346", "value": "24576:jiXUefxJzck+uGW/yFoBkkAQDUU6Q4mW/NNVh:jiXUefTYjqqanTwfuWfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774731969, "uuid": "2b26764c-1bec-4a13-abab-0ae2074daa44", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774731969, "uuid": "ed9c22f1-d47f-40bb-a546-0455036d7a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774731969, "uuid": "7c46d6e8-f81c-461a-9bcb-5492d7eda424", "value": "hhed6zpvmw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033ff6cf-2a5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774671440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671440, "uuid": "105a3705-faaa-41be-a766-68705e0bb22b", "comment": "Malware payload (Mirai)", "value": "b31abebd69e05bdd6528e5c812c6a624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671440, "uuid": "9436795e-105a-4471-b6e0-ba4c5c49d5a1", "comment": "Malware payload (Mirai)", "value": "eb45effa07848a1fda4c6fbd11391aead7d0efa5bc6c65c5e06d6f2c5f765cd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671440, "uuid": "050e4643-e2f3-4d85-96f3-325b37d75d80", "comment": "Malware payload (Mirai)", "value": "1d0100af781cd65406f1a8432134ba63d3084750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671440, "uuid": "692cf198-8c15-4761-9066-f606d857d26c", "comment": "Malware payload (Mirai)", "value": "2e5e1a53a8379dec4e83657292dff6f3033a423d6d9b81a38bb594214e2645a6baf771a40d73b8451ab387b1a7eed693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671440, "uuid": "9e848df2-28c5-40ec-b0b5-a80818672455", "value": "T152A35BC1FA83C1F6D85704716163AB3EC731D8A45035EA09EB9B9F36D933940A7273A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671440, "uuid": "8723bfdc-7e6c-47b7-a29f-cc3a3cd8bc46", "value": "1536:aAh66xOkxmn0//OhnlWzc6KLwF8MMXYOwoxv:aAsUOkxx/Ng6KLwFqxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671440, "uuid": "79b0c534-cab3-4da4-8d0c-a7be2d62e725", "value": 98380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671440, "uuid": "e7b6fd79-460f-4f61-b145-8739caf8cc5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671440, "uuid": "6161bd96-ea5b-4b74-8a86-4479614f6dcc", "value": "httppd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4ce094-2a5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774671272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671272, "uuid": "a3752025-f45f-46f9-8a6a-70898574d454", "comment": "Malware payload (Vidar)", "value": "125809e9a0a0d15a1a17cb0682fc0151", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671272, "uuid": "45d11bb3-bb68-4c92-bdd6-a2c55ec2e07e", "comment": "Malware payload (Vidar)", "value": "ebd6a9e8e858b1e03e2090527b01fb9aecb9a0264f56f73424fe741b4879e8b0", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671272, "uuid": "aae5df17-b421-4cf8-8c5c-66f1a5624d37", "comment": "Malware payload (Vidar)", "value": "39e57f51417bcf5fc8d173e9f60598e05f953361", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774671272, "uuid": "a122573a-0ce8-4e30-a2d5-a710651b86db", "comment": "Malware payload (Vidar)", "value": "1136633ac922b76f13757948243d4968472d60bd6753ded6d5eaf8e55751e28a1da9353a96b885ab180a7a4d4282e4dc", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671272, "uuid": "459a5a12-40d8-448f-8f9b-e03a82160b7a", "value": "T17E958C437C9121B5D1ADE2318DB192A0BB70B8599B307BD33E52AAB91FB23D41F35748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671272, "uuid": "00674205-7249-4e73-917a-f56763b590ee", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671272, "uuid": "4a17c263-bf63-45e8-a0df-285d7a8bfdba", "value": "24576:EhAi9TLR3EGvVv/aCAZo/HTb3tS1L19bes/+hOcgYguI0NVK1wY:YP9TLBEGdBfs1xz+hAYgu5VK1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774671272, "uuid": "798f572c-80ae-4c9b-893b-9503f09d01e4", "value": 2059992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774671272, "uuid": "b552695e-a406-4c08-8947-d1bd826b1dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774671272, "uuid": "afccf329-1eed-4d9f-a993-39b074c8926e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80e04a3-2aba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774711713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711713, "uuid": "ed603985-d331-492c-8187-423f4e3d579c", "comment": "Malware payload (Mirai)", "value": "f401a19b1a4c5c4eb81a7b99077ba68d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711713, "uuid": "4af22c8f-877d-4d5e-9a1a-227271298d68", "comment": "Malware payload (Mirai)", "value": "ec856e41b489d73f5c46b1df49d4959cdeaebbfe1a0307dc5501705737be96a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711713, "uuid": "2318f3f0-c9a1-4572-a2c7-f408847756c2", "comment": "Malware payload (Mirai)", "value": "678a686bda1c3d06b83bcc44a090597304eef556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774711713, "uuid": "2c505f75-ac21-4629-bf51-10055d47babf", "comment": "Malware payload (Mirai)", "value": "d8f2d44fed34a32370f0749d3c265af89c45e3ff4e7a8eef07289f00d07546cf50e8df750afe360bca1be570e089839b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711713, "uuid": "4bffe794-3d71-4c2f-a0e1-26259ba86897", "value": "T102835BC8E6C3E9FAFD5205B261765F328B73D67E2129FA42C3AE9431D821401D61AB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711713, "uuid": "f786c2e5-f4f9-4177-8d4e-748790ea5e20", "value": "1536:b4P8LJPKUJ6jIGmPIL175kSxfYStG+000000000000000:4EKUJ6blLBCShFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774711713, "uuid": "3ca0546f-5a2f-4054-907c-613dee459c21", "value": 85736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774711713, "uuid": "b5cb9ad7-de54-4386-b191-aa720de38420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774711713, "uuid": "4a12630c-5be9-419f-b741-9136df4cd822", "value": "telentd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce322d1-2a80-11f1-a769-42010a9c0008", "comment": "Malware payload (BPFDoor)", "timestamp": 1774686569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686569, "uuid": "8148c0df-5450-47d1-abaf-48347652844f", "comment": "Malware payload (BPFDoor)", "value": "0e5c58b8f109c5cf68fad6a9a8b50790", "object_relation": "md5", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686569, "uuid": "0a6a2fc8-2bf1-4352-bb4b-d7bc0afb678b", "comment": "Malware payload (BPFDoor)", "value": "ed768dd922742a597257ad684820d7562bb6be215710ec614bd041a22f3d6863", "object_relation": "sha256", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686569, "uuid": "7107f858-f6d4-4a4f-9422-f78541fd6265", "comment": "Malware payload (BPFDoor)", "value": "8414e6dccc0d3fcf027c9f092697b8b55c11ee03", "object_relation": "sha1", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774686569, "uuid": "576676a1-792f-483d-af55-1dd79bc2715d", "comment": "Malware payload (BPFDoor)", "value": "3cdb338c084c309f99dc6c6e00b2f5fd884ab8f6f091b4735dc16e07627517bafcc13ede3958b77e96d250c4d0fc2aac", "object_relation": "sha3-384", "Tag": [ { "name": "bpfdoor", "colour": "#7C9817", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686569, "uuid": "b609c49c-11da-4a07-9f12-e08dbb9be694", "value": "T182755D66B9A710BDC5AFD070C66B8131AE70B86C03217F7B6294EA303E77E205F19B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686569, "uuid": "756dafc0-b33d-4c66-8b58-506d99809d3a", "value": "24576:3pbP6/gk4baF+SU1OeYs0d18C5N9PMWenJTQ5ip4esMzdT:Zz6/abws0b8Cb9EWenkM4esKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774686569, "uuid": "b7e82faa-ce8f-47c6-a4fa-06cd3d432724", "value": 1604472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774686569, "uuid": "0721ebf1-e5b2-4f5c-a9a3-07ffd75bd555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774686569, "uuid": "ef60c6b4-3e65-449c-bd68-8376750703c9", "value": "ed768dd922742a597257ad684820d7562bb6be215710ec614bd041a22f3d6863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f2b4ea-2aee-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774734010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734010, "uuid": "c19fadaf-15e2-468a-8ec3-c5cfb983930d", "comment": "Malware payload (njrat)", "value": "2a4908ef62879412d1aca7a9a64c3ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734010, "uuid": "1a05f2b6-27c9-4d99-aa0e-6a1bd30cd57f", "comment": "Malware payload (njrat)", "value": "ed9a987df263687a79b63c4da4bc4882a5b83491d0a9ddad9d6388b2a1a51960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734010, "uuid": "8e084a8c-bc0d-441e-a600-debf9274a963", "comment": "Malware payload (njrat)", "value": "40fc82d9c86c287e419bd480a8d8cbf63f2f773b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774734010, "uuid": "ec4ff352-6468-4475-b8a9-22bf532082cc", "comment": "Malware payload (njrat)", "value": "55f6f9edf41ec55585d4124f40b06d0cdea34a87f48e6c352062964d9b82ec7d22099685ab7dac276e0c0aa16b3333c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734010, "uuid": "8813b1a1-015c-4ffc-9448-ae7fe6b9c38e", "value": "T1E013C78CB694E174D5FF8BF1A4A2B2890B71A017A902D30F99F154D94FB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734010, "uuid": "920ac9f3-cf4c-4439-aec6-f27b9ee6fcd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734010, "uuid": "75fabc57-7603-4138-8e50-7d681f40fa2c", "value": "384:FZyYcg98NaIyrtdd32E68ETiE7QzsIij+ZsNO3PlpJKkkjh/TzF7pWnLmgreT0pO:PxywFrLd32HfquXQ/oaC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774734010, "uuid": "ac9d6ff1-bcbe-42a4-9377-4daecad2b027", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774734010, "uuid": "a2e9cd9f-5380-4fb5-a0a4-8873164dc6b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774734010, "uuid": "eae0e426-dfc9-4fc2-8bd0-8c4cdddb3f31", "value": "112222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abee9045-2aac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774705653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705653, "uuid": "bb5b8c14-e007-4da3-8d4c-530b9fe071c3", "comment": "Malware payload", "value": "ac1185e06ad523c0eea8f4e6e3c6fa31", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705653, "uuid": "7f3f4714-3e31-4330-abe6-0f558d633824", "comment": "Malware payload", "value": "ee3f6b75ecceef229900944aa924a21d65ed5eb7f0388c763717c791fcd6e2b4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705653, "uuid": "9fd8151b-0681-475f-81e4-81d303bf3df3", "comment": "Malware payload", "value": "d6614f7b9a1d1ae6bf3f8b0ce507b72b7f9629d2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774705653, "uuid": "39bef969-80c2-4af2-9482-debc96ab36ed", "comment": "Malware payload", "value": "991a0bc48922ec2fb983bf4807c85ead058f4121df76c3ab44b8b6736db04a35e204c13da95ebe917f8e68cc0ea6db51", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705653, "uuid": "8873d1d6-f430-406b-b63c-986b45db9985", "value": "T1BBD423B6C4601042C56251FDB366C774684CE7BB8D7EC32397AE16180BD25FA1EA886F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705653, "uuid": "793f1652-19d3-427a-81df-17598aaafb64", "value": "12288:MRmc4DK0XM6o23dRpKp//1liTQs3dJ96h++u5ryvSOYI:VdQ6zLpq3yTXHy0ryvpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774705653, "uuid": "d1fc3bfe-0840-40eb-bbc3-7ee488d3982e", "value": 606110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774705653, "uuid": "9d479a10-dbaf-4ef7-a7fe-85033a9230e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774705653, "uuid": "2a08db7d-3961-43f9-885c-6ea81bacc3db", "value": "ee3f6b75.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ecd9af-2abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774712951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712951, "uuid": "008dae2e-67da-40b6-9984-a5ae66e293fe", "comment": "Malware payload", "value": "d31d8542679240dc63779802776d367c", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712951, "uuid": "0d2da007-9631-4204-a420-5b39852adbaf", "comment": "Malware payload", "value": "ef66e85ac1dcc484b78ccd35ac12043f3f322d0ae2cbfa1e7a3f0eeb1fe6344a", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712951, "uuid": "4968ddbb-bae1-47d0-a649-286a43da6064", "comment": "Malware payload", "value": "b93b9880c6d00b92726337bd4605351119bc01d1", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774712951, "uuid": "549d0934-3713-4c72-b85d-f8faeabc3096", "comment": "Malware payload", "value": "76810d65612d7dc45786350170259db3214150d8b4720a9946461a0463a3b0b3aba66f9e61011d92bb07f7973159ea31", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712951, "uuid": "4e667580-f6b7-4353-ac86-f8f10adb91fe", "value": "T14E282306E39251B9C57F44318D6FEF27A634B51803646FE79380A9307E21FC16F2AB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712951, "uuid": "af1e65ca-525d-4ecf-a934-ca3388dca9bf", "value": "333777f472c1cabbf61d5457df32505f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712951, "uuid": "a06c2e3f-3677-41d6-ab57-e335f3cb9b1e", "value": "1572864:fqOuQIOG9F3M3k6pWrp4aT6HtNjfjoGBMGDimkJQa4XxT1A:yYkmMp10by+W0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774712951, "uuid": "f689ba5d-3b6c-418c-897e-9c2f5fa62d5d", "value": 100180992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774712951, "uuid": "1b4a7374-87f6-4a3e-b2ed-5f7e79e8b683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774712951, "uuid": "ed25d9c2-7a38-45cc-8f95-bbfba33a08db", "value": "ldplayer9_installers_windows_x64.8.6.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0e9a7a-2ab8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774710590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710590, "uuid": "81492916-356c-42f0-8826-a39c34354808", "comment": "Malware payload (Mirai)", "value": "6196903059df0d53c9d9fc7a05f17358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710590, "uuid": "e819a48c-4f50-44bb-99bd-88c9f2489c29", "comment": "Malware payload (Mirai)", "value": "efa4036feb52590153147960dfa2b6e652a3e8504a71730fd7b90ee2ece1f99d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710590, "uuid": "1953a7e0-7042-4956-a5b9-e608091e2bf4", "comment": "Malware payload (Mirai)", "value": "0ff17cc60ff427853c6280baf1ceb1295ff6e539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774710590, "uuid": "88e1e8b2-7e60-4865-8d80-71fb177b2753", "comment": "Malware payload (Mirai)", "value": "15e3f747efa2a1ebfc345f907d919f446f77b94c7ac8146683a93211c013fd94f57e5172afc1274a442a2a3699755764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710590, "uuid": "ea024f9c-cc68-4d59-8967-e799a189852e", "value": "T1E8F2FAA6B7B91B3BC0E0637951F2670334AA2BE504B0C34FBD550D6D6F92390A567AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710590, "uuid": "7b41d59a-cc39-4b76-a993-db58c5463251", "value": "768:RWu62wHk2185ebRalDXZIReVDkIbsrtqyH4TwMIZ1TOwS:RWugHk2185eslDdkQWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774710590, "uuid": "53090fcb-9c99-4517-b554-915b750068ef", "value": 35592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774710590, "uuid": "5594e651-04a4-43a8-af5e-0f3cd6192b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774710590, "uuid": "79fae8c3-4bb8-49d8-b3d3-a19709299560", "value": "attd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ec8e53-2abd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774713051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713051, "uuid": "708c5534-1387-4963-bc8a-5eff7585b2fa", "comment": "Malware payload (Mirai)", "value": "371e43b0728bc270b6197fc2931ced26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713051, "uuid": "60d36ea0-3175-4456-81be-97620c4b887f", "comment": "Malware payload (Mirai)", "value": "f141c9d281fac7095d6c5d529672014a5599d10a7475fe2d85d4ecbb5c1ed673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713051, "uuid": "2cbe288a-12c8-4c9a-a199-7fd77e681070", "comment": "Malware payload (Mirai)", "value": "8b0317942f128dacfcfda7706e27e2bc9c5bf579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774713051, "uuid": "bde9973d-ffd1-49f5-9dd1-5a0419d504f7", "comment": "Malware payload (Mirai)", "value": "874ded8334bd31aea11aa6ad5dfba5a16042ca8f8d56dd19a6476db5eec73c088bf7efbc6de7ca4347bfa4151104d828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713051, "uuid": "cfed65e8-47c2-4601-9b27-ca95c831325f", "value": "T19A836DC6F983C5F5D86304716167A73EC731E8581066EA4DEB9B8E74CA33881D7273A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713051, "uuid": "aa015d46-26a8-47f2-a388-6a89dcaf28d8", "value": "1536:ncBEnL47eNrM2JPCxPu0b6WbC5e0cOVOwQ5tfPc:ncqL4mrrPCZ7u5ehOgfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774713051, "uuid": "209a6c96-da6b-4464-9137-fb6e45efe2d4", "value": 88712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774713051, "uuid": "24d84848-9ad4-4aa5-b1c7-928e60a64777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774713051, "uuid": "0cc9254e-0a8d-4848-aa92-b13eba82f47c", "value": "httppd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e699889c-2ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774720354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720354, "uuid": "2254510c-2e47-4490-beb5-80e3a81db5c9", "comment": "Malware payload (Mirai)", "value": "671e9d728437b0597b3bfccd6ee1b51f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720354, "uuid": "7184a9f5-e1bb-4b35-94ec-62aead70adef", "comment": "Malware payload (Mirai)", "value": "f161694a49dbde95c099ca2c8f7e4702dafd2d3247f6bcab0eed76ed6463287a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720354, "uuid": "d3435dfd-20d2-418f-888a-feec3827d835", "comment": "Malware payload (Mirai)", "value": "1bf076c85556861c60137043016225d364cb515a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774720354, "uuid": "cb260b7d-6053-4f53-ad27-170adb619f62", "comment": "Malware payload (Mirai)", "value": "27efc663674a305e8b28efa23fbbe816264077a758d9426d9df55bb4f6dcb5dce8ca1874d2af7bda09d57f0b357b6c74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720354, "uuid": "65fa8c62-bdbe-43a7-8185-5f08f7b24036", "value": "T1AE230271890E8EB164303C36DBD9D793B6E12AB1C6672013962D0A3C6F75B231E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720354, "uuid": "9bbf3878-cf78-472a-8ad1-5ebb9cc63391", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3e9q3UELbUXfi6nVMQHI4vcGpvd:DECFd+A6YHAxDLRQZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774720354, "uuid": "912fba2c-443c-45cd-85bb-cd642e37d537", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774720354, "uuid": "e42f1e80-aaa8-4715-82a7-87f80eb5ea73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774720354, "uuid": "50e27f56-b944-47db-885d-e194b5e97a25", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db675fa-2aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774706783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "3b0d07e0-7e68-4ae9-a3cc-95cf843174f6", "comment": "Malware payload (CoinMiner)", "value": "864123133a2fc9d552b7dd36513e1993", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "478c687c-0341-4b1d-8079-f04625b68fcf", "comment": "Malware payload (CoinMiner)", "value": "f2ce62363ca63ecb004d4b764566ebb10653b9b16b26b4a5d7a2c50e60a6f0a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "e177363f-d1d2-4f90-9469-ba3388e37a36", "comment": "Malware payload (CoinMiner)", "value": "fea02b26c00a3ce2addc47332fcd3de0ead5caa2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774706783, "uuid": "a98241f6-d1bf-4166-926d-f7fbc24086d4", "comment": "Malware payload (CoinMiner)", "value": "42cf19f63f7442aed1f7824d309324140bd4cd04c27b22eba9683a77842d122ceac6852be99bd27edf99b89cfb63bdfa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "cbf4bfe3-efc0-48b6-9abd-e1d8f0999ef5", "value": "T1BFE633CE64AF94E8FC4AFE7847233D4A25EE1ABE776A744951E1736D3130070E4241EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "93da8c6b-e8b2-4f94-b75c-0af51a6b4698", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "fdd04bd0-06aa-415c-9705-995287895ba1", "value": "393216:/Y8etAYP/zCQvYgOv5Z792k3rLur2WU/I9S4IIwrX:/03zvvT851lrCiWUQMmaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774706783, "uuid": "4035094b-ca31-4706-b2ff-3fed51e48de5", "value": 14084096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774706783, "uuid": "7e282f4e-b544-47f0-936a-321d0d6da079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774706783, "uuid": "e76af81c-951e-4eed-b8ea-9f183d7ac982", "value": "RecoilX[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507277ae-2ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774714948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714948, "uuid": "2cc138ef-ca58-4879-8790-eadd2063cf91", "comment": "Malware payload (Mirai)", "value": "1b33726666052ac492720ab4f067ec72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714948, "uuid": "24b04544-a5c3-416f-b7ec-bee41469fc63", "comment": "Malware payload (Mirai)", "value": "f44ae2df5f7fc6e37b2a9818464695ba33754d7ded6401868494a0294a89e1ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714948, "uuid": "36e89816-1f9d-47a1-8ab6-2eb836a8cd56", "comment": "Malware payload (Mirai)", "value": "aa1e7b7223a10b69f1961d5363b5433bed877497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774714948, "uuid": "6e45174a-7744-4b94-9a66-103811d5d18d", "comment": "Malware payload (Mirai)", "value": "ffbacf654fe144c37f082c8bfacdd43b14e7e982432b9364b9a22f9cdb06b48b5fc5ead125ee4677f2e965745934b660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714948, "uuid": "22c76304-d492-4847-add8-8937f3d1387c", "value": "T1B8C33B49F8508B17C6C216B7FB4D428D7B2617A8E3EE72039D256F21378B95B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714948, "uuid": "aaa963d7-8f46-44b1-a796-21666d29cd18", "value": "1536:Qgxxl2MPNwPY1585n2Vd9UXC+NKnlTTpQ4V5w7HBqdnbNpS8JrbklxBwywdldaL9:QiwPga2VzWC+NKc4c1qFrhrm9J8bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774714948, "uuid": "1a1e1d96-e0f0-4d8c-a9ab-715712834000", "value": 124812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774714948, "uuid": "a7b60891-716d-43a4-9c9a-fdcbd99c2c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774714948, "uuid": "9150b05f-d8a2-4938-8b79-ade29ef21a78", "value": "avahi-deamon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25d1060-2ad2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774722038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722038, "uuid": "b2ef05c8-c12d-4aee-8380-ef12e508d5b6", "comment": "Malware payload (Mirai)", "value": "3479f371d7e403c29dc0f550e0938531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722038, "uuid": "b73ee229-bdd8-4d54-a536-ffecc0a2905c", "comment": "Malware payload (Mirai)", "value": "f50cd291a2efa1439b1a597564c0ece3d3348a5522e90c08f1399cf3352b8c56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722038, "uuid": "25278d10-ff3d-4988-ade0-035f23e27c8d", "comment": "Malware payload (Mirai)", "value": "425b32737655c84262a8f8e0374f4d17bdbf9379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722038, "uuid": "1c80a10b-81d0-41fe-98a3-a0fd4b6ed369", "comment": "Malware payload (Mirai)", "value": "53f4f42a680091724b3ae4ecd5fb264be48ac007a5147d4cad5a5887d78faf6b0a6006e72775cdee7856bcf35c9e1e24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722038, "uuid": "dd967c97-18b3-42b9-9ad8-aebe21fc8daf", "value": "T1BCD3D80E2E619F7DF769C33547B78E21A39923D622E0C686E27CE5111E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722038, "uuid": "41a28ceb-5e8c-4d08-8bb5-b448532960a5", "value": "3072:lPYZ9x/fU4vqj8dhnr9+ALdKC/1HRs0ywYV7DTvv:lPk9x/fUWqj8330C/xhhiTvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774722038, "uuid": "3928a85e-3a91-4540-b6e3-909882e95833", "value": 134260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774722038, "uuid": "ed2211cc-46bf-43b5-ad1a-53b66558cc81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722038, "uuid": "1088cce0-dbbc-4b79-852a-512d57f905b0", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9437702-2a75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774682106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774682106, "uuid": "0e9a82d4-f3a5-4def-af92-3a47a2c9298f", "comment": "Malware payload (Mirai)", "value": "bf3c3bcd2abb3c81d352061358d20b7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774682106, "uuid": "31eb871c-fc8a-48c3-a4bc-13a1122ab0af", "comment": "Malware payload (Mirai)", "value": "f512aa138d45a334b5158b527ddeb2009d8192b007840a172f035b2f9c41a55f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774682106, "uuid": "ea919b98-1c18-4a05-8be5-d4da91d5bdc6", "comment": "Malware payload (Mirai)", "value": "c0841ea5e1a8bc11561e7eebe2afefd7fd9e9d5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774682106, "uuid": "2f48b764-78e7-4702-a294-759b833c61c9", "comment": "Malware payload (Mirai)", "value": "24fbcd5632181ee8e61341e26483bb4ddca52c368f550c734006b127f7b16bdf733bff1e38db51fcf4e7e04c3b71d912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774682106, "uuid": "2a8fd1bf-3f8d-46c9-8cf2-deaacfabf8f6", "value": "T13C9383497FA00FF7ECABCC374AEA2B45248D651A21A83BB57934D418F24B25F15E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774682106, "uuid": "27b9cdc2-dac6-4f97-9696-e41a8512384f", "value": "1536:N7oLX7L3E5BIBslZpImQ5/0R7Ns3ZZKiUDdK:5oLXfaBI8ot3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774682106, "uuid": "9bfde864-0e6d-4720-a8f0-032baf74a645", "value": 97224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774682106, "uuid": "3fe48939-52f7-4db7-8387-c5d23230e6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774682106, "uuid": "fe767596-94e8-4e3c-9ad0-70012cf51300", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb8a365-2ae7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774730887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730887, "uuid": "fecd42e6-7619-441e-83cc-b9cb53b6a4c4", "comment": "Malware payload", "value": "08acb2a1f9e9233c7874d1f5962b2b22", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730887, "uuid": "daf0d31d-02a7-4099-8d5e-6874ab55ed5f", "comment": "Malware payload", "value": "f64c03fd35001825ecd40ded2df0d3c4f2069b396557167d098c9dae8cf49f91", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730887, "uuid": "15ac5aff-89c8-4fc3-8190-e4d8b5b667fc", "comment": "Malware payload", "value": "97e61912f5bc9abe76e11bcec33c7b902d8ecd18", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774730887, "uuid": "328477a7-d5b3-44e1-b55f-fecf5915d448", "comment": "Malware payload", "value": "77b5ee106462ed4e39d8bdc4479fd359f246cdc1e5d575884c63d7c0309fcdb52fa0d2cfc3bf9d4eb534a6ddaadf4514", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730887, "uuid": "e9fdc9c5-0c2f-436e-a1a5-3175f0247e99", "value": "T11E558E16A66801FDC0BFD2F8CE564913E77178494331AADB17D09E621F27AE49E3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730887, "uuid": "98ed4f8b-752d-4d9e-91a7-ca71701852bb", "value": "d15850281a07c4afc390744986dca8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730887, "uuid": "193887b6-d8a1-4d25-842e-3c7650172216", "value": "24576:EuKiWIAluxK10TMElVSDq4FtdEzuVWLxtsv:e7IKqKmLlVd4BEjxSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774730887, "uuid": "581a7a26-3612-49b0-8a0d-b062db0c73fd", "value": 1290068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774730887, "uuid": "d1c098a5-85a3-43b3-9397-eac3cd21265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774730887, "uuid": "18cf8321-d9c2-4599-abca-b30411e48367", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01ddf52-2ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774722866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722866, "uuid": "cad477ed-0b73-412c-bf73-a5ebe36d1855", "comment": "Malware payload", "value": "85c86cbc7defb27d1c1c8038e42afd6a", "object_relation": "md5", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722866, "uuid": "7ac52727-dcd2-4ad7-a5e5-3646162da5c2", "comment": "Malware payload", "value": "fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0", "object_relation": "sha256", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722866, "uuid": "a7442c55-d1db-40ba-a4b8-262af2ce3fa7", "comment": "Malware payload", "value": "228927e9ec82bc88ede4a9008719e992418d9863", "object_relation": "sha1", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774722866, "uuid": "f3b54cd7-a896-43e2-b25a-55f5cf5aa9c9", "comment": "Malware payload", "value": "4a240d70ccad80c832527d4c0c6e755c401cfa22562e2b52dc3a0bd47f75bdf3ddb0c60750fa29daf023de3c5d166ba0", "object_relation": "sha3-384", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722866, "uuid": "a73c6b27-96eb-4674-aab1-313f44b58065", "value": "T101E27D46FA04D232C5421B31425FABE48F769C44DFA7215236EEB38C6D379D065BB9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722866, "uuid": "51673349-c85c-45f3-82f9-8b75dcc03add", "value": "768:tMstihWa2x3UcnjFgjTrHgYFyeWMbC3WN/nq:dtihWxx3UGOTAYFyob4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774722866, "uuid": "5e6dc4f3-37fd-42d5-8836-7e570535388f", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774722866, "uuid": "43fd1e60-b566-4da6-a15c-7a9e14ca7e13", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774722866, "uuid": "4a4c319f-9374-42f9-bc7c-60d392a6bcd1", "value": "Transwiz.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }