{ "Event": { "published": true, "date": "2023-04-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-23", "timestamp": 1682294581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1aa9c0c8-5d41-4725-8ace-595e8d126782", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b095cf-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682213087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213087, "uuid": "01c427a6-3dc6-44cf-9870-b3f5d1756988", "comment": "Malware payload (Amadey)", "value": "208492aeebdc3c9581ec74f46a1041fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213087, "uuid": "a52d797c-f18d-47c7-8a97-0adc5749affc", "comment": "Malware payload (Amadey)", "value": "004345330eafdf975df19364bbf0704d182d74736b3b37c51de9fc96de4c6e36", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213087, "uuid": "41a75c41-f513-4ef4-9f7f-adf2530119ce", "comment": "Malware payload (Amadey)", "value": "64027aa25680a123c4517d995ae820655dffafaa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213087, "uuid": "d3a8a0ac-92c3-4499-90af-210ff2360ffd", "comment": "Malware payload (Amadey)", "value": "be386b681ffb2b81110a61089abccbac47e911483078eb81bedb8f1705c63238f9b4c013d848187c8035ad798bd68b11", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213087, "uuid": "62666670-6132-48b3-b7bd-65fc8aa80142", "value": "T1ED352323E9D89035E9B82FB45AF763D31E397DE20A35468B67C1684E0CB38C4C93535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213087, "uuid": "67c73f81-6f7a-40ce-a579-3f9e6a1c7fd0", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213087, "uuid": "d5afc7c1-be65-410e-997e-263ae841ae4b", "value": "24576:WyWLVBZdARbM9RNCACuycgkz4ugtAchXMEmpTaDUThk:lSVYM9RfgkzwKMB7DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213087, "uuid": "1f9b6c12-6eaa-4ff2-bc64-6fa33d002b7c", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213087, "uuid": "f4738534-47be-4f17-8a7e-2829ee0af0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213087, "uuid": "51c7bcac-2592-4e02-9910-cf06ab2fe2f0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df365387-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259145, "uuid": "8f7b4c3e-bb0a-4bf1-b784-b17e7af6ea08", "comment": "Malware payload (Mirai)", "value": "34240a89e38cbc2f90f0e7dd95002d81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259145, "uuid": "e4e973ef-9eac-41be-9a8a-d29cbae20574", "comment": "Malware payload (Mirai)", "value": "00b33f20242af3a07ff04b14302f5607bd9ad8e8c557db9837269a07b891d5b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259145, "uuid": "645c2117-529d-4078-83b6-5298914e66b0", "comment": "Malware payload (Mirai)", "value": "197f0601b95d21a48b3291193a0452001f434667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259145, "uuid": "2378d4be-b3d5-4d23-9b68-c5a3f69aef25", "comment": "Malware payload (Mirai)", "value": "a987c36c89f5c97f40874276f88daaa44224623a2a2ee855b6bfb194fd4ab0f092b91e24112327cae285b995e16f00df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259145, "uuid": "097372d9-fae5-42af-8871-dbdebad63d61", "value": "T1AC338D36F42AEE90C0494174A4698EF81F63F1C487633DB65AD143A25087EB9F618FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259145, "uuid": "b640fac2-a763-4f17-9412-10027428c7a5", "value": "768:JaECCyQh4eFFey9fTeDwtpZs1sTwEUU1l+icfsLL/qpC+ola2hsYtV1:JaEmQ2kFFF+wtpqMl+iWsP/qpOllsY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259145, "uuid": "53921016-ae0c-4a60-826e-80d9532aae6b", "value": 51116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259145, "uuid": "4177473b-3c6a-45a1-add7-5e35c86d47d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259145, "uuid": "f45ae393-e404-4158-b0ff-be358e33a90e", "value": "34240a89e38cbc2f90f0e7dd95002d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f57ecdd-e203-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682273828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273828, "uuid": "507eb78c-6903-4f74-a143-3d49b07f4575", "comment": "Malware payload (Mirai)", "value": "3a6b413ac5d752ca8a4accbe3c4bafde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273828, "uuid": "8ec31dcb-5340-4799-b01b-29250270f37c", "comment": "Malware payload (Mirai)", "value": "021cf0a6abaa6adb3dfcd06ce00a1abfb12e93c77bc063d28ebf2606b46d87a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273828, "uuid": "5c77fe5d-ef25-4e31-91cd-5c92b68e2b35", "comment": "Malware payload (Mirai)", "value": "6512bc669e86a0c60c88ec8ca0bc0994b9b7b999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273828, "uuid": "99be25a9-6a5b-483e-abe3-32e2f13fbecc", "comment": "Malware payload (Mirai)", "value": "93307295a3532a6ec12146705d46b9619097a5842a6791e4dee8ed43e87f03876abfde9ccb0c9dc46afb6576549a5b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682273828, "uuid": "77f6da99-c84d-4491-925e-79e34fc73a7f", "value": "T15EE32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682273828, "uuid": "27f3332e-8ddc-4ad8-ab00-267d48dc64a8", "value": "3072:CJLce3pC5mG7/abHbz4NpaIJ8VIJ1FfUXkkTM/9cHMY:CJLcea/abHbz4NUIJxHfUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682273828, "uuid": "2f669ab4-495b-43e8-ad8e-8a51fddef6b7", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682273828, "uuid": "0c20b4c2-be27-40ed-b678-9a457bfda4f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682273828, "uuid": "acc08534-7ab5-46b6-b211-cbbefbdbd0ad", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebda3d70-e1c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682247570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247570, "uuid": "925f28e1-8ce6-481d-8bfa-d68555dee995", "comment": "Malware payload", "value": "58d6eab3aafd9139a2f1c7606ecd4cef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247570, "uuid": "db5a0b30-4409-43f9-a27f-26bd3f4bbacd", "comment": "Malware payload", "value": "02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247570, "uuid": "5b406452-18ae-4b07-9981-2212d2388a57", "comment": "Malware payload", "value": "4152a7431b3d5dd8b0f6ad08148cb166315f41e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247570, "uuid": "265814f1-1312-43e6-a895-507d09d5dd25", "comment": "Malware payload", "value": "1d33338653aaa7b2b368ad0d8c739e8dc61d24d5362848334a1130bd9aa59daf7564317a204ba26c6023190cef36c964", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247570, "uuid": "a65dfb60-78af-471c-9cfc-b96d8b7d09aa", "value": "T11A636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247570, "uuid": "a0bdc819-e2a0-4846-a90e-ed8934eb997c", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247570, "uuid": "11045b86-2691-4025-8b14-a8bae27dea02", "value": "1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682247570, "uuid": "5f1123a8-8639-46ea-90a0-1d18f41baee9", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682247570, "uuid": "3b8bab34-104b-48d8-8436-63426f2d8abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247570, "uuid": "d5fa4d4c-36b4-4660-a7c8-1e422546160e", "value": "2023-04-22_58d6eab3aafd9139a2f1c7606ecd4cef_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9c4bb5-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261263, "uuid": "4233d4c7-489b-4462-a0ef-14a4440458f4", "comment": "Malware payload (Mirai)", "value": "dc60a0e6f5ddf4136333e57df179b01f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261263, "uuid": "96f19f4f-b39f-4154-94c6-df646ba806ae", "comment": "Malware payload (Mirai)", "value": "03893f193ccc362c5f5883f3e1ae8d1d84a153d2553299810c903ff6f918ff88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261263, "uuid": "1fc1f36e-f9a2-4101-a1ae-51fd37ab86f0", "comment": "Malware payload (Mirai)", "value": "ed323892023e5187bd0e6690a5c387e05259bace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261263, "uuid": "51729b84-df06-45fc-a021-2585807039c0", "comment": "Malware payload (Mirai)", "value": "dda4d56656f100edaaa0b75008ca3c5fcf009093e33c23addcc39fb4d4875771131390bbeecfae2f3ef9fe2e336db002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261263, "uuid": "e5f4104e-ce9f-45a0-bd93-14e9144b5d85", "value": "T132C3F81B2693CDBAC0478B795B8EE01378B2FD3F073A51026785FE642F35AA4598B351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261263, "uuid": "96ad05de-83fb-471a-a813-3cde5e2d713b", "value": "3072:fMcFwStKLoJZA9pd3RJQZEC2tsDvGBMfp4qeRlVUncRSdws:zILoJ0Bi6CicuKRZeRlVUncRSdws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261263, "uuid": "b5686034-5e24-4857-8c9b-9be42940226a", "value": 129833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261263, "uuid": "a925ab22-3be2-409b-a4a9-f26124f674a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261263, "uuid": "293e56d4-3465-4f47-bf64-630751657550", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9e94ae-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258441, "uuid": "878509f3-8d6e-46cf-83a6-9b1897ecbd72", "comment": "Malware payload (Mirai)", "value": "b86c4a382f2615be8a87db2e44838d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258441, "uuid": "945ecbf9-77ab-46b2-b365-44773b65194a", "comment": "Malware payload (Mirai)", "value": "051ee232558460348856dfe74c82f64329157f919efbe37066c63404ff9dc383", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258441, "uuid": "cdb490b8-d728-4622-acf4-cf766bfdda31", "comment": "Malware payload (Mirai)", "value": "b30439c4135dc3a59fbc5a59cc4add8d433e7438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258441, "uuid": "6667da01-b361-4e55-ab69-5c90e48da004", "comment": "Malware payload (Mirai)", "value": "269d485857ccf8ae4dd457cb9eff68d5190f9f2da68c84a0b2068158bc5d19b74a0fffdc5dce90990d8bdad968aa9e0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258441, "uuid": "4850087b-8e64-4bbe-ac73-a013f21dbabb", "value": "T1C8230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258441, "uuid": "9171f9c4-c562-44a5-8cdb-59f003731b44", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THK:5DmKF7Gxyk8cqoHAmWurAufsD5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258441, "uuid": "875f813f-aba9-4815-b034-82c101f56b81", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258441, "uuid": "64e9e220-bc23-4e90-86dd-6a38e6415fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258441, "uuid": "c7fbb4e7-85ca-4887-afee-d85371012c3f", "value": "b86c4a382f2615be8a87db2e44838d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227d6e52-e18c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682222750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222750, "uuid": "d6e36b80-6032-43d7-b6b5-67c022371b55", "comment": "Malware payload", "value": "19b0536110abbf617e2287318d700a6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222750, "uuid": "02a3470d-67d6-4553-b317-fa395dac3702", "comment": "Malware payload", "value": "05817a1afe6a00ef6a865bb9943ce4b6aa9b0c0e4f8039c88361b1a9b90b4c25", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222750, "uuid": "6fbeef39-d7b1-4316-94d7-58351ea1222b", "comment": "Malware payload", "value": "95b4a1defbfb958ba092e5f2bbbf0261e494d8b3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222750, "uuid": "86d39d8a-040e-46c1-820d-ee5bd64b1337", "comment": "Malware payload", "value": "8a423a628ff8d8613b9427b8be1674390de3b34e078198c2a1da6c5237c4290eb87ad871ab7f913d000cd7238f190bad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222750, "uuid": "d741dba9-2c5a-4e1c-a674-5f7c68020d57", "value": "T17FA6228079911ED7FD05F2B9804F8A3C479AA336DB89D543B94EC2D87F471E44DA2A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222750, "uuid": "1f13f2dd-4b5f-4829-ba17-08d5f75deaa8", "value": "196608:QQu+Ehb8suVM4bPZDl/WJ887mtb5NoOdMnwPRxHfD3PkEFP4PJC:XEhxUbBZsOdcEdb38PRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682222750, "uuid": "de398514-fc1a-475e-84a6-56069d59140f", "value": 9577807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682222750, "uuid": "14e3ac42-10f0-4f2b-84b1-ab713b54b0c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222750, "uuid": "7472fd53-357e-4c08-8f8d-d414909da881", "value": "Hitpaw_Al_Editor.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af926e3f-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232436, "uuid": "d728b352-8d55-45bf-b516-6737a21bb241", "comment": "Malware payload (Mirai)", "value": "ea840eb5fbd29faf19f3d4ee7c9bee36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232436, "uuid": "934e086c-333c-48b9-8df3-73cb63a88118", "comment": "Malware payload (Mirai)", "value": "0591d584cc4a0feca8072ffbd6c87d1462545620708fb60c5b0e5f415006c2ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232436, "uuid": "2f742e71-8367-49ad-ab08-a610c90cfd2c", "comment": "Malware payload (Mirai)", "value": "425026aa351259fd954f8d99c9d4f4f51ab022a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232436, "uuid": "9bea9c4b-f9a1-40db-88cd-b2bff3751ae3", "comment": "Malware payload (Mirai)", "value": "d960341170bc65f11c71320f8c886b70f40ec3b57c0e0a68248f0f8b1f0c0ea8da56472a96725fdc184a4f85c6519238", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232436, "uuid": "6a9073eb-0e8d-46b9-a857-e3e07cbcdd6e", "value": "T172E2E24109367DE0CF70113ACDDF190B34E916F5605A35613B85D36EBBE2A46F0E868B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232436, "uuid": "9e6048e0-4b24-4286-a5cf-4de6c6c74cea", "value": "768:G0F93/nwytJz8EmMY2fbxMK5l9EgXnLPVF6JA4rj9q3UELjxs+:Gm93ntJzBmP2tMul9EUdoJILd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232436, "uuid": "cb9f85bc-1202-4b73-a642-5d5fa7660929", "value": 31560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232436, "uuid": "f28c8bd2-e655-4866-9bc4-59b0fe6511b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232436, "uuid": "309a3f98-cf1e-45cf-9a65-347244ea0a11", "value": "ea840eb5fbd29faf19f3d4ee7c9bee36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07aaba5-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261697, "uuid": "80a4924d-0ffc-42db-b527-4c7f82ae9c88", "comment": "Malware payload (Mirai)", "value": "46ac16f5a991379c92c6b2691d6bffa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261697, "uuid": "6e1ba296-57af-40cb-9c9c-0c35e7f1ad6a", "comment": "Malware payload (Mirai)", "value": "062637f23e937361943e87b6a3709d81c168d6169962bf971a179759997a22a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261697, "uuid": "61b90079-4829-4e17-925d-312dc64f1656", "comment": "Malware payload (Mirai)", "value": "e8f52d3d379c331b4d3e1fc46a7d8d6c9bdb07e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261697, "uuid": "6ce94406-a23f-48d1-920f-0d7f0b56efce", "comment": "Malware payload (Mirai)", "value": "136b311fd4502e510630ce9b7eb060696bf6d3a9f3f94c2bfaad782fb3f16e6ed305680dfe46a0906dc8a9b542ddec6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261697, "uuid": "df8605dd-5dad-43ae-974e-221d991fc21a", "value": "T10BC2E1F617D827CBF9F922B7E0B0C61652C990F0C32B178263C0E456806B619B2B5EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261697, "uuid": "8dc7e075-ba91-4981-9ffe-6782ba66f123", "value": "768:LWE81DbtbUk8nuXCf0QYHKGkl4Wr2xGJt9jCOj:LIbjSf01qGklTr/j5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261697, "uuid": "649050d6-ac2e-4a25-8aaa-e2be95a7f6db", "value": 27752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261697, "uuid": "6ec03b7a-f593-4667-a810-c4aa256fd125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261697, "uuid": "cd5b2866-5f42-405e-ad65-e6213d99af67", "value": "46ac16f5a991379c92c6b2691d6bffa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e061cab2-e1a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1682231659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231659, "uuid": "30eb5022-26c6-455d-8e40-435bc82d2d32", "comment": "Malware payload (QuasarRAT)", "value": "14733fd5597f39704c5029997540be19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231659, "uuid": "04edd8fb-5d28-4c3e-9dd1-93b45d4e8716", "comment": "Malware payload (QuasarRAT)", "value": "0767b70abcbe52dde7d3997f689bbd65db1feeaf4f2861e85b3ca869c4017dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231659, "uuid": "06f57e8b-52c0-4e3d-a5f7-eb7062716ff1", "comment": "Malware payload (QuasarRAT)", "value": "8b546cb9b43b8e163faa425e8807a17151210d9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231659, "uuid": "1cb9a3b8-e009-42af-9acf-5932d8640db2", "comment": "Malware payload (QuasarRAT)", "value": "70191a2250dda96dcfa7e148735176f1c5241e0d6c4bac215d8a84169ebf30af2c19a2b0bdf07f745625e0e64b91cd80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231659, "uuid": "aab8a94c-5a46-4071-890e-e2b8ed556189", "value": "T18495CF91B7CBA5EFC2460470E0298D47D3948FA64F209AC7DD9C68246973FD91ABDB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231659, "uuid": "730a7561-ff50-4368-bb27-04f5cb3870eb", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231659, "uuid": "4ff88776-efc3-479f-b98d-dfccd9710971", "value": "24576:O+rC4mU6rP8/8fFNjy+W/wjFdUwIolLQKfIASWWeT/rZ2zEhosJqNZsWYoDmYzG0:OKO8ku6LUJep2AhRJqv0wzWjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231659, "uuid": "63daaa22-b125-4524-bf6a-b5a8ed665dda", "value": 1911296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231659, "uuid": "1b4ce241-ea1e-4bc3-ab42-00fc992180dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231659, "uuid": "1b5f7cb8-4b1f-43d0-bd84-74e4310429d6", "value": "14733fd5597f39704c5029997540be19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cc9af8-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232446, "uuid": "db03169a-2049-4df6-8772-00461e61ff5b", "comment": "Malware payload (Mirai)", "value": "16ede0ddae5609ebd89beb623e211f3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232446, "uuid": "51d0d4cd-8992-4f62-9a8e-619c7cf85df2", "comment": "Malware payload (Mirai)", "value": "07ff0d6d85c7dbe68c934e2a12f3002ce634eab52cfe77537dcda5c8dd2db64b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232446, "uuid": "6a0fa36e-cf7a-4813-b41e-973df84b55e1", "comment": "Malware payload (Mirai)", "value": "ead687272015997114d893d82600ab78bdd4ce82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232446, "uuid": "1a1022a4-904c-47f1-9eca-38877688df6d", "comment": "Malware payload (Mirai)", "value": "078fc0b29d65d4f4b001b2b4a9a88d762fc899d0c1d39bcff91003d57abec14b60d664eb1f818a7dc3ab6dffc55e714c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232446, "uuid": "03f37634-ed0f-4d0d-ad4e-188d005ecfc3", "value": "T1A4C2C0E4E44C2B8FDEAF6B74209AC4C467864FCEF741CF9111066F4241A751A2925ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232446, "uuid": "b06defd7-b6f1-4941-a557-42decdcccec7", "value": "768:DAs5Z+8Oj2Xxa4+5tYAAE0xiU4uVcqgw099:D75Z+qa4iFAE5U4u+qgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232446, "uuid": "d4aa24ae-0484-4f95-8159-146a84af6373", "value": 26156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232446, "uuid": "8ba66ddd-37bd-42a2-bd31-36d88067a20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232446, "uuid": "7fa7c572-7556-4380-819d-427a85642eb3", "value": "16ede0ddae5609ebd89beb623e211f3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0735be6-e174-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682212707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212707, "uuid": "83dc63e7-b0ab-47db-be2b-e928a5bdb434", "comment": "Malware payload (CoinMiner)", "value": "6bd09c2f238be861ea4cbb2e628c9c37", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212707, "uuid": "927a7e64-38a0-443f-8f80-0bb25ad31d3b", "comment": "Malware payload (CoinMiner)", "value": "082b1829d965e5fc7461f7f41eef321c2d16d21d3b5c7678bf7b5808f2aa80d7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212707, "uuid": "c97b38bc-564b-4996-8c0a-26c4ab4c674f", "comment": "Malware payload (CoinMiner)", "value": "fc4af4091857427f9877d911c3ba8d5bd475a053", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212707, "uuid": "f45c0397-b1c6-4884-a6cc-19f497b8c1f1", "comment": "Malware payload (CoinMiner)", "value": "b916277428953307a2d78b3129361923593b6cbe3de2fdfa28bc9ced2ffc91f2112eab0061d0a1a9ebcdce5ae315473c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212707, "uuid": "986c5c1a-fd3f-4911-86db-fbce7f678db7", "value": "T18774BF217284C07DF87BA8759CFAC635627C3A741B9F51C3B3D8162E8A612F2797610E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212707, "uuid": "ba92b985-f0c1-45f4-a686-f90612053743", "value": "6a6337ce6b49dbd232588f00332200e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212707, "uuid": "50b2b451-bc44-4b2b-abf2-64f488d2d52a", "value": "6144:EqVng4GKNlVigBE8qHrW3DuCZYfNqBYLoywEJK+XI7/ib49LZy9:EqVg9KNlcRW3DefMBifwZjiiLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212707, "uuid": "806617a1-1175-43b4-a760-84e125a1329c", "value": 340640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212707, "uuid": "ed596849-9d0b-4aa4-8662-f1c83ccb3a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212707, "uuid": "507788c8-86df-4877-a035-11627702aa35", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9afb1cb-e1fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682271161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271161, "uuid": "7eb0b16b-e3f5-4328-ba04-eb4ce064c820", "comment": "Malware payload", "value": "2ef7105a4a3fb2add832cd2a0af798d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271161, "uuid": "b9e9dcc9-f568-4fd8-852c-bc00f62be24a", "comment": "Malware payload", "value": "093dc325823a88ac08a2c70eb85153258cf39076a03eb70d77b2a4da6c65cace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271161, "uuid": "7cee41a8-22da-4ac4-bed7-8fa0749cf3af", "comment": "Malware payload", "value": "46af86e64afead3ee90b78ab41c8eb808696b801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271161, "uuid": "24975a94-f0ca-4e0a-94da-7cabffd7e329", "comment": "Malware payload", "value": "a70062b51670cbf706d9ebbc9261c49184e038fcb0b009156f3a3a680731230ca353f263e240c9f44bd42fb21c31fa50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271161, "uuid": "39dd085b-248f-4268-88d2-0490f8b37521", "value": "T1B0B34982387A2671EF81C07B9046C4B69D3B6F21177DD57D6CA2BE7A25F0354388AD32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271161, "uuid": "5c314bd5-3ac1-4542-b30e-ed35670406cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271161, "uuid": "077f4d5b-5ae1-4c77-bd72-7e147cba200f", "value": "3072:XDGYhDoQi4l6q9vLqUHcvq0ZfYaW1nLbH0hLNT:zG+C66q/8XpYawXUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682271161, "uuid": "ad047438-6720-4da1-9a30-b69e9188ce98", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682271161, "uuid": "ac06da25-198b-41e0-9b90-1042c2ecbc05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271161, "uuid": "6fe64c01-490b-45f3-99a9-9f22cad0529f", "value": "aaaaaaaaaaaaabbbbbbbbbbb_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a013c0-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682253310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253310, "uuid": "e8da9a92-2c6c-4393-9cd1-b4c0905f54f6", "comment": "Malware payload (RedLineStealer)", "value": "5de06e112f619b5f6c6686ba99bbb604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redline-stealer", "colour": "#DDD3F2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253310, "uuid": "c54a7542-1497-4a07-9d29-44480edee958", "comment": "Malware payload (RedLineStealer)", "value": "0a071e8c255e23a819231774203d5577ba838fa687dd45ac1ae068a71d7d97dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redline-stealer", "colour": "#DDD3F2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253310, "uuid": "d4fe82c3-c340-4749-aede-bc7a6d0461e8", "comment": "Malware payload (RedLineStealer)", "value": "dc4262f9ed1325625f72a1574de70704cf931732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redline-stealer", "colour": "#DDD3F2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253310, "uuid": "fd7fd0ce-45ac-4688-8cad-6170586de7a7", "comment": "Malware payload (RedLineStealer)", "value": "6606cdb2c3d522c74d7aeef5b804a951d48323283733b3bc311e238caae0c12af931ef4056eeb988a09e42a698167597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redline-stealer", "colour": "#DDD3F2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253310, "uuid": "f01f8258-6486-4197-8c1d-689dde92214d", "value": "T183849E063288D47FE82BA8BB4CE15FA5223C6B3A179F08C357941B5E4D966F1FC72149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253310, "uuid": "97716916-6928-4825-af86-3d6f51e06c25", "value": "6a6337ce6b49dbd232588f00332200e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253310, "uuid": "ce896b42-ebd3-497c-abed-f9bb8007c6a4", "value": "6144:UC/2nKc4ViUZd+w9NMB3nfGRpw8WzVfBNitAX3zWsbiQ:F/2Kc4ck43nfGRStBoKX3iei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253310, "uuid": "55771b72-3fcb-4044-969c-b632bea7cf22", "value": 377504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253310, "uuid": "5da57b20-a330-48a8-8d2d-c1c3cb0dd103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253310, "uuid": "68599d6a-39f3-43be-b731-ae862f83cacc", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae75859-e1b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682240723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240723, "uuid": "92c6ca4b-3935-4a11-9902-08c6d1da66f7", "comment": "Malware payload (RedLineStealer)", "value": "1d483080e4a934af6271ce9d0a983814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240723, "uuid": "966ccd13-f7ae-4fc9-a2db-6ec3cb0417c0", "comment": "Malware payload (RedLineStealer)", "value": "0ae60ff8a6274625e7c90c061b24842a55055dfe23cebefa3f94553f99e00101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240723, "uuid": "4074af7b-a204-4216-8b2b-52cd2b2b2eb4", "comment": "Malware payload (RedLineStealer)", "value": "45a570db35c6a770d15fb0d4d03b241b048246c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240723, "uuid": "de271375-b2a3-43fd-b453-249d452dc98c", "comment": "Malware payload (RedLineStealer)", "value": "60738c66e9f671a0aca2bec85bbffe763be2322924dac7d5b19e602ac17e51b62588b6fd5be865801f2a88270af57d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240723, "uuid": "07c85181-0f60-4499-b3d8-cd0385160afe", "value": "T16C45231179E2E076E96258B445F0E9F8EA7BBC425934808F3B042B7F6D32AC05BB5753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240723, "uuid": "170d1a73-38c1-49d6-af80-2a4cb029e702", "value": "775df902054b16f31a3efdde44a18e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240723, "uuid": "5d22052b-4b1b-4d45-8b4b-84a1540396b1", "value": "24576:QnrLY/rw/fdjqac5YMWaSOhInqc6NkbKOz5+Zn3D6n73:RrwNqac5YMWaS2nkbh9+Zn3DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682240723, "uuid": "9a70e2f2-0537-4fb3-952a-fb2f787cc742", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682240723, "uuid": "988e8d18-60eb-48e1-8177-12c270c16659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240723, "uuid": "c8684d06-5327-4546-81e8-16c52de4caf6", "value": "1d483080e4a934af6271ce9d0a983814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83843788-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253407, "uuid": "718d5f48-b6a7-49a2-9e5e-091da82fab1b", "comment": "Malware payload", "value": "e6e0cffc48a978c686f3dbbdba5ec685", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253407, "uuid": "959109da-6153-402b-bee1-3b4e2c1c3325", "comment": "Malware payload", "value": "0ba464ad25de0d15903a85e589f3b78266a068ca9ea751ea299fce5db3290bef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253407, "uuid": "84279807-17d4-4b25-91df-633b268273ee", "comment": "Malware payload", "value": "8100fbe1f3ff01c6662a3f346b854e4d3ebf79dc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253407, "uuid": "eafbf7b5-99b7-4713-9bcd-2e0b06c28324", "comment": "Malware payload", "value": "9cfa75481b0f3899002d849e311bca005f7ea015888b4e34e5eabf4d35a418db2a5ffa0de1b1c1d577ea8ebd97df1c86", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253407, "uuid": "8e160072-06c9-4712-bd59-04cfe5a9821d", "value": "T12BB4234B17832A2D68214F1DEF1E1DAE53BAD13F6B76A91EE285DFED04C84790833424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253407, "uuid": "95cc714a-2316-402a-a176-c6f0ef0a3229", "value": "12288:n/TPZ2auGX5em57A8ybhlswN30X0d5XqKyMZA/DZ5Bw6:n/YauGwm57AHl3F0XG5XJyMZqDZ5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253407, "uuid": "3f4a7de7-e102-45ab-9843-8a398840c079", "value": 521052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253407, "uuid": "218c141b-3437-4279-b332-d123f3ce15f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253407, "uuid": "aff85dd3-f092-4115-84df-c789f774fba8", "value": "Aviso de pago________________pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d34d30-e18a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682222110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222110, "uuid": "c258c96f-1d54-4c89-a781-c974751ad007", "comment": "Malware payload", "value": "73451ab142c86e71eb7e62e7ac9cfad0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222110, "uuid": "451a32ad-833e-4f29-b5fc-41b10140f095", "comment": "Malware payload", "value": "0c3e9528d9ef7d821f4de401cec94efd5ffc87382d9e1dad0ff47da81b0208da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222110, "uuid": "8da850f7-2941-41df-ad6c-4dc6d1b95bf3", "comment": "Malware payload", "value": "485e32ba974dcfd87fc6796e5eabe8594e87885d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222110, "uuid": "6705a049-0ceb-43b6-9bef-67b140b7f988", "comment": "Malware payload", "value": "cb61ac6e3ddc4ef9768783ee9a0a70667f07e8fa403732c5b413f396d96284e662de8ae7e83e1e69d48ff3d0c048e458", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222110, "uuid": "4868ebf8-72d1-46b5-b8ce-5fc8964fe60e", "value": "T1E517339532A5BF3D180108A36528A77117A944EF6B80ECA9FD173FECB34CD6697106F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222110, "uuid": "23424952-62ee-48a1-a99a-59484ffa5734", "value": "393216:3QM6zubqxUy9ULmZo5MueuUuv1/J0taK50DDKcxuKbWrIVL:3CqWUD6Zo5Mqv1xIJ50DJRHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682222110, "uuid": "f833402a-6494-4fd2-b149-8be33e967d05", "value": 18820138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682222110, "uuid": "10025ca3-9b31-4526-97bf-ab7d1a28003b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222110, "uuid": "95433147-6391-454c-bfc3-63bd5a6277a5", "value": "[Official]_Fotor_secure_installer_4.8.8_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12802383-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263526, "uuid": "d7114633-2006-41de-8682-2e7bf656c7cd", "comment": "Malware payload (RedLineStealer)", "value": "b0010a1a466b6912599e9dbfb9b0f2b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263526, "uuid": "d3679e42-f55b-4b33-b5d6-07e69dda83b9", "comment": "Malware payload (RedLineStealer)", "value": "0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263526, "uuid": "a7e4f72f-a3f4-493c-8cb3-576af2dedf82", "comment": "Malware payload (RedLineStealer)", "value": "992a31e660ca6c51290a20924328f650d1633011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263526, "uuid": "e6f2c9f8-62a2-4f91-9313-368c88420464", "comment": "Malware payload (RedLineStealer)", "value": "ab92a5a9edf5d42970f1d02baaa3212f6973d3786a99cc38d4aabb7f71de2665425e65601e77c8d7ba70203883f82e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263526, "uuid": "20831995-b3f0-47c0-89dd-5f4b92f92d06", "value": "T153C41253A7EC8432DCB11BF018FE528706397CA15B79C3EB278499DA0C72AD4A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263526, "uuid": "83bbdd51-dc10-4853-9681-3c7b6e77f03d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263526, "uuid": "3cc650a9-aab0-4031-a6b6-d5aa0a0332e7", "value": "12288:jy90BhqdRBkZ71iu7CVoJkL07+QsKS+yw/lBJasjt6YNN:jyMhERBkZ71bO2JU4+tKS+ywXJaU7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263526, "uuid": "43bdf123-68a4-41cc-b5f2-044a2c9ca319", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263526, "uuid": "c515441b-70d3-4667-8691-2398ede73e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263526, "uuid": "dc708f06-bc97-4b6d-8d53-b8e5f1bb700b", "value": "b0010a1a466b6912599e9dbfb9b0f2b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9dbb82-e189-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682221801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221801, "uuid": "4fae55b7-1b15-4178-bffd-c0b38aab2458", "comment": "Malware payload", "value": "b9b73c5379645826903ac55bb4d26b07", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221801, "uuid": "9630b60b-4f9c-4a05-b35d-c51c6667d8e6", "comment": "Malware payload", "value": "0e38d565eef8ac2cdd520ee246e643d9db6f7152f3ed0b938167c29f3e6a2a00", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221801, "uuid": "9f232fc6-be2a-46e2-979b-1acd08c805e8", "comment": "Malware payload", "value": "49003d0ba26891feb2a67e588eb13313c7180cba", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221801, "uuid": "5c6be5e7-5578-4460-b4af-31386f03fd5b", "comment": "Malware payload", "value": "b46e8211ad653836711455b45508e07e873f4fd9b9f9332ff90da76b3576b9daec3b769f39ce3e44437d016a7f920bcb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221801, "uuid": "eed15b61-fc2c-4624-a293-f4d9c97197cf", "value": "T15AD59E17FEB80125E1A19E7FA6729B15D1713C851730C6CB0202A6B9EDF75C68632BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221801, "uuid": "c25e85f5-e571-4032-93d1-0539172b6bae", "value": "49152:o2mdRUps7+j/SXR1aKPHDAFgff08lUU+XHuJ5lph69gflG:SdSx+PbffxmXuJ5zhrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682221801, "uuid": "a77650c0-796b-4346-8d9b-98a4cd1aa89b", "value": 2854912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682221801, "uuid": "39a1bc95-2140-4078-875f-e3b5ffb57ac4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221801, "uuid": "35b421d3-91f2-49ca-aa07-ff5643c72a2a", "value": "xb1usb.11059.0.140526x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19962a10-e1b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Phonk)", "timestamp": 1682238627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238627, "uuid": "bf5fc970-7d0e-4447-990b-a8746c17cf94", "comment": "Malware payload (Phonk)", "value": "0ab970af56aa006e740c27a5a1e12807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238627, "uuid": "e4dc7230-5eba-41b6-9e7d-f9cf416d8ced", "comment": "Malware payload (Phonk)", "value": "11aabbba0268cf5ad901f11038f6d920671dcd7b4b52f77fd6e53772d606c8fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238627, "uuid": "cc4b1332-24aa-4248-b986-eb596cf7431e", "comment": "Malware payload (Phonk)", "value": "1b003da4f9cbac7393f75ff96727eb3eaea2e528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238627, "uuid": "1123f124-993a-4b4b-8028-900664440e3a", "comment": "Malware payload (Phonk)", "value": "e083261f0f1960a73898b8f39804a98a2fc42da5daa68746d1dc310ea01f6e9dbe6c9f624543450d1256afbd441326ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238627, "uuid": "6e655b47-5075-44a7-b0ae-bccc8e5caca5", "value": "T10225619D3A672DB6DD4E01F2CB513AC85F61C75AAF00E0E62B5346C9660D133ADCD0AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238627, "uuid": "84b48d52-79d9-4ff0-9306-fbd35f9f3ec5", "value": "12288:shNN3+c1SM2+crV1CMRF001J2VY84wevCK22xyJrq3Dd3xaRzT0QSjByglfME5F:sHN3+c1SP+crrCMRF001J5wqNfT3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682238627, "uuid": "1de046c8-c43f-4c33-82eb-e1333c30167c", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682238627, "uuid": "f0b6b137-1b48-4d1e-9ccf-d0ca623ef278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238627, "uuid": "1e8f1dd1-69e7-4027-a325-75be3b933ced", "value": "0ab970af56aa006e740c27a5a1e12807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d7c896-e1ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682249683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249683, "uuid": "82b110cf-8861-43b9-9c62-6fd11687d440", "comment": "Malware payload (RedLineStealer)", "value": "9ca454fbdfee12355a345dd8d5dd0515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249683, "uuid": "38890fe9-70c4-4e3f-94bd-9d1c13dd3c0d", "comment": "Malware payload (RedLineStealer)", "value": "128b80ba6e4db4fafb7f670e57b1df0226d4cf86ea04c828bcbb01a78a797a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249683, "uuid": "319687fc-9793-4985-bf7c-cc877ae2d986", "comment": "Malware payload (RedLineStealer)", "value": "78a9316bbbece3c8b156930a461aa152ff951354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249683, "uuid": "a2511854-718d-4bba-b356-7f7bd870ff95", "comment": "Malware payload (RedLineStealer)", "value": "0d90432299238c2d299d3fc09ad9f6223359ccf16dc365ec4e930d93037fa93b6bd51f9f788377041cb3bc20d4be3838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249683, "uuid": "6d3b77f4-1fb4-4e41-9cc4-ee7055ef95ad", "value": "T19F748E063288D07FD42AECFF4DA19FA4523C6B3A27AF48835794175E4D926F1EC72249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249683, "uuid": "f81d69bc-6562-49b5-ba9b-3f68a37cbab5", "value": "700f5813efd204f7328cfcc176187f03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249683, "uuid": "622cba58-20e6-42ea-ad95-c70f57f054bd", "value": "6144:wSQ4WQKIGAGZFG0ljnVtFCiCBzeB+uTXcZcM5uPi8:TQJJIGvI0NFCiCRgHsR5uPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682249683, "uuid": "3f39dbbd-8ae7-41db-9f9a-54d6741c5431", "value": 360096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682249683, "uuid": "bc11b42e-d999-4e97-9c9c-24d088d4af27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249683, "uuid": "d3225b53-07eb-4d00-97e4-0a7e73456556", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcef3a8-e172-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682211921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211921, "uuid": "30fbbbab-33b4-4cd5-b028-fd0a4b28dabf", "comment": "Malware payload", "value": "717300f29fe153e00f0a243d443f87f6", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211921, "uuid": "1ef7c22b-95a3-4c2f-9beb-e862966c6b35", "comment": "Malware payload", "value": "13d3317ccae3bdeb9d275369fbd7106d91f75096c62c663d0b3e277b2d228dc2", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211921, "uuid": "cbf87493-c1be-420f-8fb7-d2de1dafe56e", "comment": "Malware payload", "value": "73eb161dd1f29c64b7451a05405eda69f7962681", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211921, "uuid": "e60db879-5e5c-4a0f-8722-581491a58df8", "comment": "Malware payload", "value": "e9f4f7b778a51efedbc406193e872fd01a4f2f5b5757233e06b7d21823255567a2edc40f045be457dec1f0f8ffdddcbf", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682211921, "uuid": "6e5e353e-895f-40f3-94c9-1591121172c4", "value": "T1FEA2B420305BAA5E07E2C336BD56A1EA9C5242394CDB040CF6DCDA99FFAF647A13D740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682211921, "uuid": "0b98e64b-34f6-4321-96bd-c7a087677652", "value": "384:xWmuW06ul03vm1uv+FOiuH+937sG0z47xx:eFX0OZOiue9LsG0s7xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682211921, "uuid": "a80f3fbb-5a6f-4fc6-b603-56ea83bda4fa", "value": 22584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682211921, "uuid": "9e679189-7f48-446c-b508-1a59c048a5da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682211921, "uuid": "33d21af9-26aa-44a8-84da-397ca61ce000", "value": "53tahW0A.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89827564-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682253417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253417, "uuid": "e3c6df9c-fc0a-40d1-9800-b7006608a348", "comment": "Malware payload (RemcosRAT)", "value": "cac28abae6e8916e352279a20e4cf230", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253417, "uuid": "f7da5f9a-5566-42ac-abab-89ff3d848560", "comment": "Malware payload (RemcosRAT)", "value": "151e7f13d94fd740c50d21b4d00ee2d6a04ee500cdbe5f00cfe235be85a363ff", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253417, "uuid": "73d2082c-710b-4683-9121-d948ef29e8ae", "comment": "Malware payload (RemcosRAT)", "value": "47fd4065086b5b0fe0e2ff4d58815277ffe6b1f6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253417, "uuid": "f3c3695d-2de7-47f6-afeb-acb9f5f539d9", "comment": "Malware payload (RemcosRAT)", "value": "2ac9805d6da4212077464bdf225e3b3c81042f05b5ccc9f0fed1d9d562e8dc4b04a6d4447c58a40df36ad119f470c257", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253417, "uuid": "9342b65b-bd49-4308-b2dc-cd308c5bdea6", "value": "T181E2C4595658A7219CA34C3CB29A23A0BF4DDCC4AB002CD37B726B58EF87D05F6B1574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253417, "uuid": "ea85cff5-c49b-44cc-88fe-92c68469bb07", "value": "768:7xZKZVxZZmvx2pi8dXSTijwF7ulkVeGJRMI+PLb++0EWGWR:7xZKZVxZZAQH8ui0GJtAR03BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253417, "uuid": "3a765f21-f3fa-4066-bb45-242805f0db81", "value": 34059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253417, "uuid": "ebc82299-d27a-465b-9073-84ba1e2e683b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253417, "uuid": "ed25921d-74ea-42cf-b5f1-fff0d770d8c9", "value": "HUB International Midwest Limited-Invoice.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7e4de5-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682264670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264670, "uuid": "4c9ea955-e000-4aa9-98f6-bd3accf0351b", "comment": "Malware payload", "value": "d6c36f54d1119f3fb8007a23a6f10bdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264670, "uuid": "2127c029-a653-4f67-b1f2-b36abdf67862", "comment": "Malware payload", "value": "15ae654deea22cf7dfb1c703df63a43d40f2e3ec86a61f0b13dbb81dedbaf010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264670, "uuid": "0b089ef1-165d-498d-834b-d09934e1089f", "comment": "Malware payload", "value": "304246eee0e21d95de178608113bbcd19703c9ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264670, "uuid": "c281cddc-2d63-471f-b8cf-1090dfaed514", "comment": "Malware payload", "value": "133ea8240e47e4e2c3aebce19cb1c3ae29f7c2c476cf5644fadc36bcc7fb8f7b01bb79922ef40a117e8456aca282a876", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264670, "uuid": "0ff16592-8143-4765-8f2f-bda33c051655", "value": "T16FD3C483B410DF67E44B4A3647834721B6B5FF5D2A4202B37317BA52AF371D129B2E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264670, "uuid": "8794df92-dc5d-481e-9d39-22e3c559efbd", "value": "3072:0P73rpb6Ky7+UrLbgzsEeye3k39almLc0IZcHgeQs:MLrphYLbgzkye0tomLc0IZcHgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264670, "uuid": "9e4fd24c-c659-42af-9aeb-872079fe93fd", "value": 137426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264670, "uuid": "e741016a-3616-4fed-884d-08cf7cd40696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264670, "uuid": "c644ee01-5f37-4745-acba-18a95437dd84", "value": "d6c36f54d1119f3fb8007a23a6f10bdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d25267d-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682253209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253209, "uuid": "588a8efb-7a3d-4310-810f-18b3301cec4b", "comment": "Malware payload (RedLineStealer)", "value": "452e1a76316b2b586e6c1b12daebc121", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253209, "uuid": "a907e458-52d4-40e0-a26a-c905fa7cb0bc", "comment": "Malware payload (RedLineStealer)", "value": "15da1d8ebabfad5a9ca4f7c790af69bc2e95960057bcf0df8102b8743483448c", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253209, "uuid": "174a9f76-8941-45f1-88f0-a59702e645b7", "comment": "Malware payload (RedLineStealer)", "value": "795dd8fcdb8e777df52aa0ca440c4356c8b2a188", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253209, "uuid": "97d19709-d4c2-490b-864a-38cda674bac7", "comment": "Malware payload (RedLineStealer)", "value": "5fe56b29e3d3e66eb1dba52258c010c7f33953e03aa527fdc0f58cdabbd77bb41d8833b1959af0d8d32c325668ecbd4d", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253209, "uuid": "148bc704-4b46-4f59-b687-f67bbad2cc73", "value": "T166953330A94637F3965811666AEDD3B4BA30CA54C206B4DE4DB9228D3A1F3DC8F6C54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253209, "uuid": "ae235190-9ae8-4168-b9de-aa3ca801d296", "value": "49152:9g09B/Gaeoiva3cl2Q17ULjUI+5A+gr+JhUgA6L6B:+rlajSSUIyA+g4hNA6L6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253209, "uuid": "d4e934ec-9837-417a-8383-9b9ea6c5d232", "value": 1983934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253209, "uuid": "08d5f15e-bc42-4844-80b2-9f6bb5e5ce8f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253209, "uuid": "a8df5ac4-6a3f-46a6-b39c-81eb997dfd7a", "value": "Discord Nitro Generator C Project.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b8549e-e1a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682231668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231668, "uuid": "cc804b80-9392-4403-8bad-62c2b2dec335", "comment": "Malware payload (RedLineStealer)", "value": "75e3b5b17db31f0f3d44131fe28d44ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231668, "uuid": "4f116204-074b-44aa-b3bb-a4b1ba4556f3", "comment": "Malware payload (RedLineStealer)", "value": "1846ce93adde1fe895875ceeb8e36f3a2444c7d5b180ccf53548687cc2ad6ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231668, "uuid": "23bd96af-c329-47ca-ad54-5674aa338d64", "comment": "Malware payload (RedLineStealer)", "value": "ee8c049c320666da09c26c53fcd707880f17cdba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231668, "uuid": "aa37ffbd-738d-4832-a62d-06a7e51b911e", "comment": "Malware payload (RedLineStealer)", "value": "88a19bb939253ca60d3121dcfd7e784e46a826c11ee216ad012c9a6b8781dbfdd8b89b7782c535e864b28abc3551f841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231668, "uuid": "4d0ece6d-7f45-4747-9a3c-8d19efb56e7b", "value": "T1D2663307FAD69671DC610E312F04562470387C717F39F9A8B39B1E7E65340A2BA24A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231668, "uuid": "ffd0af3d-fa72-4b1d-b265-174e29062a2b", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231668, "uuid": "ac6a7743-e3b4-41ea-9751-0011fa82d4d4", "value": "196608:VjWrYkSwV0rXV9oW80GHD4CNITUe4aves468n+SzloWl:Vrwq780GjFNIorsvun+Szx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231668, "uuid": "3380b781-91f0-4589-8888-a4fa60f01672", "value": 7060371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231668, "uuid": "3995ae48-a19a-4214-902e-eeda81da0472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231668, "uuid": "088ffca2-5653-4389-bf1f-b3f233199f8d", "value": "75e3b5b17db31f0f3d44131fe28d44ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8d8332-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261687, "uuid": "dc09be37-3c76-4dd8-a0d5-0c835689aaba", "comment": "Malware payload (Mirai)", "value": "8279998dc485ae784119c9606e71e7ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261687, "uuid": "1a82ff4f-3a93-4cc4-83fd-b54f3d1a6428", "comment": "Malware payload (Mirai)", "value": "189c67cf0c9e3fd17b4d0c001eb572d53a423284d404118c6674b81d809d09ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261687, "uuid": "559bc9ca-e062-40b0-a0d9-dec8d83f91a8", "comment": "Malware payload (Mirai)", "value": "5ff6cc9fd5fbe25a347c26948789c6968f1dd9d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261687, "uuid": "b655bcd3-4ccc-4b59-9315-f0c05887f6e8", "comment": "Malware payload (Mirai)", "value": "1678b909a40a20edc06ed43472f6053e8f3a682eb65bfc42937e2e553404fafeb89130c9d739c25015df2cef09cebe79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261687, "uuid": "38699c37-c56f-468c-8bd7-f0fb165e48b0", "value": "T157834D9AB801CD7DFC5EE7BE8053460AB520A3651A530F3FA69BFD837D721680917E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261687, "uuid": "4c5cab01-86b9-4793-aa8f-a740ccba399c", "value": "1536:2v95KX1ptvcffhJfnqxT6xg+Y85kHdzFZuCfPBhVrrMNTKnqi8:2bKlptEzfqx2xg+YHFl3BvNqi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261687, "uuid": "3ed3f6e8-e92d-44b9-82ef-bd6fc0d38669", "value": 82844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261687, "uuid": "6cd208f5-7243-4f01-9e8f-d07c1b9e3a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261687, "uuid": "8b4cb2a3-9523-4573-8a5b-814b563cabeb", "value": "8279998dc485ae784119c9606e71e7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc89403d-e1d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682256187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682256187, "uuid": "c0e233ad-340f-4339-b612-b07c92854044", "comment": "Malware payload (Mirai)", "value": "8c4d8de2456336eb13fe98d96e717b27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682256187, "uuid": "0bc3e32f-b30a-40d0-804a-83bc835f3813", "comment": "Malware payload (Mirai)", "value": "19a4d4a228e670ef1b37f3278338722228ad1a3934408e0169fe1812d1be9d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682256187, "uuid": "5c005bd8-97c7-41cc-9948-ae0c9fa7b918", "comment": "Malware payload (Mirai)", "value": "a3d58e782031085a098044d5c33f8e1571eb4867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682256187, "uuid": "fc797880-ecba-4555-9e84-129fb2bbf68b", "comment": "Malware payload (Mirai)", "value": "fcc502335bf44d1b03af887acbab568bbac3eaf24a9672d02a00c0d214feff2cbae091f044fe4f10b1777cee0dac06f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682256187, "uuid": "3f3789df-8f37-4ac8-a2c3-3748845bf353", "value": "T1002329C0A143E9F9DC6A01743066FB329FF6F4F6221DF997D3A896236C52601A907D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682256187, "uuid": "a93eb693-5a87-436a-a18e-2386cad7eaae", "value": "1536:kXTow+N4VVSBZhKhtVHQCaaZmijgK2J6Xb0ino:YswI4VVSBZhuVwCaOmijgKmUgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682256187, "uuid": "430cecfe-0aeb-405c-973b-9c7dbf7823a0", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682256187, "uuid": "dc5e196b-d47d-4093-9a3f-d3bac192a05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682256187, "uuid": "e8a6a498-4b5a-4755-ae99-a79b33b79094", "value": "mynewbinslol34adsjVjdsjccxjc.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95422b70-e181-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682218218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218218, "uuid": "da3fdd8b-7022-4344-933b-7399daddfcb8", "comment": "Malware payload (RedLineStealer)", "value": "f33f19236f9ec9b9e5d4d1ad02ab4df9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218218, "uuid": "3b93ecd7-41f5-4e7a-8b17-c07acc5b846a", "comment": "Malware payload (RedLineStealer)", "value": "1b50b09ec36b50afafc6ce6197d6919370ac8405a69315b6793e89a6108251f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218218, "uuid": "d222f426-8164-46c3-bb69-400be4d8ffed", "comment": "Malware payload (RedLineStealer)", "value": "2f66671836a29bf5123cf33f374b4b5ae3e566e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218218, "uuid": "22e0e088-63b3-4146-bc01-4892afaaaea8", "comment": "Malware payload (RedLineStealer)", "value": "bb467350504ae0219b3828dedfeee46f5585381b3bbf9fad52a3af6d498e779570937dcf2feb3565e030218ff784e908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218218, "uuid": "195af48f-84b3-4645-b9d6-245959eee08a", "value": "T16035234273D84032EAB6273408F613930E363C92BF7C875B5756E68B58B32E49636767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218218, "uuid": "eadf5299-f84b-4f78-8334-2847348b3bf3", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218218, "uuid": "0b9c07a9-5a01-4e0a-8f24-007cbcd82329", "value": "24576:Lyh69bzf8Wm54gwv2s1d0aco8DWS8DU17aogHsG51N:+K/8nmjzko8KSB17qMG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682218218, "uuid": "b424a43e-e786-4a05-a4c7-73df3c85f13f", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682218218, "uuid": "4d5c5d2d-724e-4fb1-aa95-84315f8b6ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218218, "uuid": "497fd79b-1179-4cc3-9db7-cbdd5cf7b1dc", "value": "f33f19236f9ec9b9e5d4d1ad02ab4df9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9cc4af-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682253428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253428, "uuid": "48910943-db5f-4d86-baba-c00b9f061ec4", "comment": "Malware payload (Formbook)", "value": "561a7d197b3f46cfe923871aa045d49a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253428, "uuid": "bb31e158-3112-46c2-9f80-2a51cd67194b", "comment": "Malware payload (Formbook)", "value": "1c817e5b5a9bb0f54ec8dcaa24457ffdf586961d99ef2ce5a23ffbee4d9ba133", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253428, "uuid": "f001fff0-c1f6-4e06-b3a4-45472e81fe80", "comment": "Malware payload (Formbook)", "value": "fd55a5660c6334567b78c31e56d6f4c16de5c628", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253428, "uuid": "e61fb3f0-706f-42df-bf7b-4179944af954", "comment": "Malware payload (Formbook)", "value": "400059084e2e0799cbb6d3d65d15be047d83df88375616ab52361eab3145850b29cb30ffa736e718b7eed42cfe8a5807", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253428, "uuid": "b3806ef9-c784-45b5-8042-b61d2005a812", "value": "T1DF946BA239C9756FDC2F4674035FEAB22A795CE07391496E4F80360D4C3694A80EEDD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253428, "uuid": "729afa58-1dcb-4621-9232-5fc363bb987f", "value": "6144:ABd9vbPZVheNA+ff0Ngt++nY8Vug1ugGIiD7Od1QFOCI:gXnhe2eAgtouugmmYFxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253428, "uuid": "37cc6330-586a-4d0b-bb9d-6821340423fb", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253428, "uuid": "610a5036-bbc2-4ef2-a12d-ad85143398c0", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253428, "uuid": "e2bc8a09-1e59-4385-8b96-13a27882a6b9", "value": "Scan_4195921_102396.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edc8a96-e180-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682217617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217617, "uuid": "09dcd53c-7d85-4152-8f06-a57673fbe33f", "comment": "Malware payload (RedLineStealer)", "value": "ea6ceefbabc10480f36b51c8ff1d17e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217617, "uuid": "f3229233-6051-4bd0-b408-58ee709d7f62", "comment": "Malware payload (RedLineStealer)", "value": "1d6f12232ac800688291e8e19c2c8b5fbf8802e9bc1a2a3baac9784a6456e902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217617, "uuid": "2824b016-ce05-43fc-9cff-e4673c440b27", "comment": "Malware payload (RedLineStealer)", "value": "89a3e9094bc27ce78824f60755e8e9dd09a08411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217617, "uuid": "a6e1abbf-2cc0-4197-9046-ddf2af5b0d7d", "comment": "Malware payload (RedLineStealer)", "value": "ab55c7d97c450c4f5d75b63b37325e3d7661678311b753f7e8a54479a5039b8ea32048090e24a7d8d359a1e0c0eec5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217617, "uuid": "a43607ed-08ef-4487-904b-0bb6b4b7e54b", "value": "T1EAC41252A7E45533D8F503B014FA12870B36BD929FB4C2FB2B46988E5CB36D1963532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217617, "uuid": "89390d1c-68cd-4cef-bfd4-39b9a126217a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217617, "uuid": "dec0c221-676e-4ec0-9ab0-015a6c037e85", "value": "6144:k+p0yN90QEbeAbqsf+EKeNdLPMOo7GE3xDzlhZpz67M24DPjlr9Ej0/IPO+C7:Ay90he6qwpKyBPM40XzLDt9EBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682217617, "uuid": "51518536-5d83-44e5-ae99-91c4a5ffd030", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682217617, "uuid": "2200e6e2-061b-4c2f-89b4-cc910539247c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217617, "uuid": "7e9ef749-3745-449c-89b8-abdb27ec7b6d", "value": "ea6ceefbabc10480f36b51c8ff1d17e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98ac137-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261658, "uuid": "a4263bef-af9b-4896-a548-cdc14aa5f5ef", "comment": "Malware payload (Mirai)", "value": "93027a2e4d0099a6834fbff815e3cb9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261658, "uuid": "daf55de8-d519-453b-84c4-061ebfbb71dc", "comment": "Malware payload (Mirai)", "value": "1e2de1b3756f50fc745846d38c7ddf64f61878b65bb646598eaa4801be0102c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261658, "uuid": "a7fef55b-2eed-49e2-8019-35deb289f3c1", "comment": "Malware payload (Mirai)", "value": "0ec36def6934e74aab26bb99cfbe190625430b77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261658, "uuid": "fa458f09-ecf7-4048-9394-2d68a213ed50", "comment": "Malware payload (Mirai)", "value": "00e882367e9b61112dbc8ebcad5e92b02110b3def855fbe56d6e9b0c2d39667a19874d4f40a569b72acefc0d6aeaaa65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261658, "uuid": "9a84470f-3d13-442b-830d-cbb7742ce99f", "value": "T1CC539FA5C4AC9D58D6254078B614C9388723E00C95E77EF7DA46CBA6D00BEECF4893F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261658, "uuid": "f2637ee2-281f-4f2d-bb60-61f2acbba75b", "value": "1536:wa+XckHK/sQSwL9YDrZULLyofs36mTXoWQ2QTWKCJ:whXckqEQZw2Lf+6mzov2GWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261658, "uuid": "ae03724e-b5d2-4f62-a551-60d04d84e23c", "value": 62400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261658, "uuid": "442015fc-c34e-4d07-bae3-911f07189451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261658, "uuid": "d890888b-1246-4bba-9b5d-cc1736a02b75", "value": "93027a2e4d0099a6834fbff815e3cb9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafc390f-e18e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682223919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682223919, "uuid": "03e26c29-de4f-4045-94b5-00ccb973dc25", "comment": "Malware payload (RedLineStealer)", "value": "06506d069caa323a1403599b59ba251c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682223919, "uuid": "c0425c1c-9838-4f09-88d3-a8093c1b6a80", "comment": "Malware payload (RedLineStealer)", "value": "1f63986d16f01ea18771d69b837d532888076cf13c3d3757abf3bf50edc6e4c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682223919, "uuid": "75efad2a-079b-49cf-a29f-ef12689c6cec", "comment": "Malware payload (RedLineStealer)", "value": "c7cb39649b4b54782577393ba1759f10c44cfba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682223919, "uuid": "a7a89f45-44f9-4beb-aad0-97607a4f9e6f", "comment": "Malware payload (RedLineStealer)", "value": "d6e4109d37cda3291ce5dc909ed3100f53852f1a8f0015e4baabd6fc7db32e64deae6c1e5cdf8370da21b853505179ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682223919, "uuid": "d93f1ef5-9ec1-43e1-a76c-6c5b769e519d", "value": "T15FF41247EADC4431DCBD277018F917870E32FCE3AF78428F6A05959A5CB26C4A63176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682223919, "uuid": "0ad911bf-5d1d-4f46-8e43-17ac436b8029", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682223919, "uuid": "6c787cbb-34e1-44c0-bb41-8265c3db8381", "value": "12288:6y904p4wfyJvWA2MdZiclouGxSpBAAiFTn11quGVJd+TzhO9ma:6yKwa0A20opx6qRIyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682223919, "uuid": "6efa0061-8e7b-4f82-a3a1-a2af2620b469", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682223919, "uuid": "5e1a28a0-c444-4376-8d21-48a4c523f38f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682223919, "uuid": "44c82404-6aa4-4cc6-b750-5bb7ee76f976", "value": "06506d069caa323a1403599b59ba251c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec60170b-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260885, "uuid": "3067bd7a-5ead-4c92-96ee-657f498424a7", "comment": "Malware payload (Mirai)", "value": "34a49da90e0e42621f795a8c8b7f1649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260885, "uuid": "5770db73-e7f7-46b0-a2e6-93d3dc6184f6", "comment": "Malware payload (Mirai)", "value": "20debf5814c528e7ee5c7d9cc48460a26c430edd9e564513c66b9c2472e7fd11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260885, "uuid": "c8018941-7421-4ef4-827b-68a776fde928", "comment": "Malware payload (Mirai)", "value": "98d614b68ff7476cb0d7f9a8a0877d553b35a6b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260885, "uuid": "5e9160d8-2989-4b59-94e5-b5a0592fabc3", "comment": "Malware payload (Mirai)", "value": "1a5421c7fc9f70074563e48a29ea65ea0736e4e51161b182b9f3c29256655cbcf1fb200353e983cfd62035b966579760", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260885, "uuid": "71dc6f68-09e4-4b82-b870-dcb081d42534", "value": "T1A3042934D6504B17C1D223BAA69B424E3F234F97A3D733095638BBB43FE279A0D62915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260885, "uuid": "77e24199-432b-475e-b2f6-6926dee4a966", "value": "3072:6PC+RjGkWa6s/qSPeAjQM6PBtjQbPOgpM/9sAfymUwwFB7DXNu:61fWa6s/qSGAYPBVQbPOqM/9sAfymUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260885, "uuid": "8773f16f-4230-4f4c-ae55-4ddd0f1fdc49", "value": 181882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260885, "uuid": "2d98bce7-b366-40f7-bc79-fbd278281d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260885, "uuid": "d51ba711-3a68-464f-a382-6c486385ca99", "value": "34a49da90e0e42621f795a8c8b7f1649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03805a55-e1b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682238160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238160, "uuid": "3a8a0c2e-87da-41cb-b805-ad25468220ad", "comment": "Malware payload (RedLineStealer)", "value": "e07b2e7f148b850970a03a06c782d77e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238160, "uuid": "b9ca2a34-ec78-4ede-824d-21c421c24ba4", "comment": "Malware payload (RedLineStealer)", "value": "21087fe7cd8e1885dfc583663063dfb4472335206eaa8ebd7ada911327fa36f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238160, "uuid": "c169b763-5aa3-43dd-8213-03d2f13bb500", "comment": "Malware payload (RedLineStealer)", "value": "f2370a3fa0a54390542e99c2a629ca2fe417a52b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238160, "uuid": "253bc1b4-f717-4a90-bd8f-87beca99f0c7", "comment": "Malware payload (RedLineStealer)", "value": "89556abc19f7f945ed6f465bcb8c21915776e7842398a29b396ae9398fb85022563b561dafe988bf58270568bd3c5e55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238160, "uuid": "06c91f91-a1e4-4d4b-acd9-98d98bdc728f", "value": "T1AB452301B592F5B7E2EB427006B1C5747A7BB8609560978F336D6B2F3D313C29B4A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238160, "uuid": "ba03f78e-a543-4e4c-92d1-040a965b20ba", "value": "f88982a603d93c22b0731529c5e6f4b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238160, "uuid": "9e9b4d6a-7789-4865-9d7f-bd12bc90c245", "value": "24576:uZ/i8viZtNWceh50KP+8HInX9+nsbl54gOOm1J30y8zY:qi86ZTu7tWntyshqgOOoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682238160, "uuid": "117620ac-3fba-4ae3-b610-8a13696fc699", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682238160, "uuid": "6614eed1-223c-46a6-81d3-22245ba1939c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238160, "uuid": "f359ec30-cbed-4ac3-96fa-0b4a6914934a", "value": "e07b2e7f148b850970a03a06c782d77e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c3adea-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257892, "uuid": "79245f37-2965-4752-a624-31d83fcbb0f9", "comment": "Malware payload (Mirai)", "value": "54e234f308c13a5a877547de1f8342f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257892, "uuid": "bcf1e2b1-8f8b-453b-ab3f-0dc3f2f74dec", "comment": "Malware payload (Mirai)", "value": "219f3554b4769b825774d10bd389d98d911f0149ea0711664d46e90ea8005642", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257892, "uuid": "eadbad71-3170-4f3c-98c4-d304877a97e2", "comment": "Malware payload (Mirai)", "value": "3ce6119b87e9e40b83716392ae3b7d24ae9f0b98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257892, "uuid": "1e7f7d8e-df43-446f-8d25-2fdfc9c7e372", "comment": "Malware payload (Mirai)", "value": "bce5a21af17013419b52efb2092837279b48691643d9b06c766a5ccfcd203a2d7f769e80a8a8eb5729f84b7b2cfaa175", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257892, "uuid": "21c807b6-ab9c-4873-b1ea-4299e2c7811e", "value": "T116E2E0BA47390AA695F0EF76DBF6CD4263603B7C61597442129423EC9EC260A26F9087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257892, "uuid": "88c70b48-6e52-475f-b497-7236cd197d7c", "value": "768:zljOHlOTcLs7Z8FviuyIENCHBhroJ4qDkGZ1vP85R79q3UEL5t:zAFOqquyqBhEiQLJLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257892, "uuid": "424fc625-cc6c-4e33-b40b-c9d2e0acb581", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257892, "uuid": "5576ce45-2999-4381-b176-4ca0964af0ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257892, "uuid": "222438cf-ab0b-4615-b68c-b26bc2a979be", "value": "54e234f308c13a5a877547de1f8342f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29be6dc2-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259270, "uuid": "8cdbf52c-be89-4039-bae3-2e43060641c7", "comment": "Malware payload (Mirai)", "value": "4e030a76d74c7b85584047f5e2d95d40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259270, "uuid": "d7913155-e55a-45c3-b678-edc71f302df0", "comment": "Malware payload (Mirai)", "value": "22339e5e4a712fa992948e36a02f505617bdac662dc05f94800b8f5fb6a31e10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259270, "uuid": "953ce682-83ea-4d13-b0ae-e7aa4a68821a", "comment": "Malware payload (Mirai)", "value": "6ef96754389aaed0a0b08931b68b47a058f3d664", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259270, "uuid": "a55a666a-04ef-4d87-b336-8e95888adfac", "comment": "Malware payload (Mirai)", "value": "a94a9dd68064b7d52b61999119e43c89128988af5d228616d88c0e6aa29a75370b2269ddb320e21bdb88decb72f1d7b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259270, "uuid": "12edcb9a-f891-4ca1-87f2-9ec657a5b3a1", "value": "T13FA2D01966DEFE63E170453BD6BCC543BB9783BA91BB22751C1802ECF081446E6BE582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259270, "uuid": "b611b33f-8ae5-49c9-940c-6a65915ecb12", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpVCjlEKOP4UbYl2T1TweYtxthymdGUop5hG:Ypoh/DxCvhdR4VmlEKe+9vxs3UozJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259270, "uuid": "14e39d01-ab01-4381-9d82-91cf3cdb6b83", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259270, "uuid": "59e2b218-ebf5-4d2f-86d5-3f84cec6f9ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259270, "uuid": "ae2e804f-bafa-4df5-8f74-02addf8940f9", "value": "4e030a76d74c7b85584047f5e2d95d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e61ec9-e1fd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682271308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271308, "uuid": "e5732fc0-3802-4745-bfe2-1f382b602802", "comment": "Malware payload (njrat)", "value": "a891f3f78c13c3d8e96ad22cdd1bbcf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271308, "uuid": "277b4fb2-184f-406c-af1f-3584bf52ec68", "comment": "Malware payload (njrat)", "value": "22411d5147e3e524de889fb5184f8725156fc11ab403c16d9aab51dda065a616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271308, "uuid": "ef36969e-cfd0-4be7-9dfd-6521ea189406", "comment": "Malware payload (njrat)", "value": "97aecf61a0f7355cce2dabc8ffba58423100202e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271308, "uuid": "ad33b50a-e4aa-46aa-a067-ff2a723ad49d", "comment": "Malware payload (njrat)", "value": "53b41155e75314a0766f3deab882d0058a16f081618460b24f51e9fb623950264bb05353b9dbe3b85554d50497b4b072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271308, "uuid": "45b30619-ff70-44ed-9421-820a4aafa698", "value": "T1F5E3712039FA2039FAB3EE775AD4B4E6DD2FBF63271A947D105133170662A40ED81939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271308, "uuid": "c69821dd-fd57-4004-83f2-578b79459545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271308, "uuid": "655d3aad-62a8-4036-acd6-d18c93060f8a", "value": "3072:r8y/OUgHUYPVIb+uHyaQjZK9UmN3dW1LObH0hLNj:rTyu9+mwOUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682271308, "uuid": "cace0b4a-eb88-417e-9f31-9690aa981b96", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682271308, "uuid": "aec2efd2-222b-49de-b70b-a4e4ced3eae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271308, "uuid": "f03fc174-516e-4f4f-abfe-c2c584afc601", "value": "ppppppppppppppaaaaaaaaaaaaaaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbd0c93-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682263732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263732, "uuid": "50eb4716-526e-4099-a119-26c58cbcb5ad", "comment": "Malware payload", "value": "bafcfd7e5c2c7fcc9e5974df625aef5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263732, "uuid": "e6b3a40d-5f57-42c9-8d6d-87b8339b8509", "comment": "Malware payload", "value": "2356b19d5586d5f9284b8225a4f86d9d863d19eccb6a76cb9bd21df7d93afe5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263732, "uuid": "54ce7b43-d8f0-4af4-892d-8fffc44d47e0", "comment": "Malware payload", "value": "2d046e3fe4027b1b08d281be396b1196f8b99dae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263732, "uuid": "3e18c840-b1c8-49b9-b5f1-1f2dedf5285d", "comment": "Malware payload", "value": "8789e74fe62fb73f1b858d4df1595fc5ce64b094d89a9195518dfd0eb5c07cc25ff9fbbe8592b2657e023ac42040473b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263732, "uuid": "8dc85a32-6a2e-459a-83ef-f0bdd6096d08", "value": "T19DE3D82B22232F13C5E505BA01E34634BCEDCE6D34664FD3AA897E695F319D036A13D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263732, "uuid": "8047305f-6bf0-47d5-9f28-7d6d668889ae", "value": "3072:5TDE/T3VZyqmqVlANP5MHy1hG/70cEIxcHgyps:5T2T38lyKk/70cEIxcHgyps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263732, "uuid": "7902c4dd-a361-499f-aad2-09a131344c37", "value": 153644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263732, "uuid": "035cb3c5-0d3e-4f6d-be1e-9ab66bb0b1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263732, "uuid": "28ad6c5d-ffb1-4056-881b-53afd08efd3f", "value": "bafcfd7e5c2c7fcc9e5974df625aef5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf4a3ae-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682259164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259164, "uuid": "f37eefdc-96bb-4730-a5e7-c01a1b070280", "comment": "Malware payload", "value": "088d8230be60502b8788086060f8cdb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259164, "uuid": "b4858f50-143f-433c-be5b-9b9b7a3620ee", "comment": "Malware payload", "value": "2529b89d5481bf3b299eb443420f4c20655a91225104094e79e9119ba5d3c098", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259164, "uuid": "04031e14-aedc-44a5-8e0e-b926968610ec", "comment": "Malware payload", "value": "51651e2c33bc9e13985587e4cb319f3e840d6b59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259164, "uuid": "cef27636-90ee-4638-b46a-5c321bc42010", "comment": "Malware payload", "value": "c28275518776eb2a40139cd7c69beb1ed03e275f23490ce79a4932783e428cd7ffa38d5e6f8e19564a155fda4f256c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259164, "uuid": "a1c4cb04-ce53-49d4-a016-db7ba6b327e8", "value": "T1C0F3946ABBA1DEB7E80FCE73059A4505118CD94A42D92FAFB6A4C51CE38BC4F44E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259164, "uuid": "1c72d6c8-9d83-49a1-9aa5-927ad9ab36d4", "value": "1536:yg9XjjjsAPVT/lN1zvZHyTZaSFUBld177+VzZUMMgHb1/tXmrTiHWGsO/r3CsN0:yg9XvpHGo5P77i9MqXmrTcWGsOT3CsN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259164, "uuid": "187ab8f4-db74-4db6-a235-7a34e7350c9a", "value": 166010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259164, "uuid": "07c092d4-de41-4c1e-a4e9-49ca11e597d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259164, "uuid": "b559b9a0-3aec-4d18-9460-931ff21ef2bb", "value": "088d8230be60502b8788086060f8cdb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105bfdf1-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259227, "uuid": "15424d62-6f81-4eb4-8cce-055d25569577", "comment": "Malware payload (Mirai)", "value": "d6dcffcf62b85f495cc12c892dfd5534", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259227, "uuid": "c9513371-5f31-461c-9322-9cc1936ec31f", "comment": "Malware payload (Mirai)", "value": "25cbc6e261f7b1ca8d78ec481285dbfc81e751059101808a9c5b576c7c4bc8e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259227, "uuid": "edd5e022-e5da-46cd-a6d6-344fe07db4b7", "comment": "Malware payload (Mirai)", "value": "1d182872ee91d8d672e35f72108450e23938f457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259227, "uuid": "749c153f-f276-4215-8c36-2d29a4a02b04", "comment": "Malware payload (Mirai)", "value": "c47a3e5c9e039af8f0a18e5b422be76725ca999a9aada75d4de5ea7e43237b62a6c8661120e3970a5866c5b946aa85d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259227, "uuid": "46c9dbba-296f-476a-93a1-b7a52263e6de", "value": "T1A3334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259227, "uuid": "ecfe024a-287d-469f-90a9-5e939ad5e064", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GHPS4yns96BktDgIPi8TwV:ivW3jdQGqt7Y+Z+uN9cGgI6bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259227, "uuid": "e5b7e7ff-bc21-43d1-8c5f-0c9cd71d44b7", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259227, "uuid": "f5ced691-9b88-49bd-99d9-cdaebf7a0596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259227, "uuid": "39e19893-b95d-435a-ace6-8a574b9af41f", "value": "d6dcffcf62b85f495cc12c892dfd5534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607e99ea-e1ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263227, "uuid": "fd985d92-27e1-4d5f-9936-3eb2a75c1fbe", "comment": "Malware payload (RedLineStealer)", "value": "53ab98c1653db426feac0fd005c198df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263227, "uuid": "9091a1a0-f076-4828-942c-50fcef30b65f", "comment": "Malware payload (RedLineStealer)", "value": "26d512ec79ff230f68f3e95d2e1a378ab51f69accfc6334a063c5219d9229294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263227, "uuid": "020dface-c053-4f7c-9b24-ad902566f22e", "comment": "Malware payload (RedLineStealer)", "value": "60255ce0f1146c9c3ad9a905b2280ef0bfd72f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263227, "uuid": "8df10a6f-bc9d-4934-96ed-8429f3bc77b0", "comment": "Malware payload (RedLineStealer)", "value": "81822608e6b4d14c023b268f545b3fb0ad035fd639e986337d556641d142eff20f0b73e6e74b230afb1c5d40281ea290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263227, "uuid": "0ad2269e-d8e0-4655-8953-a280b6d8f08e", "value": "T176C41243A7D84176D8B12BB05CFE13C30E35BCA55B70A39B2746A98E48737D0A57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263227, "uuid": "c2b19d17-2ebf-42c6-adbe-479da561ccc7", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263227, "uuid": "44af2070-6d33-455a-b28f-32661d124fef", "value": "12288:9y90/t7Z02O7Oiv0FiWIGiVd03io6vPtCSM43Ft+:9yatFXO7OuZVk96s34D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263227, "uuid": "2bdd90da-9796-42ce-a9ca-871a4c210b0b", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263227, "uuid": "009ce094-4d1e-4662-a1c1-8f92e2c7d208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263227, "uuid": "cee5ef52-eeda-4760-9e39-916caca369f8", "value": "53ab98c1653db426feac0fd005c198df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2e4bd8-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682259195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259195, "uuid": "4d2a9cb3-f93b-4380-9146-62f8defbe8c4", "comment": "Malware payload (AsyncRAT)", "value": "60dc47e69afcdadc8f4e744f7a40a87b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259195, "uuid": "b8d75241-c540-48ba-9bbd-4ab296fa0df7", "comment": "Malware payload (AsyncRAT)", "value": "284354c31831c62ac87fba4a0a042fe94daf4c853827bd0009666f50238db23c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259195, "uuid": "1168aab3-3fb9-4b81-ace6-320ccfef4520", "comment": "Malware payload (AsyncRAT)", "value": "72d1cc12d7684dac79d1983e1be7a9efde09c3a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259195, "uuid": "027ca3b8-3645-4ba2-9a46-2190187f0c35", "comment": "Malware payload (AsyncRAT)", "value": "d8325dcaa3d7a630ee1eeb717cda934558fbed95e7fa122cad5115f0f6cc33436e88a97efcd03320588b37612f666fb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259195, "uuid": "4ba83614-054e-479f-aa8e-36dd8dbc4d3a", "value": "T1E565D0316BC1BDDDFBE90EB4E87501543CB0B86BA169E248B980289BCD60394DD71FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259195, "uuid": "97b3499e-1339-4d45-aa66-949d99582303", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259195, "uuid": "1695f860-fde3-4208-8074-68d83a652b91", "value": "24576:Sw998FHHVXtnM83EF3HcQ090WdnPf1jkcKdWKThZfbFD:S5V9nM/y19P1yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259195, "uuid": "7c4b1d9a-c6db-4d3e-b67f-8541d82eeaa9", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259195, "uuid": "ca22798f-4e03-4f50-8788-50c71f2bd688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259195, "uuid": "9c8d7689-044c-4d64-9a91-1541b5940533", "value": "60dc47e69afcdadc8f4e744f7a40a87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5181e44a-e19b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682229272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229272, "uuid": "cd137463-7ff9-44f7-b176-eaef71753c97", "comment": "Malware payload", "value": "1589d522d42436f69df856cda86b62ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229272, "uuid": "ac6af678-cbbc-48a2-9806-c803e3983889", "comment": "Malware payload", "value": "2ae903f0cdd0dc677f950c4d4b0868e859c083e74b05a7cbdcff119c945c36cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229272, "uuid": "180011c0-f207-4da1-a26e-2a63bc4fe3e9", "comment": "Malware payload", "value": "98febdaa8f167f0fb2e72a34b922395893de3055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229272, "uuid": "4f9ce4d8-431f-46e1-b6ec-f98600565adb", "comment": "Malware payload", "value": "b8b6024b4a7a77874de12806bd8296c0009ce87da70ee70a2cdf9bc4287c6389ff00748590bb9cf83970587a3431ab54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229272, "uuid": "89827b95-e127-4966-a07f-3e6319bce241", "value": "T1B8F4281365E87CA4E27A92706B7383F1977DFC281A20C95F12E8C61D1D3D5A2BE31792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229272, "uuid": "811eff7b-1941-4616-8b65-13467df21a92", "value": "424c3ace0397058dbe22bab9e22b8c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229272, "uuid": "119b2d37-78bc-424b-a0b6-17e9359af77c", "value": "12288:sFLIbiTShdX/O3lvK9Xbg21o0eMb01JQntLOCbha8gWh7Xk:s5uiTShJ/O3v2G0embo8PdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682229272, "uuid": "5ce26ba2-866c-49f5-a340-bd2f93f8a7a5", "value": 749024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682229272, "uuid": "88ddbfa3-007e-4fa0-8bd9-20af11ab9fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229272, "uuid": "f2816215-c25d-41ed-8648-b15699c391b6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81c5501-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263830, "uuid": "67430f42-fffa-4279-a4ab-6811ec385c30", "comment": "Malware payload (RedLineStealer)", "value": "c1b28c2d342a546d10dffe4e6f97cc13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263830, "uuid": "814714ff-d139-469a-bedf-d9ba92def4cc", "comment": "Malware payload (RedLineStealer)", "value": "2c3de095d8ece9c86c81192b6eedefd1bc46b32c1b7ae671003fcd88ec59d2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263830, "uuid": "c97880d8-0c5f-4975-81e1-b5681f6d1154", "comment": "Malware payload (RedLineStealer)", "value": "60a3fe7e03c9531587dfb037dc19029992c209ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263830, "uuid": "2e01d11a-eaaf-4877-9b9b-dca3d3dc9170", "comment": "Malware payload (RedLineStealer)", "value": "f0248aa6e63209713aef3a744ed30adea90715c7c6e1c1e0d76240d96c41391deb678553fe8e979ef4c56e8d99ad11de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263830, "uuid": "20eb61b8-9073-487d-8905-4a06f5da3bfa", "value": "T19D34AF117AF1E073F6A785704870EAA42A7BBC625B7681CF33581B6E1E316D14A7D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263830, "uuid": "3a711df3-f776-4eee-ae59-ec2f7351c4ec", "value": "2821f07e04708b885221a29f6cc88220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263830, "uuid": "0bc0403c-c7cc-4388-a8e4-2170df30e4cc", "value": "3072:JaFd/6bjo/yEiKw6+T96nkbtWP7TGcEOFVZy5x9P3tx+4lQ:0f6QyEJbScTactV4dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263830, "uuid": "51ea1434-eb6f-401a-aceb-ae2bc87c7ff5", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263830, "uuid": "c52d13b6-2024-48f2-b841-a7276212b29b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263830, "uuid": "3a3b1cd7-f299-406c-81d7-a14382a4aa73", "value": "c1b28c2d342a546d10dffe4e6f97cc13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254112eb-e1ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682272147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272147, "uuid": "d43b46c8-9281-49a7-80c9-e4f14b0d2cfe", "comment": "Malware payload", "value": "6aaa4040e2a901bf52518a4ef891468e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272147, "uuid": "bc7be6e8-55d7-4ec9-a066-714e397448ff", "comment": "Malware payload", "value": "2c4c460c5a1104ec346f276a0d89f0748d7da86e5e19134ca61543083a922e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272147, "uuid": "f8a5b62b-844e-4c2e-9d5d-8e1ece983b45", "comment": "Malware payload", "value": "db2f3e957dbe3cb79cbea5c024fb734b8e524881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272147, "uuid": "8673f810-c3e3-4fc1-b68b-cc944f44c584", "comment": "Malware payload", "value": "7da3bf03caba582d6da557b51a2603b5d4b780812d8beb79c309ff137074dcdf0ea1c7b54ffd7ceedefb449f57832c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272147, "uuid": "aef991c7-0c7d-45db-a74c-f7a10a2d77c2", "value": "T1E673B38235B62231DF81D07B9482C5B99D3A6F21173E897D3CA6FE3A29F13543986D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272147, "uuid": "775977ef-cd89-41cd-a79b-8d03806223bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272147, "uuid": "e4d95feb-47ad-4067-8b9e-c8e8f9c2ef56", "value": "1536:gtvq4xmetEeopChiH0hLP+VVVVVVVVVVVVVVVVVVVVVVVVVSvebEI:wv51tEe0bH0hLNIEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682272147, "uuid": "60b2ee39-f557-4737-a59d-c5eb50ebc492", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682272147, "uuid": "5b35e1ce-18c7-45ff-8024-2feacc9f213f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272147, "uuid": "c114e6de-30b4-487a-9597-feb99711765c", "value": "svchost11-11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463faaae-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258459, "uuid": "6cde992d-1cb8-4752-879d-0fa7eace9f6a", "comment": "Malware payload (Mirai)", "value": "7c1e053f9d6da3feaa90b8eb2034e962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258459, "uuid": "49250d86-6135-460a-be7a-1b31275061ee", "comment": "Malware payload (Mirai)", "value": "2ef66712d517095bb7bc3f906ba44d635332af0916cec4af795b804eeae9d878", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258459, "uuid": "36b0b7f0-f8c7-4e7a-95e6-59307fa7fe64", "comment": "Malware payload (Mirai)", "value": "684b0eaf3a6627925122dbc6888d8a04e8a7ddf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258459, "uuid": "facdcc03-9210-4435-819e-eee40c42a294", "comment": "Malware payload (Mirai)", "value": "92bf45bdf54090decd9c7415b4acdeebb1ee9b72dd4a86c4a76d35b9ad4bd42fc8d2cebea92ab1a160b4d85cb5f3fcff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258459, "uuid": "591dde37-3272-44a8-a633-0270c44a45af", "value": "T1E7336C36E029DED0C6560134A4E88FB51F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258459, "uuid": "2e70d19b-d095-4a61-ae14-46863c46f7f1", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9fm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBim3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258459, "uuid": "324f9817-a7ad-49e6-9f6b-c580bc496c99", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258459, "uuid": "2f1bf874-64e0-41a1-b075-a60290a8aa74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258459, "uuid": "5edb25a8-a10d-468e-8ad2-674b37260e88", "value": "7c1e053f9d6da3feaa90b8eb2034e962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cf023f-e176-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682213285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213285, "uuid": "66f0500f-8435-4365-951e-49f107fb3249", "comment": "Malware payload (RedLineStealer)", "value": "231f3bbc3e94d915781fb30d1d20c62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213285, "uuid": "fb52aef3-61df-4a30-9f0a-02508331fffc", "comment": "Malware payload (RedLineStealer)", "value": "2f841fd38071bbef38189afd3922a50d222c895b42818629e6fcf99d42caafb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213285, "uuid": "aad15301-8537-4d07-b01b-8b2322af8f83", "comment": "Malware payload (RedLineStealer)", "value": "49150df3ab973916ce28a05872f7c5bf606dd00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213285, "uuid": "a6a84326-f2f6-4376-8ad1-2a89c9e5e7e6", "comment": "Malware payload (RedLineStealer)", "value": "b816f4b55880964e698922bac0a5a753239a2a1a0420c142a9d40ff698a1731f8d588e562c8db8d485d09570912172d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213285, "uuid": "86b698fd-dbe5-4ef0-b875-a164950a3b19", "value": "T19C356B01F7A6C031D5E2FAF70DB88660883BB5D3056188EBB7511A7BCF2A7C8A61C755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213285, "uuid": "4d6d7b48-1c39-4885-9c7d-8d951df73645", "value": "e28b3f7484bd5db9ff26da5bec4979e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213285, "uuid": "6bb80d76-ebab-4062-b6a7-a96910802362", "value": "6144:c8IXHaRijlgDAOb7dn5SPpxnhFzLzPUFrtY7wFsUaY:c8IXHBqAvsVNnaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213285, "uuid": "8309317a-3ea1-48a6-b799-68ddf9b021fd", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213285, "uuid": "42ab661e-3149-4b1e-a2f4-42e431adfb78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213285, "uuid": "a3b127f5-c5d6-4c92-b9ae-e22b688e64ef", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d47ce2-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264707, "uuid": "5de165c8-3480-4418-9514-2acd636855f0", "comment": "Malware payload (Mirai)", "value": "fc032fae5fa3fe77df6180823d185d6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264707, "uuid": "06b4b7b1-5274-47a7-9acb-8a0a8a4a0559", "comment": "Malware payload (Mirai)", "value": "2fa539a8ba4afd228cfd58326d0cacbc3461a19d31791f2931cd528c9545c778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264707, "uuid": "1ebda6ac-e088-45e7-9f34-8edfc8c7df35", "comment": "Malware payload (Mirai)", "value": "bad297b4ac7815177507d5f2ae5e54aaec6b5412", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264707, "uuid": "31f65eb1-6607-471d-8c94-f1f86e05e607", "comment": "Malware payload (Mirai)", "value": "24de265f15b8b8015729b09dec03ea7ba8f4f463159f42735b12ae5a3466168415b40f0cdd7790bf57a0a354046c21e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264707, "uuid": "4f0c65e8-fa1e-4bf3-b96a-b7c2cea23ee3", "value": "T1A6142A31643D2F16D4C0B97F12BB8790B2E13A4D2BA4C98DBDB30D4FFE2565068525BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264707, "uuid": "299149e5-38a7-4360-a8f2-63e0979a58fa", "value": "3072:+wf/2CQXLCZm+tj/FOC3sp+1Y06HbnBScyGvjxqpBJ:nf/2CQXLCZm+tj/FRY067BS7pBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264707, "uuid": "e2807cac-ca31-4c92-b8fd-229bb272b5e3", "value": 190536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264707, "uuid": "1d333f6f-f54f-40a7-9b6e-49eebbda0498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264707, "uuid": "1fdb0ab2-321e-430d-b1df-7acd7d96e831", "value": "fc032fae5fa3fe77df6180823d185d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9c7001-e1b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682238927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238927, "uuid": "be4efda6-a57b-4939-acd0-d6978b0683f4", "comment": "Malware payload (AsyncRAT)", "value": "1532c59188757a08c6165d8029d83b5b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238927, "uuid": "02ea843f-67d8-4314-ae3c-e4b8b6fed32d", "comment": "Malware payload (AsyncRAT)", "value": "2fa7468126e8461e495df1445a409b25ad9988ee734a492faea464831c073f3b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238927, "uuid": "ca28fdf1-1cb3-4b66-9bb6-55f225951935", "comment": "Malware payload (AsyncRAT)", "value": "e01f202c503fb29e1e65859043650edc90feeadf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238927, "uuid": "c36435ae-6b8c-402d-a23f-8f305a8a1017", "comment": "Malware payload (AsyncRAT)", "value": "71b10ad9645d6f99f2b4e411b026cb57b451cd55fac1b692bc1e5f60593ce3fdbb55146913fb23b2b5d2c89aa651b11e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238927, "uuid": "fdb5e6d9-ad74-4075-b9a4-e292635eaf7f", "value": "T17EE5F1331787FED1C7A94ABEE4D621540E90ACAB531CE1947CD874AB11BA620BEC5CF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238927, "uuid": "a2eaf787-5716-4550-8876-0080aca716b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238927, "uuid": "1bc2ae0e-3ab0-4e40-b2ab-674e14dea097", "value": "49152:BJCdi8aMi04/NpyW+3eQna4XyTjYmG9iJA1bVatCBSW7cWjUSk:Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682238927, "uuid": "78e3b5f1-dadb-4ede-b7bd-36eb724f6547", "value": 3079168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682238927, "uuid": "f98080ba-baa0-45b4-bd1d-afba15cf5f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238927, "uuid": "efbe1899-a4b7-4110-809c-20a50c838c7c", "value": "1532c59188757a08c6165d8029d83b5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cb24f8-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682232507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232507, "uuid": "0e8cdfa1-83da-4def-bb9a-d8d95d3a261a", "comment": "Malware payload (RedLineStealer)", "value": "a2afc8b6ba246ba38c2dbbe87d9e789b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232507, "uuid": "a08bc778-e703-4a63-914d-af27b8d5f874", "comment": "Malware payload (RedLineStealer)", "value": "3063a9d3df1ecb0250cefd69dad1cc1402126a495d77ea87dd650b63ef3b28cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232507, "uuid": "cbcc877a-d100-47da-8f8e-ada4187c25b5", "comment": "Malware payload (RedLineStealer)", "value": "fcebf02f90c1abd0823b125355b1a84a5fa12ab6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232507, "uuid": "52673183-fa7c-47b4-91e2-82f3f1e23d54", "comment": "Malware payload (RedLineStealer)", "value": "c49d5069e83c2ec7b88d2647cbdc7477ce85546599d3dd1e9f697cce724c4d8805b012bc622bdf57fd6a76248ae828d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232507, "uuid": "d802292d-a2ec-4714-b8fd-b6a00917f44e", "value": "T130452301B592F5B7E2EB427006B1C5747A7BB8609560978F336D6B2F3D313C29B4A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232507, "uuid": "43057330-260f-4b6d-9a80-19f1859b886c", "value": "f88982a603d93c22b0731529c5e6f4b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232507, "uuid": "bdc34a6d-eb32-4e78-bccd-ed2087e0ea59", "value": "24576:WZ/i8viZtNWceh50KP+8HInX9+nsbl54gOOm1J30y8zY:Si86ZTu7tWntyshqgOOoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232507, "uuid": "fd2464f3-a51d-4887-ae1e-bff740096404", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232507, "uuid": "09012f13-7e13-498d-9ee6-874213ed5188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232507, "uuid": "c367a337-ba30-4af7-b2d9-b82f1bfddd4e", "value": "a2afc8b6ba246ba38c2dbbe87d9e789b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f6124f-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682253410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253410, "uuid": "72a5b29e-e863-4da6-8e71-bd256c7c6139", "comment": "Malware payload (AgentTesla)", "value": "1e7be3757283f0992264dc394d36012d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253410, "uuid": "b4a7bbc7-4370-4234-a36f-119aebf68fd8", "comment": "Malware payload (AgentTesla)", "value": "31856a8460a730f9a125e1b47fac89b72d6213846848c2ee08de3c1eba04ccc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253410, "uuid": "1cd708fa-016d-4e90-b1d3-6592393df07a", "comment": "Malware payload (AgentTesla)", "value": "f701b8c22abe4633e8e733d09302cb066f104d34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253410, "uuid": "e9e74d90-7132-48d9-8d6c-26788bf5afa5", "comment": "Malware payload (AgentTesla)", "value": "4fc7795b8cbe97365af89764c105eecf3bc3e4f0d893eec6b96a16758c6422c0cf3c8ff26e07dec8a005825d564e395c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253410, "uuid": "cd27bf15-32b9-45b4-8dd2-2fbe501a9fc2", "value": "T15914236E5913505FF6C4D6BEC03F8835017EFC845F3E9ECC1AA88135BE005A9689CAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253410, "uuid": "96882c57-7fd9-4661-9e3b-0e3a3cca9c20", "value": "6144:pRFiz1aY05GUA7u4kBC0zqMNxkLwHsjbi6v:pRFiJvh7j+1qMNspO6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253410, "uuid": "df792331-13dc-411b-9370-7e516c3c27e8", "value": 204787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253410, "uuid": "f5426826-0933-4327-9d64-f7ffb972f987", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253410, "uuid": "e09914a3-7467-4307-b17d-99671b42bcda", "value": "Bank FOrm FOr Wire Payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6b9f56-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264749, "uuid": "09449005-0d8e-4c3e-b2ea-976f1a3cbcda", "comment": "Malware payload (Mirai)", "value": "5e3254fd4b26aaeaae58c766a12ebe60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264749, "uuid": "f3150ea5-0cf5-480e-92e1-658676d7c38f", "comment": "Malware payload (Mirai)", "value": "35d3365e176d2138e2003de4d2cf2023eb3156bcb77de3dd83db130d1aa375d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264749, "uuid": "5b6f9ad9-bda0-4dba-ab01-bc8c483d93bb", "comment": "Malware payload (Mirai)", "value": "d01d4826ccda82233d367c82f56da8476a87578c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264749, "uuid": "7421cfe7-7267-445c-aeff-c6128396f2bc", "comment": "Malware payload (Mirai)", "value": "fbdc61ad45371b488423d6f317578877b45ce185dca5117e0bce795af06dbc46db6e74b5255b62a8f8961863613cb9c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264749, "uuid": "87578ee6-d893-4962-9b69-2c628ad18e20", "value": "T12314F6416882992AC6E423BAF57E40CE332077F9E0DF71668C625F117BC585F0CA7B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264749, "uuid": "0b1f0982-fcf1-4d4b-851f-cca54f6ce7a8", "value": "3072:gKhvH8if1NNrC8KrIqV3Cf2liZsN0D1Kpfj3wNs9y:gKhvH8if1NfiGmKMpfTV9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264749, "uuid": "73b7023c-2158-4ccb-adbf-4b7fc3ea8798", "value": 205820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264749, "uuid": "2a7e5cb4-26e8-4d4f-9abc-9cc40b73d5b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264749, "uuid": "a338982f-4379-47f1-9bb0-c281b54277e9", "value": "5e3254fd4b26aaeaae58c766a12ebe60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3bf9ea-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232457, "uuid": "24c013de-0cf1-4aa2-9a99-6733c827e45a", "comment": "Malware payload (Mirai)", "value": "210dfe44059501739bc42f215db0adaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232457, "uuid": "844a7f75-bd7a-44e3-b168-805eaa93f32c", "comment": "Malware payload (Mirai)", "value": "360277ab0be05cd667c52bdcf6b6a3b85cab02e36400019469acd99ba2dda0da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232457, "uuid": "db11d17e-d65a-43a6-a481-137e5f257dec", "comment": "Malware payload (Mirai)", "value": "4b3de559aec2dad5e137cad551054abf6cdb054f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232457, "uuid": "ba098b90-3832-4ff0-86f0-bdc31e1024d9", "comment": "Malware payload (Mirai)", "value": "281b584fe21a4eda4ab439c860ee3761a2dcf93ffd82a103ce2071e7e63fc0b2c8f1bff51b225c3b11128221eed1256b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232457, "uuid": "afd689bc-dcb0-4bfa-a285-d55b9f62fcab", "value": "T104333B4DB8011E1CE9E758BC602A8F1A9E512790A1931B0F96F6FDC22C73265BF36DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232457, "uuid": "bf90d572-6e8e-4239-b163-ab81fb33a417", "value": "768:nOrnez2N2tgo/4L5zjr4tKFrRE/P/KqttVjuYdG7h6:Ojy42Co/4L2yrR2iatYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232457, "uuid": "21f29f1c-9caf-481b-ab26-047da4ffca83", "value": 50356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232457, "uuid": "eb33a385-0668-4dd2-8db4-6266da7b686f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232457, "uuid": "8e5a1a29-49f0-4bf3-a345-d1ec34c4665a", "value": "210dfe44059501739bc42f215db0adaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4caaa05-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232498, "uuid": "74de3e64-e1e1-4ea5-9ed0-c21c037c22b3", "comment": "Malware payload (Mirai)", "value": "3b3baae103bd57bc809dcc89713d7287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232498, "uuid": "fa0d664c-c86f-4159-afef-4e8876f4342a", "comment": "Malware payload (Mirai)", "value": "36f34cbdb5d5af1b47597b4b47343ba6fddfa49ef013167ebc8cc2f1b27217b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232498, "uuid": "d5febde6-2b4b-4ba2-a3c1-4648efb422e2", "comment": "Malware payload (Mirai)", "value": "17f614c4214bbfc34fdd7aac1b42adddd369a9a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232498, "uuid": "16d1f623-479c-4c02-afd1-8eedaa5854a1", "comment": "Malware payload (Mirai)", "value": "0e9300fcb58d1b05fd69fb034e021d96ff66b95660977c5bec48a9cc9238b999203f0a47213fc4b414ac5d49f042fed5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232498, "uuid": "3c14ac55-54e1-4fc8-8024-3639ddb21bde", "value": "T16B633B32B9352E17C0E6A97E11F74B10B6E166CE26A8C61E7D730E4EFF606106543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232498, "uuid": "ad4c8099-1a83-45d0-a6b5-6f7e09b6c2a4", "value": "1536:1obbq9SI/q7JQ0px2b7SJsVXJF4xPFN+AA6deZ:mT4QlFmX+I76deZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232498, "uuid": "624bb5d1-ecae-44f5-b5c5-3693d4f04c2c", "value": 69648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232498, "uuid": "f7693481-922e-451b-961e-55f820c4c062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232498, "uuid": "4019531c-d34d-4e39-9d8d-4301da4bb4e0", "value": "3b3baae103bd57bc809dcc89713d7287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3228caa-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260896, "uuid": "1031e561-2613-4955-960b-5b6771d142be", "comment": "Malware payload (Mirai)", "value": "30e2ca3aa85592fc650b8b83f1ac8249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260896, "uuid": "dd742f00-f6d8-40f9-88a7-630ead86ac9e", "comment": "Malware payload (Mirai)", "value": "3729b2bb3807b616022d2000723771603b920bd8571d61cf6491224d69977a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260896, "uuid": "94f51de3-8090-4864-9d74-984fa7a74733", "comment": "Malware payload (Mirai)", "value": "7672e487379507ff70ec9f47217a7adb864544dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260896, "uuid": "a069d317-4a7c-465e-9dc9-a39c3976d867", "comment": "Malware payload (Mirai)", "value": "235f9117ddca8531829f7369450e122cf2f6b55ded4e4cdb6aa548094dc4901ec376ef4f7937a2f488f5721c4c6bd8b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260896, "uuid": "11fa28a5-6cd8-4334-89a9-a8daa6e2deeb", "value": "T19D634B24A97D2E27C0D4A13F52F78325F2E6230E25B0965D7DB60F8FFF2464468162B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260896, "uuid": "86e7a9d8-9c97-4a25-88b6-d6f0234f7204", "value": "1536:UXR6xc5kXAxopkzneUFxcvX7sF1AvPjXeFI6fP:S8XRqxxcve2vPDe+yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260896, "uuid": "c70c8013-3f94-4ab4-a3f1-ac8fb83aef9f", "value": 72564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260896, "uuid": "8159fad3-5e5c-47c3-8cf7-67dc39be895d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260896, "uuid": "f22b6f16-e9a8-4a04-a9d7-fd2a1feea6a1", "value": "30e2ca3aa85592fc650b8b83f1ac8249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af316284-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259064, "uuid": "f6741a96-4bc0-4b3c-944f-1534988eda67", "comment": "Malware payload (Mirai)", "value": "5066639c98136523bd86bc70075dcee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259064, "uuid": "3978df17-1b74-46e2-8ed8-7cdd75bdea15", "comment": "Malware payload (Mirai)", "value": "38ad5d96d0131e80d496614a56ed5e1969b35a43b96f539d4426103ee75e8b0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259064, "uuid": "d925767c-7a58-481a-9a86-c6375cd0c8e4", "comment": "Malware payload (Mirai)", "value": "e4f4bd254033659b32a13426c2b0fd9573feff25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259064, "uuid": "47ca7b2d-be22-49ff-9db4-716e5ac72e64", "comment": "Malware payload (Mirai)", "value": "ab1be1df03fff3a60052c222a6ac0c14f95472713a3470a678124e6841b6c04d0678ef6f66e73176394ab362367e9e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259064, "uuid": "77866392-5a26-480a-89b3-94b56157de24", "value": "T114B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259064, "uuid": "a8fb4242-3d9e-4deb-8040-7432d00c3462", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAd+TRCm7FnVqfJXFWbNb:T9a2aLqkrMQsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259064, "uuid": "e87b04a6-e333-4ef7-b6ed-da158f28d25f", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259064, "uuid": "bc7e276c-8d9c-4ffd-be50-e50cced11f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259064, "uuid": "99dac563-6679-4472-bda7-5b8212a3b76c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2139ab68-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258396, "uuid": "6e320bf8-1bb8-48fe-849e-88984e861cdd", "comment": "Malware payload (Mirai)", "value": "4a51ba8956cb16c37bc124f63457859a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258396, "uuid": "073f15c6-eadd-4563-8f2f-2bd49bc94895", "comment": "Malware payload (Mirai)", "value": "3a681df612bcda25e70c15546251b21f1a33b9f476095d00f8d5b9a64d4bc1b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258396, "uuid": "e6970f3b-2a14-46c1-8f73-e4f38149c125", "comment": "Malware payload (Mirai)", "value": "ad2dea3e6be3e6f0413ad32de5a01e7edb30faba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258396, "uuid": "8f623cb9-5d77-4fca-bdc3-05677c430e9b", "comment": "Malware payload (Mirai)", "value": "3aea454aa3953a4bbb78b248e91ce07ff9cfce4df391fe276e3a87706281c2d243c396cabdba2b5a29e23b663de46662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258396, "uuid": "397a9fc3-edf7-4e96-a781-15e95c68725c", "value": "T143431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258396, "uuid": "44d38757-d61c-406a-9965-9304e4222f87", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TA:/M99jmL8BZp9IFUoWKdYuvQ5BIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258396, "uuid": "e9eb6877-aee4-4b11-b6bb-6aeb351d5c8f", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258396, "uuid": "bdbcb120-8f14-4a79-8d08-47d65ab51a00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258396, "uuid": "0979233f-7b42-445d-86b0-3b1c7cd39648", "value": "4a51ba8956cb16c37bc124f63457859a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2728386f-e1a1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682231778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231778, "uuid": "0584e70e-7529-4446-a4e3-c43afb7a4604", "comment": "Malware payload (STRRAT)", "value": "d5c6fe0e287377e9286592e0a66992c8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231778, "uuid": "71330eb0-79f5-4e5d-a48c-2bdb22a69acc", "comment": "Malware payload (STRRAT)", "value": "3a87b5d691d653b4de5dcfb13b851fee512a747ac0cfcbfdde75c701e2068aee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231778, "uuid": "8616d638-e53c-4b7f-b881-301002c39ed7", "comment": "Malware payload (STRRAT)", "value": "00c8667378c6a2defb0ba36cb60108e51248d72a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231778, "uuid": "3bdd18a2-77be-43db-9694-14337364eed4", "comment": "Malware payload (STRRAT)", "value": "f3dfc46958e8158184e66aee0c7bcedfc4a1e8ae6368f73e2c57966876c2a6af44cd178e12a901d5f37dddb8a0ab1023", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231778, "uuid": "abcb9a41-f85d-4e30-ab7d-7fe360f88f23", "value": "T17B63F221FF04A6D8D23748752B81CA4B385BCC896E57DD2F539C4ACF6B105CE8B925D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231778, "uuid": "d9c8e07f-2236-4eef-9c8e-d1be4d27e21d", "value": "1536:cCSNM7OHaM32+F+fnYpHo1gjqfXxMZrIDZcmWnUHAT9aOvF74/o96:HSW7OF+fnEZOG0FlgT9390z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231778, "uuid": "69067e8e-c4c2-4bf4-8498-7f66469ff025", "value": 72257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231778, "uuid": "ef426186-6cf7-47c3-8583-656ebf269aa2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231778, "uuid": "aa6cc558-b16f-482e-8203-6560b62aeb99", "value": "Purcahse_Order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71c9ef3-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682263829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263829, "uuid": "72c0bbc9-a27b-4378-a06c-d4170b5be23a", "comment": "Malware payload (Amadey)", "value": "c7e14e60f891b01f1253b0943e047470", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263829, "uuid": "498f8d8a-dfe0-412b-b3dd-d186c02aa2ce", "comment": "Malware payload (Amadey)", "value": "3bcd7acb77ef7bb10b4ee824d285d0ec70192a4e49842f856337627f674093bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263829, "uuid": "a7fb35ca-5c60-4d0e-a8ee-714a80e2b5d4", "comment": "Malware payload (Amadey)", "value": "a6044125d59fa3715d403ed1dfa0c06cb70a6601", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263829, "uuid": "782ecbad-9c87-4f9f-aa5c-309f814e08a6", "comment": "Malware payload (Amadey)", "value": "5779d204ae28e04b4444e42410973da1521c9799e03be999ae0b4145043f718d50b2153c99e5af17de6023b717b7ab6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263829, "uuid": "b1e55751-1f91-406b-9842-57c9258fce81", "value": "T16745230179E0D07AE59FCA319431D6A51A3BFD72DB3680AB32352BBE1E314C29975372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263829, "uuid": "c9a9df0c-6ad6-491a-ab09-5765d2f9155c", "value": "2821f07e04708b885221a29f6cc88220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263829, "uuid": "1f2dadc6-3e41-4d27-87b7-4de35b0fd05a", "value": "24576:gUcKJEq27vir3VnDKRthL4H70Hop1YZzBOVkicYVgcLtFonRiv:gSeq2MZSjLg70cCZdITrrARi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263829, "uuid": "e34c4ea3-3be8-4fba-9b03-21aa35384ab9", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263829, "uuid": "05a5582e-0f5d-44aa-9b37-aec313c74aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263829, "uuid": "2723ea8e-c2a9-4c23-aca3-c0e91185e335", "value": "c7e14e60f891b01f1253b0943e047470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b71aa19-e1d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682254924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254924, "uuid": "ca1211ba-db77-423f-9b96-cd4a38d7507c", "comment": "Malware payload (Mirai)", "value": "274cfa8f241fd7deb6b36c134e7aa04e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254924, "uuid": "ffc6c267-e146-4f0f-8db4-9afe0f5e915e", "comment": "Malware payload (Mirai)", "value": "3d26abd2b3e2496596587fba887d2936bd6e0570eb470020fe93c6de1a50a0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254924, "uuid": "b981734c-d778-4aea-845d-3fef5f72b3d5", "comment": "Malware payload (Mirai)", "value": "0e223f27c21912e38fbb3d97ffdcc4992a0b2b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254924, "uuid": "3f1b5b27-57b6-4f31-8a48-4b8c1aeace70", "comment": "Malware payload (Mirai)", "value": "55dbcf7d6e4369f864279c92b11c2dda3183a8a034592f004e3e0c7956249ce76ed16e742e537d651d26d7fe22f48ed2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254924, "uuid": "6df8bc7b-2362-4d71-9ca2-c306dd6bbb90", "value": "T1872308C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254924, "uuid": "22ae3348-65ef-4522-9d50-9a42c99dc97a", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve0AG+1pa/4Qw7bn2iue:Gv4QPfZfW5XTOeofzG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682254924, "uuid": "28089983-218d-45a1-9b45-12714829156a", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682254924, "uuid": "824c2837-66f2-418a-85fe-17708d5ff2b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254924, "uuid": "5465e42b-90be-4342-9db2-5355c5faf8cb", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23357b65-e19c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682229624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229624, "uuid": "cc160b1f-5f40-407d-ab3f-0fc4831d0f8f", "comment": "Malware payload (RedLineStealer)", "value": "380015dff7c689e8785cef9ed1b18ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229624, "uuid": "f97ab735-7f56-4d19-842a-00d2c0a7bdf5", "comment": "Malware payload (RedLineStealer)", "value": "3fc7c2590c600a7703042b038aeb6a135e0be8b0c4c0faf9e28df4f6934ca2fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229624, "uuid": "f0bed32b-03d2-4188-bc56-d34b77ee544e", "comment": "Malware payload (RedLineStealer)", "value": "c4bf3f6a28dd1bf1316f0560ab7c5078b070b15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229624, "uuid": "91a2c063-bdc2-43ed-bdca-3d44ccde9017", "comment": "Malware payload (RedLineStealer)", "value": "033664834f45d41889c276bb5e0904ce8debe6e7939f32059c3c1a9a21c0c15569eb7eb8497c3a5e8f6f9f1c5045c450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229624, "uuid": "5b52b7b6-ab3c-4b3b-86be-17412154916e", "value": "T11CC41213E6ED1076DCF5277068F913830E3A7CA15F79839F2605A4DA4CA26C49A3637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229624, "uuid": "4ccac349-4748-4788-b233-22b5bf411443", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229624, "uuid": "82083a9d-5dd8-4396-a701-122406fb160c", "value": "12288:/y90xZWBxBhG5pmb/6VJSphVgbFT+1B9udVJTprZvQR:/yeZW5ZcsQQLApSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682229624, "uuid": "6241be58-275f-4129-96a0-b1dd22ef0a12", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682229624, "uuid": "728e4e0d-fa4c-4341-9eca-776279796561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229624, "uuid": "1b10e190-a05b-43ef-b85e-46712e15cd52", "value": "380015dff7c689e8785cef9ed1b18ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecd65fa-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258446, "uuid": "3850ecc5-7071-4c65-a3b6-3422c18ae56a", "comment": "Malware payload (Mirai)", "value": "79992d37dc37ac54a75a24942454703a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258446, "uuid": "fbc1613d-5ed3-41c1-ae8b-8c141614218d", "comment": "Malware payload (Mirai)", "value": "3fe91c751869a40bab4491853bcdb40527364cd1b8535f7ba62e01da347438f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258446, "uuid": "da96d824-82da-4257-acfd-f557e1886ab9", "comment": "Malware payload (Mirai)", "value": "a92e52b4734e04a8a3a405fce3ba6c420a29c2c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258446, "uuid": "e43a475f-55a9-488b-b6c6-f69882811f22", "comment": "Malware payload (Mirai)", "value": "c71d69bd3c571abe78bf0a74b0221028cd54a60e82180d98f0a12f0e3859edb3249800ab831c9b6f8039cf804fcbf331", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258446, "uuid": "dde1c173-f1c1-4329-9c23-642b2660e7b6", "value": "T1CE330A9EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258446, "uuid": "55474215-58fa-4191-972d-fbf3fe5f083e", "value": "768:gduPBFnHooqR8qOCKq2zH4/te+TK806MMUVjzkfQXObHud2oGW:r/hqaJzeteqK806MHdkfQX6HuCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258446, "uuid": "f4caa1f6-65dd-46da-82ff-7b887fa7b56b", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258446, "uuid": "15773b0a-ff89-48aa-9594-8d5d79154c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258446, "uuid": "bc8bed9c-f37b-4f74-bf7c-ca4b92d12b25", "value": "79992d37dc37ac54a75a24942454703a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb185409-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257876, "uuid": "353ba492-1cf9-42a6-851f-1686a57ac882", "comment": "Malware payload (Mirai)", "value": "efca6c594597706c00ab64fda7745fbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257876, "uuid": "b1f75532-ff9a-41ed-a5c5-b85597edeff3", "comment": "Malware payload (Mirai)", "value": "3feabba78240c929a45806a0586e160949995f37276af2efee1c352f8b52bea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257876, "uuid": "a4f17248-b7b7-4a80-889a-27f9b1323f21", "comment": "Malware payload (Mirai)", "value": "6ebe8f18e364db50c8f6d7d85afc40241a14ff70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257876, "uuid": "d7fd2bcf-2e8e-4add-9e78-e38aef329277", "comment": "Malware payload (Mirai)", "value": "db52ce5368d4e0c116e312c946ae4abd47444a9b69f52fab5bbb352075326ddba22e9c4fbe35fdad24333d3b590be136", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257876, "uuid": "5365a114-f6b6-42a5-bdf7-28c78aabc09b", "value": "T181735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257876, "uuid": "2717b8bb-a03c-46c7-967a-b9a6776fec10", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8K:YwfdNu4cmZvFqI3w7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257876, "uuid": "9e3f9ff4-0a08-40c2-8c19-118177a50a0f", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257876, "uuid": "1fe2fb1b-9e78-4dbc-9d01-55366c1f3677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257876, "uuid": "4a580d69-888f-4358-abab-af4219bd0005", "value": "efca6c594597706c00ab64fda7745fbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c2cf08-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260919, "uuid": "968c0dd1-f9db-4282-9b0f-7d81f4d044c0", "comment": "Malware payload (Mirai)", "value": "2d5c6434cbfee17665eeb76da3562737", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260919, "uuid": "21124f23-d3fc-495d-a55d-28cb9744022c", "comment": "Malware payload (Mirai)", "value": "41973c95fad0db201d106f82cd19469ef9e8571fad04f72dad5d58072af29cb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260919, "uuid": "d6b51601-faf8-4d9d-a08c-e270ef1f215c", "comment": "Malware payload (Mirai)", "value": "ea342033175d83c66bc210b4210ed624ab1e329a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260919, "uuid": "89f1b632-4ecc-4863-9043-9593c50bc0a9", "comment": "Malware payload (Mirai)", "value": "28c58a1856a6aee38db164e1aa5dee1ac50409c252b46e17289f304f7c7cfc1972a846212b82b891e088f811b874d35a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260919, "uuid": "cf01e8a3-96c3-43e3-bcb4-f824143cf5aa", "value": "T1FE930956BC819A11C6D412BAF92E018D332357BCD3DFB227DD105F20778A92B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260919, "uuid": "25cfeed7-932e-4a2f-abee-907dac5935d3", "value": "1536:YBn7hY/KSIXDX2p81dKpDqrDL1F6LFnaZbD33M4i2mWakQvjS5bYu:mp3j2p7WJspaxmWakQvjS1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260919, "uuid": "a45c6d66-85de-477a-bdc5-8d3ff7dab3ab", "value": 92616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260919, "uuid": "1407ca68-9b1a-455a-bec1-5b4a314df63f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260919, "uuid": "761421ff-433f-4db3-8c81-23a406f720e1", "value": "2d5c6434cbfee17665eeb76da3562737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df5d5b3-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259250, "uuid": "58abc70f-2f3c-489e-8908-1905c2ad34d4", "comment": "Malware payload (Mirai)", "value": "99617044b2d9b03a2fd03e2a1e61cc2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259250, "uuid": "0128a010-6094-4b84-b267-96c7690bca33", "comment": "Malware payload (Mirai)", "value": "4227e65e0235084128d6eb8c3dd107ca646007da417809ee72087c04d924e1a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259250, "uuid": "fcf67d2e-b0e4-4937-98ee-ff98c93bdee1", "comment": "Malware payload (Mirai)", "value": "dd07e37783ef8033f6903dd97855ca945d03dca2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259250, "uuid": "612a7fab-a272-49f2-8254-66bd71a7b8b1", "comment": "Malware payload (Mirai)", "value": "f1057abbf4ef3f0fdd0b2a657907e948cd3fb4d30a6848be517d7d1af8eb5f225aa7922ea6c5e36d695afb2f03a5c37c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259250, "uuid": "fb59375f-6fe6-4394-9ced-65598f05798e", "value": "T112539FA5C5ACAD58CB1445B8B614CD388723F408A5E72EFBD646C796800BEECF1587F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259250, "uuid": "56a9c2c0-ebee-4cf6-81f4-74c0fce572c9", "value": "1536:XaoJRnrB/mUU5XtiYmG6u1KUDYofs3Qb9jQrNUxb9CH:XHJRrBeUUfw9MXBf+QJjWNUxb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259250, "uuid": "f066999e-898c-437d-80fe-72ca03d6f67a", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259250, "uuid": "a8900c7d-313e-424b-a76c-31b4be878af2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259250, "uuid": "bc7482ed-d5c5-4ca9-b403-1c684ab75af0", "value": "99617044b2d9b03a2fd03e2a1e61cc2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94df330-e1f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682266812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266812, "uuid": "0b2c07e4-bf64-47bc-af89-d8f8eb87cdbc", "comment": "Malware payload (CoinMiner)", "value": "0c88b9ca0568638f1ecac1f26bd4b313", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266812, "uuid": "91e6f201-8fa4-4131-8fee-59bbf8606b54", "comment": "Malware payload (CoinMiner)", "value": "42512e8e1edcb73da0e3b5a3422dc471f26a381534e258efdbd43a9225e40ae6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266812, "uuid": "65a61224-7a73-4515-85b3-4ee88bdcdd87", "comment": "Malware payload (CoinMiner)", "value": "f7484f2591abbb625ba100b9b5cc09b60d6821b2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266812, "uuid": "dd51f1af-3ef6-4c79-99f0-0d21dfa4636f", "comment": "Malware payload (CoinMiner)", "value": "468fecec955af4818f35826469e356d1c60e9a0651db536ad8fae8faa2c9a256a8a0b351c848ae30f5c6cc840e21cbbb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266812, "uuid": "41ff2ac5-637d-4820-b10f-f86bd329f68f", "value": "T16F25719D3A672DB6DD4E01F2CB513AC95B61C75AAF00E0E62B5346C9B20D1339DCD0AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266812, "uuid": "ead54286-0fcd-45d2-9b56-377d5e5b011d", "value": "12288:Th/A3m1OSjUbR2e2Lei+3avJr2ZTTwLYbNzsaTO6fqWREdMil7kas8mOf17Gs5Lq:Tq3KOSANKeqp2uYOwsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266812, "uuid": "daf23d19-0571-4728-b5fc-8cc0b8a8976f", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266812, "uuid": "6ea3e186-975b-48f0-ac60-d6353ab23bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266812, "uuid": "f4db1010-7d39-416b-be98-c4a686d83577", "value": "0c88b9ca0568638f1ecac1f26bd4b313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8791e52e-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253414, "uuid": "89787d93-f5ae-472c-a8d3-c0d99d56de01", "comment": "Malware payload", "value": "a6a0845bbef635b6cf1310ad78c8be80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253414, "uuid": "bd2240d8-fee7-441c-aa2a-1555c8a6c200", "comment": "Malware payload", "value": "42ecd5a8f6d3a5b12f601b409e8de8d9155ac686da13a9310fe716b36b77f5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253414, "uuid": "8bd663fc-7d7f-486c-a58d-6b30bca3a8dc", "comment": "Malware payload", "value": "24b3236936756693b537d67c02d33f30f3304eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253414, "uuid": "99c52444-5849-4624-a881-4fc8bfce8f68", "comment": "Malware payload", "value": "9648d3310493193859c0636c510b6623a6e28a3a1e43be758f31982fa2e0a85b00f02e527da011381c2d6184190f985f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253414, "uuid": "ef265cae-3159-4ca9-8c5a-91f13b794c05", "value": "T1F1555B3439EA501AF173EFBA8BE475DADA6FB7333B06A45D1051038A0623E41DEC153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253414, "uuid": "30b4a079-4e51-4aaa-bbf0-47db7f7ba81e", "value": "12288:dwgZWVAblJ71LjbquX69fUlodjdC2+Yf0xfgw5UUdNF52n/4DwMN/57rh/hJha/u:/JZt6cYc9/r6wFmGD7ZH5f2sNnaKvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253414, "uuid": "905a3fe6-ad4a-43e1-87f1-265afe19e958", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253414, "uuid": "f53936c5-8a0d-4686-b536-778c47fe2fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253414, "uuid": "806f13d0-92fc-4c62-b229-2515d76b1ab3", "value": "FV0231600 MNS 14.04.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6173ee6-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263827, "uuid": "f23d49ee-2999-4a2b-811b-0b6a526b33c2", "comment": "Malware payload (RedLineStealer)", "value": "c9d53522dcff9e596f6b0828e252945f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263827, "uuid": "296a36d6-4fe6-43d5-936b-fe9c4b715145", "comment": "Malware payload (RedLineStealer)", "value": "46434ace2dbf0d23316b3f3332ad004961805c3c9d0b1a784868aee16278afac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263827, "uuid": "ac322f58-70fb-42e5-bfb4-79d0a4b68b19", "comment": "Malware payload (RedLineStealer)", "value": "2bcf300108fb5b6bc61dab9c349b768ed6684516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263827, "uuid": "fbde942f-80fa-400a-bf80-5aa6056dbdea", "comment": "Malware payload (RedLineStealer)", "value": "2e74442cc34b35c132cdf8720293c9587cc26269024f16abed7a61330782fe076a50044a1fb208d35433bfd7d27957ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263827, "uuid": "0bbe8a96-82e0-4fc6-be5f-2b3d69b2a436", "value": "T165C4125366D98032D9F91FF45DF913830A38BC924B68839FBB4958AE4CB2AC47431767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263827, "uuid": "cb96a637-19ac-4dc1-ad1e-ef32d9eb1d95", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263827, "uuid": "0702f11d-21e2-4bf0-867d-55d8fec36bb9", "value": "6144:wVp0yN90QEXzHexpBCQhe96Il7KIQgdyuVf3+12om/LPZCh/GJO6nfsVqPm2/bY:ny90lzH2H3qX75df3boYLPiunnf3ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263827, "uuid": "e2008853-a88a-4fb3-874d-c536e25e051f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263827, "uuid": "aa04c75b-af7e-41c7-ad02-d5ac3b7fa2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263827, "uuid": "ba86d89d-c799-4fca-add2-a8abde94dcd2", "value": "c9d53522dcff9e596f6b0828e252945f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9266428-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260906, "uuid": "d1499aff-7f26-4b05-8537-9b97edf0f583", "comment": "Malware payload (Mirai)", "value": "7b42914c047cf783a9a5a34c3bf830f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260906, "uuid": "fb06eb99-30f1-46af-b37b-790bfa832e2e", "comment": "Malware payload (Mirai)", "value": "466b27e7fbac6760e7c063b132663ad1c01b72a8ac66459e9758d71ee7134a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260906, "uuid": "f808c6ef-7efd-4989-a4e3-2fb4ba93e7f6", "comment": "Malware payload (Mirai)", "value": "3c4f93587b081eed12b10610b1ca9cd0498e3cb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260906, "uuid": "f02e17ac-7a70-4c57-ad7c-330ff93895b7", "comment": "Malware payload (Mirai)", "value": "8511aff245d5ad73cd51dafb3bb849e3d2af74b07d977bdaddff150d9b98d9492f0f0b5242be1b29b52492332d61b166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260906, "uuid": "c6daf005-fe25-4906-b311-41a187ca1106", "value": "T107732A41BD819A12C6D522BBF62E028C372553F8D2EF722BDD215F11778A92F0E63B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260906, "uuid": "2541a698-c27e-4d2d-b1c8-f0a723dcaf7a", "value": "1536:ABI7RU9AdVZhqbcxjlrMI2a4RU990wjmOaYekbkgESHerCGkfgkq5Lq:8I7RU9AdVZgcxjlIIvuUb0oSnoQSHerG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260906, "uuid": "63204647-f3d6-4459-8228-9b1531415bee", "value": 79720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260906, "uuid": "573255ce-a7ea-4ce9-ac28-67e9d4c83ba4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260906, "uuid": "dfa2740f-92dc-4dda-aba1-2d26c61f95af", "value": "7b42914c047cf783a9a5a34c3bf830f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24240a9a-e1a1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682231773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231773, "uuid": "8886bd39-d190-45fc-91e9-d5b69c923733", "comment": "Malware payload (STRRAT)", "value": "46b73e13c9748868097b4751bda83a06", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231773, "uuid": "b7358713-2045-4ad7-b62d-f03fdfb017ca", "comment": "Malware payload (STRRAT)", "value": "479268b797540ad91375871768f5af29377e014ff999f4bc7c01d2dc08296145", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231773, "uuid": "d5e00b8c-c76d-4745-ae5e-1bc13b6e85a8", "comment": "Malware payload (STRRAT)", "value": "3d33e014cfda54745f843b3bc03e64f44e10d11f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231773, "uuid": "b6f6c130-40ea-4761-b4eb-47b84bf576e5", "comment": "Malware payload (STRRAT)", "value": "0ac8c6ff7a28f6404f71e8e0d76de8b50228e43bfb246760b9ee38ad7f4bcfc137afdf33dd5fdfe5266b30db0a0aa070", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231773, "uuid": "8cc5714c-a20f-4f86-9797-8e2e301a26ee", "value": "T19263F19BBBB0D73CD15F44F9F5519A03788F85988AC1CD0A22F650928279D1BCEE7683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231773, "uuid": "8c9b17e0-8d62-4126-8c41-1aabf9b93250", "value": "1536:4WHr9Z03u9OH3FIa1JmFEDjrGUqlFgKzLqSe2V:4WJe3BJDGFfg8LZei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231773, "uuid": "cb3cd386-f34a-4947-b33c-995087e6dd17", "value": 72303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231773, "uuid": "b04393e6-e527-4da4-8976-54a5c49fa705", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231773, "uuid": "9298864a-26e3-446f-aef2-b4b482dbc4ec", "value": "Purchase_Order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38c325d-e18a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682222135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222135, "uuid": "3c13000c-1071-4a43-a84b-771b08cfc88c", "comment": "Malware payload", "value": "1ba6aff61c12c90005f26b4ba72d0c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222135, "uuid": "74cf53c9-90b1-4f41-a8ef-564db652c184", "comment": "Malware payload", "value": "47ebfccf674b07b81df6379104ef8b9a31be66f597c4084446a92ff536756375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222135, "uuid": "669021f2-480e-4660-9f0d-7c87b37555cf", "comment": "Malware payload", "value": "253930a0a9ffa460e738d44aa3d9bebe6f41dd29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222135, "uuid": "04fddd9a-d6e5-4473-8889-8ac123203755", "comment": "Malware payload", "value": "c7839ba88d8f2d19d38b54aaca90c8279f2dcee7997a7fe211d6dd1c636ee087ecface2d781c56af2066e3e51c4bbdeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222135, "uuid": "3debb4e7-2dcb-4086-b534-100e7b609254", "value": "T14C17335373911CADD4410337AA3EC5B21922FC2BC754EC0F9D253A9A465B9AAAF30F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222135, "uuid": "17fd8711-6a0e-48fa-b5a6-39cd2f03413c", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222135, "uuid": "331818d7-d2aa-40aa-914c-c8ee56f480ec", "value": "393216:jvuLuJEn4A/lh2pugC4iEifhBFCmM+hfHg4Z6wBMPIF:KCq4YQpuggfhbNbhfrZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682222135, "uuid": "1a033f9d-89f6-42e4-8d4e-ee5fd6449859", "value": 19196653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682222135, "uuid": "df2fc8d5-42e3-4d27-9532-d0e9527ce21c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222135, "uuid": "e2c012ca-7208-4a9e-81f6-03b2c2a25ae0", "value": "[Official]_Fotor_secure_installer_4.5.8_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd886396-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682264699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264699, "uuid": "ac1fd15b-f968-472e-9e95-4f08a79d1aee", "comment": "Malware payload (Gafgyt)", "value": "a61a167061eb3a92457d8490f2a1f9c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264699, "uuid": "abd1eeee-902c-446a-957b-8112ec0db042", "comment": "Malware payload (Gafgyt)", "value": "481e2616f037695ff0328e1cd790884d673d7f4c8b319044dae8b2bae6a3da89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264699, "uuid": "9b914c3d-301c-4736-86cd-a40096949740", "comment": "Malware payload (Gafgyt)", "value": "8031f508da8b7f04ddf47e16b7fafb300fbb3d71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264699, "uuid": "2c6bdd7e-11cc-47ae-a46b-3d8c1a5a537f", "comment": "Malware payload (Gafgyt)", "value": "2dea28b23446a8f6c2a8c431bea27d07f9b6edffb87ad76a23fd19d504d958f0b92f7f8c74e4a3c92cef17ed6a13743c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264699, "uuid": "ace09b63-6bb5-471e-8e09-01174334d008", "value": "T181F3F701D5508B6BC6C35BBEF745A1CE73729E986F873306C719BAB027D06AA5E3D201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264699, "uuid": "560d78d4-1602-4c37-9419-d8f7a60536a9", "value": "3072:k+dzlAqsJt/oxSMpJCH+kpP6P510FwOfmGrzTJaq+i4oT1BhgsxqZOMEmyotq8Z5:k+okGr/JaB0h/xq8MEmyotqauUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264699, "uuid": "bab4c910-df91-4462-a161-09d539309922", "value": 164079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264699, "uuid": "c907ef40-b8f5-45c9-b478-141efb917e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264699, "uuid": "5eba391c-d24c-4af0-8dec-ea55a4fcbe3e", "value": "a61a167061eb3a92457d8490f2a1f9c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ef95f7-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259213, "uuid": "31c49b71-ff08-49c5-afa1-2bcb7d15b545", "comment": "Malware payload (Mirai)", "value": "0d63d20d1b1b171068bf7c462e427ce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259213, "uuid": "6bd4532c-4597-4794-82d5-0eec04458ed1", "comment": "Malware payload (Mirai)", "value": "485511d33cc4f37cc66a0fa6a4d19b1c25011f4fc926333e7637118a314dbc4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259213, "uuid": "a61bec0e-87a9-4387-838d-a7339711316d", "comment": "Malware payload (Mirai)", "value": "66d22d73467ba5824427c77e69734dc41edda57b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259213, "uuid": "67e612f3-26f5-4825-991f-1063d071483c", "comment": "Malware payload (Mirai)", "value": "e68b7af5f5b5da2be9c11bc459e285cf8a676bac988810ebada85e6fd8810041b93d78cdb2427648eb770437b97d71ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259213, "uuid": "075f18a8-ec7e-438c-80f7-94b8c874fdad", "value": "T151430851B8925E22C5E4637AF9AE418D3B2163E8E1DF3207CD216F507BDA81F0DA7E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259213, "uuid": "68103c75-2c47-43d5-845c-5625fd69513d", "value": "1536:agbVahbIKoPBLFQ6TPZDEiwSKIOj5dr5guLHQ:agbVa52DLwSKf9dr5gaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259213, "uuid": "c785a746-359c-4a9d-ac01-eea6b5b1fb44", "value": 58360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259213, "uuid": "4c707740-2e4b-41d1-aca1-276b64558318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259213, "uuid": "fd48789d-3b89-416d-9bbf-64a8acafdd74", "value": "0d63d20d1b1b171068bf7c462e427ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cfce09-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266316, "uuid": "0177e0cf-00a2-47cc-a982-a3887b4bde7e", "comment": "Malware payload (Mirai)", "value": "dd248debd06a7d6eac474a3e65142d3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266316, "uuid": "4851f883-8f77-4cc4-b0b9-9fac34cc56a5", "comment": "Malware payload (Mirai)", "value": "4a6b91c20160e3694d1f7c33874400bd9f9711bb833e3274527f35d874079876", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266316, "uuid": "43bba262-9c4f-410d-a2fd-fcc4a100b1e7", "comment": "Malware payload (Mirai)", "value": "ad5d3e537a445875da4cd14cdb86d56ce06ed9a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266316, "uuid": "c1b86ebc-820a-4f5f-8a79-1f2f97c77b27", "comment": "Malware payload (Mirai)", "value": "d4fe31d9c1a899b0913e8d4f63bf398bbcf27b9350b25cbf54c778e774deaea4b2b59d20f837668e91bffcdd8ebbd013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266316, "uuid": "ef66c7b1-e3a2-448d-8978-107bc9702822", "value": "T17EB36B22BE660827C1D4617E22F74321F1F3534E64BC9B1A7EA30D4DAF246503677BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266316, "uuid": "ea584e6b-38ee-427f-8152-c885db956ec6", "value": "1536:ZfL7Mo7k+LkkiZiPMvq6YZZwuDBNeufhxh5tel5it+vphaEaM:ZTQo2YMy6iwudNFh5gXdphazM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266316, "uuid": "a4fbb71b-e75a-4b9c-bda2-e28ffabb2834", "value": 110864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266316, "uuid": "989de218-877e-4558-8a34-8fb902e97760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266316, "uuid": "0ce4c18c-a8d0-4a60-8f6a-c549f9a12fe7", "value": "dd248debd06a7d6eac474a3e65142d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc89106b-e21f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682286199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682286199, "uuid": "3a0eec2a-2406-4b37-b5c6-2a92a364eb95", "comment": "Malware payload (Mirai)", "value": "7c5fb3c7fed47286efdf60fbf65a75c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682286199, "uuid": "6141badf-ee33-4e0f-946f-435ebc66bed9", "comment": "Malware payload (Mirai)", "value": "4ab29632c2aafe9b927e617240c90007e28b737c8e500fb545a1c748aaebbffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682286199, "uuid": "1964c395-fd6f-4614-880a-80c46c307b73", "comment": "Malware payload (Mirai)", "value": "ab2d80faf0897f1aed7923f179864f4ac9cc4da5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682286199, "uuid": "52f61185-19ca-4c0b-9931-1071dc355c9f", "comment": "Malware payload (Mirai)", "value": "4ca74886e1674d7a5efd4bf2cbf3ab11b3a286258a7a9fc96cab297195a9dc4fd03fc89640a5b767bb43cb06152761c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682286199, "uuid": "d3face87-5a25-41ed-bad3-44960151c992", "value": "T152A31984F69780F8E4070D75C02EB33FCB31791D48389B6AEFE4FE55E927A54642924A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682286199, "uuid": "dcc45bf2-c664-4766-b513-e4b2456fa65e", "value": "3072:tWVUppyzm9hKGQRQxOsRmu9lRTuoZi6+A9a8izT:VpWmuG8MhRXRTuogB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682286199, "uuid": "2a8dcc50-7965-4c38-a703-8ee058ea0fb9", "value": 106896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682286199, "uuid": "0cabd500-eda6-40dd-be28-5e4f32787441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682286199, "uuid": "20fa224e-14d0-499a-8d9f-70527292dcc7", "value": "7c5fb3c7fed47286efdf60fbf65a75c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a9f6f3-e1a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682231589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231589, "uuid": "f4233e26-06cf-44ae-ad9a-12c7f06ac22b", "comment": "Malware payload (GCleaner)", "value": "9c1671dd9569d7dbb33868caedf5b040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231589, "uuid": "215dfdd4-6d3f-43c9-bfc7-4386328f73fa", "comment": "Malware payload (GCleaner)", "value": "4b0310aadb20b5fc4037757c5f8220261297f3747f2570e8d2816259e3f50a20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231589, "uuid": "5a6647f4-0183-4041-a224-a59ea5464fa7", "comment": "Malware payload (GCleaner)", "value": "72dad67e1dc4ab8de9960d0338910d9120619701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231589, "uuid": "6bcfeecd-cabe-4b69-8b34-a19aa709b8da", "comment": "Malware payload (GCleaner)", "value": "416e0ce076a116b667c0ef0c7530dcd320559ec7044a665478696684e848529c6870c8ccb25758125620710a170f3746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231589, "uuid": "fd37f28b-daaf-4df5-9457-e1f942dbb1db", "value": "T125E5330623A0D43AD1609D737E3BC35DF67AFB2C6D36D85E76680A2D1E938A25D20317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231589, "uuid": "5957be8a-1489-4851-b1ca-331e0cb54e1f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231589, "uuid": "4cbd6cd5-0205-464e-a473-a8f637ad4f62", "value": "49152:zGlJfsh8OrjNcetGca5QlJi3RBxjVmpI7mznbY3qIrQe/rMRKx5Dk4dOOeneE5Wp:qxGmetGrq23RBxjVmu7OnbYaI9oCtdD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231589, "uuid": "cbef7535-fc7f-456e-a28a-0d070720a230", "value": 3057585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231589, "uuid": "305965b3-98ef-4b5e-bcb4-012013511cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231589, "uuid": "0fcc7c6d-b0c8-482e-8d96-8b52a3534ce4", "value": "9c1671dd9569d7dbb33868caedf5b040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abd398f-e1ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682264130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264130, "uuid": "41dd6dab-fafe-4862-b57e-26d9f9261768", "comment": "Malware payload (RedLineStealer)", "value": "f34a5c51485494405dd3a5de84f3c166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264130, "uuid": "f7ff6dd3-7de8-48ed-b8c0-04394d81887a", "comment": "Malware payload (RedLineStealer)", "value": "4b892b3b3a3e8defd0584162880c9665bb072dd1ff2dc4da8ce38cedc6416129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264130, "uuid": "57bea808-98bb-490b-8017-64de2443ff9c", "comment": "Malware payload (RedLineStealer)", "value": "30a5b41954b4d7dc5575c4fddceeeca07e2765ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264130, "uuid": "aa7c21ed-4b11-44c3-9d62-879ba5393208", "comment": "Malware payload (RedLineStealer)", "value": "f40ed44f14705fd32b2cc76bca49d19b51a5d5174eb8c83fc5b7064aae31c38b7cef0ceb3e373926ecb5ee1ca9bec366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264130, "uuid": "1ab03a8a-d7ce-489f-9a76-104a72fc68db", "value": "T17DE41253A7D95432E8F117B018FA13C70B3E7CA26B75979B6A40988A9CF35C0953237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264130, "uuid": "cf29b406-ac43-42dd-9afc-e5b06c3f05d0", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264130, "uuid": "390c451a-421c-44b9-b96a-a2f41d8486a0", "value": "12288:My90R8OYt37FTvmF8tahC4thvSrRiWx60Qt30jYiO:Myq83tL1+F/hhthvoRiWx60Qd0pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264130, "uuid": "e914137e-b0b4-4c88-8474-cc08167e90d9", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264130, "uuid": "014e9615-50f7-451a-a9df-323c65327255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264130, "uuid": "429d09fa-bb70-4eb4-9b1f-829d3700fcd7", "value": "f34a5c51485494405dd3a5de84f3c166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abb5d28-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260936, "uuid": "10af3cb7-81f5-4fbc-ab98-7afa8d4ef0d7", "comment": "Malware payload (Mirai)", "value": "151d2a5258c38c914b9bba933435cc65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260936, "uuid": "5819e0f1-3616-4956-bdef-fa3182b0eddd", "comment": "Malware payload (Mirai)", "value": "4dba9d173fdad551bbaa6d29c2098d7c855f2844d9bb163f0a9cc243bd07328b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260936, "uuid": "0e965ea3-1d9a-4455-931e-bed896566a60", "comment": "Malware payload (Mirai)", "value": "33880d9e2ed409ec7c0c277f19d909bdfd7fee86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260936, "uuid": "912a37b3-4214-4f93-81ce-480239b3791b", "comment": "Malware payload (Mirai)", "value": "126915b1b8e677996234a4d48fc3081ecd4e3018460ad6705229239db0adca35fb005310704fce73f59c59bd23c75cdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260936, "uuid": "c7f802a9-048a-455c-9b13-931dcba40edc", "value": "T1F6E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260936, "uuid": "8933a723-baf8-4aba-9c8b-47ff345220e8", "value": "3072:JW6dm9tS1aRGQdK76t/zCeI5mrThPaLEnvPrNb:c6IG+LCPmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260936, "uuid": "fc1f9cbd-cc52-4af1-b2b8-14580ef13934", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260936, "uuid": "6c0ad003-30bf-4d87-9815-7ea01dddccd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260936, "uuid": "d068ee55-3939-47e4-ae65-75b92f5ced40", "value": "151d2a5258c38c914b9bba933435cc65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa66ea6f-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259190, "uuid": "65acde44-0040-4ae9-b2a0-c71d3f15b293", "comment": "Malware payload (Mirai)", "value": "c2b64a42281fa00e0762f9c92f200567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259190, "uuid": "071a715c-7b96-44ed-a053-abc83b35368e", "comment": "Malware payload (Mirai)", "value": "4ec4e8094791706fedc0153b5822414fcfc36ebf4b944494b7696c278dd64de5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259190, "uuid": "ffde5f45-a7c6-446e-b3c4-f5b1bbd58ddc", "comment": "Malware payload (Mirai)", "value": "6e44d1ce5ab211ae49c8d3aa38bac151ef47ccbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259190, "uuid": "ed6b79a9-7602-476c-8e05-1d6cf488605a", "comment": "Malware payload (Mirai)", "value": "21bd3c14b395e26b7cc48b322371db8b88744101e96e6c1487a2f666b678442289255d29f6a6b1f031661dad9e6b2092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259190, "uuid": "bf81ca73-1878-4fcc-be0e-66f0739f9125", "value": "T1CCC2D1E6F65D1E4AC7FF94B32D50CB9073941F09B275C8DAA044F723562D922EA02AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259190, "uuid": "4cbeb975-b18f-442c-a286-081b00837840", "value": "768:fqMkNa3MeiQoOX1UO5sHLS/+7sK4uVcqgw096:UgMetbX1UO2H+QF4u+qgw096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259190, "uuid": "b7bd42af-0a4f-48d3-ad69-1511ddce4efd", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259190, "uuid": "9a340aaf-3b94-40bc-a3da-15d00c7418c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259190, "uuid": "084d94ca-5ec3-450f-9fe7-b8851ad1102a", "value": "c2b64a42281fa00e0762f9c92f200567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b577259-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682258360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258360, "uuid": "23e3a51c-df74-4b93-974b-b33d6725f2cb", "comment": "Malware payload (Gafgyt)", "value": "b02390f160bfe419bca89dabe3135bfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258360, "uuid": "0b037234-3018-4bd9-ae14-f1a3c6205a63", "comment": "Malware payload (Gafgyt)", "value": "4fcb874199e20c103ef6fc54cfcc8cc61cd08ae5dbd8b88f93312087617d6edb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258360, "uuid": "fd5fcb8b-05a2-49fc-8666-576a726c0e6d", "comment": "Malware payload (Gafgyt)", "value": "e010b0c6980af95cab3225d86b5e123da6d8b686", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258360, "uuid": "cfea83e1-4722-4c13-91a0-a33ace3e0483", "comment": "Malware payload (Gafgyt)", "value": "65602780af547d54adcc63b8e0821382e7dae7d7888faaae283e308be28003c27e6e89e2e41170cd2dee982a1b028959", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258360, "uuid": "4e661e01-135b-466b-ab87-bb4999aff44e", "value": "T129E30805C560976BC2E323BEF78E429D33322B78579B73255A34ABB81BC17AD1D79120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258360, "uuid": "12eae53f-d263-47bc-92ce-005ca648f416", "value": "3072:1wd0dcUdC6lQeYabN3RgmkZ/iA8Ca3wmy/tt3tmh1Q5yXVtNN:qIcUdCexYabN3dARa3wFt3tmh1Q5yXVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258360, "uuid": "94a40668-d8a6-4681-bc2a-905ddff3da1e", "value": 151335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258360, "uuid": "9418bc80-9f3f-495b-8a80-07b8c50cbb78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258360, "uuid": "ab490fd7-3c19-46a0-a94b-b8a1081fa9db", "value": "b02390f160bfe419bca89dabe3135bfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71a876c-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257843, "uuid": "1378ccab-5b7f-4693-831b-f2765fcab8d7", "comment": "Malware payload (Mirai)", "value": "9a41bdf3b7e40858ac127c7c0d8f5316", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257843, "uuid": "1c9e1b2c-139d-4da0-97d9-d5e3c14da797", "comment": "Malware payload (Mirai)", "value": "51c4eb15b4a6193fa076f57b7d1a0d6b6e610ba35a1b4b6237e9cffaa8f87403", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257843, "uuid": "df50825c-84fc-4395-9ec6-66e0a57b7014", "comment": "Malware payload (Mirai)", "value": "42557dc86a8b7df7aad03c2488d9c983c40a80a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257843, "uuid": "8c047ab1-5aac-4714-a749-5b08726f3096", "comment": "Malware payload (Mirai)", "value": "c49dedbe2f6bc428331556f6edc98d5bc7d81f3d09f4bf0b61da3028b3d000bfc38372f667d0cc690f130e4b6ae3e9da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257843, "uuid": "d9e66323-472d-4557-913d-ae7ee30f3288", "value": "T1E163D725BF210FF7DC9BCC3749A82B02298C695B21A57B367D30C958B64B35B15E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257843, "uuid": "be410b5a-b862-45ef-8d7e-9ad049db0e76", "value": "1536:kNbz4CrkILQ8DRnroYdlOvKZFQWl60DB:ktz4s99OCA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257843, "uuid": "125415bd-86fc-41f5-9fce-a6728da9c164", "value": 72856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257843, "uuid": "853bd728-6174-4487-9bca-14e5ec1314f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257843, "uuid": "5863c6f7-11c5-40b5-bde4-a71d6cc4f2b2", "value": "9a41bdf3b7e40858ac127c7c0d8f5316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9daed5-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260971, "uuid": "b891e36b-e4a7-4622-8d5b-ab46e404a785", "comment": "Malware payload (Mirai)", "value": "5bf3cb245bf5b6ca47138f8d1a9cdf60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260971, "uuid": "33e955df-1863-4107-9218-3257f5c2abb9", "comment": "Malware payload (Mirai)", "value": "5361b2c007b4d7f3f82a48dab2a621f740eca61494b1597e1f60b03ce0d7ff37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260971, "uuid": "f5d8d75b-6b4b-4173-8b1e-ff6fe79168d2", "comment": "Malware payload (Mirai)", "value": "249efc16ad6f4bdffae4c525801afbfa890a3a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260971, "uuid": "89816360-4021-46f6-93b7-9476a94364c5", "comment": "Malware payload (Mirai)", "value": "d81fbf7de5ae66568bb9b836beff0bc8c0d4802e1e65d21c616a44d6116bbc234acdf48d9aba371a18d8a440a2edf2c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260971, "uuid": "e080b075-60ec-48b7-a962-8b14cc87da35", "value": "T1E2B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260971, "uuid": "80e89213-549d-4cd0-9e58-669d470bb98f", "value": "3072:MDVLSItJP+Xsp4JlN3HtjmH1cuEgvniuN/:MDV+ItJH2l3HtjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260971, "uuid": "5cc3b83f-57bf-4c7e-9684-de9101487f0e", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260971, "uuid": "e67acab9-c988-40ac-af3b-a7f88891100d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260971, "uuid": "fcfb2281-5041-4780-bb5d-4a02cc9ba20d", "value": "5bf3cb245bf5b6ca47138f8d1a9cdf60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58d6614-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682264685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264685, "uuid": "a1d2ff17-920c-4ade-b5d2-f01feb0886dd", "comment": "Malware payload", "value": "dc4dc56913db52065b63dde4720200c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264685, "uuid": "1f8dc693-85e5-410c-a389-36509c688a10", "comment": "Malware payload", "value": "538d4b1b44954385f1897adbd53602beeb83edb6521a39572659c3364148f5b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264685, "uuid": "543c23ad-428e-4d94-948b-ebd8bb4aad96", "comment": "Malware payload", "value": "aaac4c3b1089bfc445b638366ab7231e9d765cb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264685, "uuid": "1039b56d-9cee-4f4e-af21-4dd2aca02043", "comment": "Malware payload", "value": "1579d9d2cd25f151fe63198b017309b6fc527932decad2d6636e11e24ce4d28727420cef1a35666bef2cc3ec45bceab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264685, "uuid": "2b736686-3f80-4314-818c-8382dc4476b5", "value": "T1A6B319825610D573E1033BF802AFE6220072FDFE1A57C566E3897DFC86364963791B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264685, "uuid": "76a9f029-52bd-4cf4-bdbb-31f904462267", "value": "3072:QCPlimDNQqFlc8zCX6xnNT/4hJFxA1t+Z0Ua3hgp6W:FDNQqFl7NDb4hvxst+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264685, "uuid": "34e0a297-de52-4bbd-a48b-7e3f6a334731", "value": 116498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264685, "uuid": "647e5865-c2cc-47f2-b1f2-9c1350064cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264685, "uuid": "b60e06c7-2894-4d08-9f1e-9c9656bba85e", "value": "dc4dc56913db52065b63dde4720200c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b74c794-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264614, "uuid": "9deb8c09-e7a4-4eab-925a-2b21df3cc2c9", "comment": "Malware payload (Mirai)", "value": "72f1f6c48e0ff82fa636d389cec331a4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264614, "uuid": "8b013204-887e-490b-a234-936238460f9e", "comment": "Malware payload (Mirai)", "value": "54088537839f0c3032085de864db261a6fda384d370249fe85df09338723f02b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264614, "uuid": "b85f91ab-0315-44f2-bc0d-9cfea79d49a8", "comment": "Malware payload (Mirai)", "value": "4e11ad4d8e80ef6d322b6ab820f466b30a7c50e3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264614, "uuid": "46dd978b-c95a-496a-9eb1-3d99fef52dcb", "comment": "Malware payload (Mirai)", "value": "c4cb8e3be2bed7331e3698fb2f8f6f704648048b17721ba374ef66bda60d7909954717606ea6baa2c654285595a15630", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264614, "uuid": "8c00ab34-a80d-4ecd-bd50-b6c6336c225d", "value": "T1C4D2E04A45F7E0B1D4B8987224BABAC0FBB46425E21D6B7F48CCF6BF9D972480624700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264614, "uuid": "94d51c0d-4072-45c9-b5e0-50a547710fdb", "value": "768:CYSoXdJZUtqz0hVGTa/V7t4zY/R04O/oqpDSx0s3:CYJdJZmY03GU504Kwt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264614, "uuid": "b3fcf585-bed3-403a-acec-76881d59391b", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264614, "uuid": "7d746418-27da-4626-97fa-2a53c1c2520f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264614, "uuid": "b8ba3523-4766-4ff8-b9bc-8fe4585954ab", "value": "72f1f6c48e0ff82fa636d389cec331a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3579693a-e1c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682248123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248123, "uuid": "c05d52ea-f93b-47d0-ba5b-a7827d22f76a", "comment": "Malware payload", "value": "b730b050c8e9626f6e92d1a601a5f5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248123, "uuid": "1e9ea2c0-f5d8-4667-b75d-1dbe1941f044", "comment": "Malware payload", "value": "54eb093d11058570c7e0cbc19ccc41338b1be990ce7bf3a26566e7a5f8b24074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248123, "uuid": "0d816fe4-410c-4f06-961c-0baa8a79f69a", "comment": "Malware payload", "value": "b98a01c89be1bfabd52681d10904aab89c7b50aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248123, "uuid": "2fad7d4b-305e-4cfa-a3e8-7ef3a06f9756", "comment": "Malware payload", "value": "06d36ec15d2fb7772d52962b4cc424f815604b068df2741389a38a77aa4030ae0978952d88bd111f3af366215807143f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248123, "uuid": "bd7980da-46fd-4ae1-b186-b86e04c94096", "value": "T1505612927AA1EBA3F611447474E27F01B430AF6A160E075F16647CEA8A34F72D54FE2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248123, "uuid": "a19f4d4a-0962-420e-966c-a641ef6e24d3", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248123, "uuid": "a9bef2c5-2cc7-4867-8ade-9c6917990bad", "value": "98304:FylQKUFr11GIgE2vaWx6xnnX2GvE9WuvErn0RPy+3N0gXzVCh6esbqJYKfMW:4lnKBCE2voxmG89WGErn6y+3Aoe5CKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682248123, "uuid": "19326c9d-2564-4ace-803f-d119e026b7f5", "value": 5943808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682248123, "uuid": "9ff6a286-32b9-4ed3-9fe0-19605bf339d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248123, "uuid": "9e805789-9ab8-4f85-8d3e-8e31a62e0385", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8669a6-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260944, "uuid": "3c4f0171-f8f4-4ca3-919c-54f2528381ad", "comment": "Malware payload (Mirai)", "value": "279aedb1b15f74331ea0c7d13f3ac834", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260944, "uuid": "73babd33-a7c0-4412-9ad2-7a2f09982c0e", "comment": "Malware payload (Mirai)", "value": "55261daa02037f571941683e77145d7ad7eb8b1388e240460110a39c7f33d51f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260944, "uuid": "3ac05e83-c1fa-46c5-a0df-889831c40e7d", "comment": "Malware payload (Mirai)", "value": "f01078b1b876514068b1fa0f0f6efc31ba442315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260944, "uuid": "df0cf8cd-fe07-45a8-a305-65505c3cb4e9", "comment": "Malware payload (Mirai)", "value": "5433cebf10637484efa8d6f9a1a8197f4cca3958b1de72fdf1b32336bcbdbf39895560e4c3535ec1af351f803dfc03f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260944, "uuid": "79ab3bb1-78f1-47f4-8437-1c4f6136f85e", "value": "T1EB63AE73C01A5A84C289417469A08DB11F53B504816B7EF79AD6CBEA9047EFCFB187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260944, "uuid": "4b9ea378-665f-48f4-a1a1-7cd1b7588516", "value": "1536:JaLrd3bRPBf84hSHLi7GNxKA/SUW2Nr8CPwn0U:JgDS27AYABFNr8dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260944, "uuid": "bea96d58-1fbd-49c5-af40-63d58e17199c", "value": 70928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260944, "uuid": "9dcd6ad0-395f-43b1-b90c-a0e209cf78b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260944, "uuid": "2bcbe883-4791-46fc-9807-a526f12fafef", "value": "279aedb1b15f74331ea0c7d13f3ac834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195594f3-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260960, "uuid": "c8ec1425-5e5f-4d29-9484-b8bd9a7aa391", "comment": "Malware payload (Mirai)", "value": "aef9e98ff8c4227ebf7c0e21aa77b122", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260960, "uuid": "e4f26737-dfec-4c90-a297-9a9220d91cf4", "comment": "Malware payload (Mirai)", "value": "58451d8de018d0bfb01713d45bdc4b1a21cab3129fa515e4c177435bc015dc05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260960, "uuid": "8aba63fe-069c-4d26-aad1-19a1db39ede4", "comment": "Malware payload (Mirai)", "value": "ee039c5906de2460e178d8e1d8546cf2528bad15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260960, "uuid": "60c36669-57dd-4491-9e33-825ac065dd04", "comment": "Malware payload (Mirai)", "value": "ad4ca03e9e5f31e8d7fb3d1558e95b8332be003180810af59113d9114e6a3be15652baa388a5d2cd92c53217f0e77dad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260960, "uuid": "1a96bce4-3e10-404d-aefd-5a8ce0a9b2e0", "value": "T1E3C2F2F2329F9862E27C5CB5D67D84C33D935079B3FDB5A10E0A97C625D841222B52A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260960, "uuid": "fbf424ea-7111-416a-980c-63ee94ab67cd", "value": "768:oVicbEyLxMqhaPS/B8gOmI4ow/LWis3Uoz+:Dc42/B7JI4nL2z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260960, "uuid": "00c109e8-21f6-4e16-a1aa-9c55aaba458a", "value": 27212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260960, "uuid": "4fe12379-6942-4941-9ca9-c24f23ef3d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260960, "uuid": "748a635e-f4fa-42d2-8dec-9c5c030ed080", "value": "aef9e98ff8c4227ebf7c0e21aa77b122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ea2e85-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257814, "uuid": "c7cb0402-9ec3-494a-8509-e61de16a842e", "comment": "Malware payload (Mirai)", "value": "7ae05dde1121a6f6e5c79ca2117bdc04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257814, "uuid": "0c33e72f-c548-446c-a926-ed899d07883b", "comment": "Malware payload (Mirai)", "value": "5a7107280181788d6d808a67c7e298e7d1e7000cb13893b740c67dc77a295a33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257814, "uuid": "81fe9c51-ff0b-4a6e-844d-e032e2bfbf28", "comment": "Malware payload (Mirai)", "value": "5c020caafa5c1bbfc4647e5886d911f715689ece", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257814, "uuid": "933e34ac-40c4-4e9f-8656-5a1f6c3aef6c", "comment": "Malware payload (Mirai)", "value": "7b891a14c98f664f2490db96ed4e8763ce6a097c75bf9d412a2787379293a6b9f40b057b055d547eb9b491573a160c96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257814, "uuid": "6eba2f49-3fa4-423d-bafc-51bd8fd4a445", "value": "T12EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257814, "uuid": "8643432d-3d7d-4c33-a23e-ce05bbdeae60", "value": "1536:Cu27gBY9FSSpj3z5Qxw6YaWWgg1h/LWy:T9sSyzz36YaWWgg1hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257814, "uuid": "8cd1b88c-6a39-4969-b561-ade41d46a0f6", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257814, "uuid": "3be133b8-f23c-4c16-8a95-88756cf7fb40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257814, "uuid": "30dd6a1f-639a-4189-8b00-b446eaabb78a", "value": "7ae05dde1121a6f6e5c79ca2117bdc04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a5c6e1-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682253436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253436, "uuid": "76d11d04-de71-4882-ae68-33d8bfb466a6", "comment": "Malware payload (AgentTesla)", "value": "abd57b97142ba1d2123c414350cf11c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253436, "uuid": "c9475360-5a21-4469-a2b8-16115f724bc9", "comment": "Malware payload (AgentTesla)", "value": "5ba447a7105335691cb30402caf16ecc6237617a3880ad9c060782ae2a07ddeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253436, "uuid": "b59639c5-0f32-459b-8dbd-d522f71be38e", "comment": "Malware payload (AgentTesla)", "value": "ca1730c82a83dfd00dbf3048cca921616d2117a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253436, "uuid": "f2adb805-cca4-455a-950c-65857ffb2ed6", "comment": "Malware payload (AgentTesla)", "value": "a1f9011316ab631c8ec9bc35a8c5626a23c3f943a10fffa6c08176c2bb16c8c32147282f365b69a7065a0235af101643", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253436, "uuid": "915c07f1-3542-4349-80d4-78f3fcd26fe6", "value": "T148059CAB6BBBFF51C1743CB9135112209EF04E96ED2AE1A4FEE8304529137D4DA24787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253436, "uuid": "8ad7e338-38a7-454a-9fd8-194064b4629b", "value": "24576:jpI6DHMd1DtOIIQ70Vi87765OHPcyUP3xeZ:jJMd1xl/877k4IP3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253436, "uuid": "0ba24100-8745-4f76-afa4-bbad287c240c", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253436, "uuid": "14086b70-cbd1-4ef9-8382-0db29dbf997a", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253436, "uuid": "740902da-97c4-491f-b3e2-e4507d522fc5", "value": "SHIPMENT-INVOICES.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a313df67-e174-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682212658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212658, "uuid": "738e1e1f-794a-4dd7-b57c-b086e9cf745c", "comment": "Malware payload (Amadey)", "value": "e4ecfd3b612a5e27403069a2d5d6c6c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212658, "uuid": "5c17ebf1-52a3-4347-8f3b-f96ceffc1925", "comment": "Malware payload (Amadey)", "value": "5e5cfffc1cbefb7bc0439640a28eb44fabed540e073b48fa9c642b881b684040", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212658, "uuid": "2e3bd4e2-b969-48eb-b471-7c0e86f89250", "comment": "Malware payload (Amadey)", "value": "8107a6cbd39521f352211caa807179defe71bbc1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212658, "uuid": "f9010532-53ba-49d3-a650-011c7b6aba01", "comment": "Malware payload (Amadey)", "value": "e223dcd8386c63cbd231240a10fe5c55ddf9555dedf40758e8d1394c4773fafe71e1443a09ac8a11f09865036e6844a9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212658, "uuid": "8f649b31-0d14-4889-8859-6eee1258b890", "value": "T15A34D02176F1C0B2D8AB49B45434C7A0AE7BBC629B6185CB33682E6F3E307D157B5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212658, "uuid": "412ebee2-dccc-4621-81dd-bbfd945af8bf", "value": "c36577d8970592a39f985677fb550958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212658, "uuid": "a4a44d3a-b39c-48e0-8da4-ac12beff7d6e", "value": "3072:dB/h2A+F/97unIua7TvunO1DyLwwuZP5VyF:dTkkIyOgLwRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212658, "uuid": "ed279fec-2f0d-4c45-a355-e86e24942861", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212658, "uuid": "9256b1f6-70da-4543-9bb1-76613c26f9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212658, "uuid": "d9ca31be-85e8-499e-b7c1-a2ec04c17350", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e22109d-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682253425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253425, "uuid": "1f6d6106-5498-4071-8a55-e0a2909dfd54", "comment": "Malware payload (Formbook)", "value": "167df31ea8fa07910010f39c71a60041", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253425, "uuid": "6dd23061-7fe0-407d-8d1f-862cddf21dbb", "comment": "Malware payload (Formbook)", "value": "5f82e6f7aebe1ea40e05eab8ebf34e68c39b1f7bcd0516e19ed5a2c56f14ac1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253425, "uuid": "60d0a7f1-6793-4c26-9130-68031380fc8a", "comment": "Malware payload (Formbook)", "value": "22a39ca810da33fc3cb591afed75fe4b8bc079dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253425, "uuid": "3a80f2a3-1e0a-464c-a517-599d009e5732", "comment": "Malware payload (Formbook)", "value": "37a7be7ba777c7a8f63efe54990a22d12c3886db72fb433041e8a08de1e0b08e00e49cb1cf74f8f1268f003c5433e2a3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253425, "uuid": "fe09b791-ac07-4be5-9a07-1f73dca20333", "value": "T154D42343365CDE6183F9A96E910BE33AF4D7874446BB93770560399BACD2E08D5C8CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253425, "uuid": "a6d77088-3655-442a-9014-87f8e5ba975d", "value": "12288:w0Mz6PzL4ghIUy6BvA2bx2K3dkYnnJahh49HXrVTP7sTOd4ghH5UQ:w0M2bVjy6p1bx2KtnJahWZ7sK1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253425, "uuid": "af22b144-c3e5-4216-978c-e6afc0fe02a3", "value": 607394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253425, "uuid": "79c53641-80fb-476f-82ff-2b2700646d27", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253425, "uuid": "cf5df0ad-59a5-46bd-a9d4-5843b4d04020", "value": "PO 042023BCX1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96237443-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682253439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253439, "uuid": "0f525aaa-1690-4685-9eb0-e1556c83cf4a", "comment": "Malware payload (AgentTesla)", "value": "ebbe3618a32396b9d75a3c8bb5b90581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253439, "uuid": "2572a7fa-cc9f-43c2-8938-7bcfa644a4f6", "comment": "Malware payload (AgentTesla)", "value": "5f88533d17311bc4c03da1ed8da423a5c4ae8e81320acf9e9958ffa206d232ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253439, "uuid": "48ba3f99-ed1c-4da0-b15d-e3cbec39bf3d", "comment": "Malware payload (AgentTesla)", "value": "e638c59eb46ef0d0d3ff3683bbe429642e719fc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253439, "uuid": "e5d2ae03-ef49-4812-88da-161b74c8d73e", "comment": "Malware payload (AgentTesla)", "value": "b320dd21daec9e42e9c5250da749c625476d1cc26801e7c24b033e374f8e933cec2501d5bb4f4d51da55ebf9a610f77a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253439, "uuid": "64a254b0-43d9-4289-af4a-484b8ded48df", "value": "T16554230DC3F54FF9A084BDA727C0ACAD7EFA6D15871800D1584E6CAE969BBA05580E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253439, "uuid": "03f57c8a-f534-42b7-908c-46f3ccb7b129", "value": "6144:G14WaCm3Fr6FYWGzURlaBLebZtDIIiPmUzn78BCeUi8Kl:BWsZIYB4RYBL8ZtD5iPPzoCvix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253439, "uuid": "cc95beec-c3b2-4173-b0f4-7b8d5867259c", "value": 299046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253439, "uuid": "e67f3c05-98fc-4604-b48a-19eb7c2ec538", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253439, "uuid": "2e394424-7697-4ad7-ad7d-7b81614dfb0c", "value": "SOA 2112352 I_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d169864-e1cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682250712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250712, "uuid": "5b65a78d-1fa6-44fb-8201-0a0d3a5ad4e2", "comment": "Malware payload", "value": "057c27ecf07560cbf002916f5e97710f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250712, "uuid": "e2600727-f137-4467-803c-7e60d82d61ef", "comment": "Malware payload", "value": "5fb99869ee44ab33e1aad8b548c6defc0c22c3fd34686c4a61b3ca5a743a1703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250712, "uuid": "3b9837ec-2dd2-4568-95ea-2f060c435b20", "comment": "Malware payload", "value": "be27d5c8f0aaf8246d713ec6894a2730f4a72634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250712, "uuid": "5d44270a-9928-4256-8268-772d797e9821", "comment": "Malware payload", "value": "def1abc5eb5fdf6f995e06eca750c1ff6400c4749855fba1ce41923b17a08c4f3fee905638774ebf0d389f868e48e413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250712, "uuid": "6f70317f-24a8-4932-9d87-36bff34389eb", "value": "T114655B343DEA502AF1B3EF768AE475D6EA6FB7633B03682D105103864713A81DED153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250712, "uuid": "39b3b31a-a5df-4f95-b980-d53d780b7d12", "value": "12288:kkowyx1lRDS5ay92o3etRsFJHURCdWaTaAd++U6CQsKQ8A3Y2ZKQ7bYBSZMkG57X:IWar8UPKG0BKnkcdhu2KvjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682250712, "uuid": "b38f5ebd-107b-4047-8466-7b261ed6a99b", "value": 1449336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682250712, "uuid": "d1612aee-c74a-4862-af69-2ff2d43e4234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250712, "uuid": "2740f5f7-f106-4ca9-9955-43a5d2bf9a5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe7808d-e1b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682240724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240724, "uuid": "0e6f2a46-368b-407c-bbd2-ce42cf409223", "comment": "Malware payload (RedLineStealer)", "value": "e482a25698ad24d28ea5ad2323e92e0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240724, "uuid": "ca4e3974-e39c-4662-aec9-530db66436d7", "comment": "Malware payload (RedLineStealer)", "value": "605be733ff8696050c7b291b9644ecdd7bba8bbb4f5fdf453be37a7bc766cf6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240724, "uuid": "c68067ba-7ed2-4633-bf4b-16d8e8f759e8", "comment": "Malware payload (RedLineStealer)", "value": "feb7811f6e564d6a74c46d31ab78b6212c789329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682240724, "uuid": "4501a293-c8b8-423f-9362-8ce742783591", "comment": "Malware payload (RedLineStealer)", "value": "18658636f6d77017d651d786733b889716394728e90d1b89e14ab199394536b3964f1d5b355545fc14a3bb6102de9313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240724, "uuid": "b6980f66-cbb8-45f6-8d81-0e0fef358f43", "value": "T19AE412029BD98172ECB507B054FE06C70A37BDB26F28839B33566A9A58724D0DA75337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240724, "uuid": "e70a2f43-2024-4801-97b1-ba8bec1c9d7f", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240724, "uuid": "425db131-ad22-414b-9d6d-51fdfe671779", "value": "12288:Wy907jkx02cyMmatGJquHYDp5e9D2Uq26s/xPfSF9miUZaDbIiZtmvrEo0st:WyYox7c2aMJ6XgqUQs5fy9mioan+rEZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682240724, "uuid": "d14a4f51-ddb5-4c82-a380-edd36d4cdb68", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682240724, "uuid": "d6090009-081b-4076-9b60-3fe17c1fa5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682240724, "uuid": "3c03ade9-7e59-4f97-8028-51816895fe1a", "value": "e482a25698ad24d28ea5ad2323e92e0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab64a65e-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266359, "uuid": "685af1b8-077a-4d21-9549-620b628c1e88", "comment": "Malware payload (Mirai)", "value": "567caab5a5bec21443a2ac1e112f5172", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266359, "uuid": "94e22072-df42-4ef3-a5f0-89e4d3f8e900", "comment": "Malware payload (Mirai)", "value": "643dae0429351483866d7c9040bcad5dd92f04748eced2d560caca83173fdb93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266359, "uuid": "99fa61dd-96c8-4674-b747-55f7746280fc", "comment": "Malware payload (Mirai)", "value": "6f1e656e6707882a23c9ff62b433137341b513b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266359, "uuid": "198c999d-36bc-44b7-8b27-88a6fd524d6a", "comment": "Malware payload (Mirai)", "value": "4b5a6eebd9df9a13fb61e1a9440e4700eb818edec3b2a787aabeb28c532fb985b713e2e09056a94a2745c4daba5bdff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266359, "uuid": "578a42d3-0f74-4ecb-9893-7a6ec1e33f4e", "value": "T15BA34BD7FC00EEBDF84ADA7641570A0AB130A3A10E921A33B2536C67FD751D45A37E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266359, "uuid": "dde08e2c-8a31-48e1-8ff3-8dbe84f204b1", "value": "3072:7iYlNff1SSna4dlNGeR+IM6D2ybGO8bhB6J34f:7931ta4dGeRrQybCbqJ34f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266359, "uuid": "e37fffc5-7a6b-470e-a9eb-aa4558506ae3", "value": 106632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266359, "uuid": "635df743-2009-4a49-b990-d0d0ff45e3b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266359, "uuid": "d987a8a5-0295-4414-9548-2805f033d232", "value": "567caab5a5bec21443a2ac1e112f5172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c042bfee-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261670, "uuid": "d2202309-c736-4116-9032-888afe705f09", "comment": "Malware payload (Mirai)", "value": "c98eed5e309af8b90110471ed5bc6503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261670, "uuid": "5f5a2ebe-89de-433d-893d-f9b70d20523e", "comment": "Malware payload (Mirai)", "value": "64a12fd8f4102e70dfce74272494c2d3933e6b6f79d87b737778731ee02247b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261670, "uuid": "a088169a-6b03-40a6-b11f-c2c396b12b3e", "comment": "Malware payload (Mirai)", "value": "11bb0113699e2c1557970067f07f3cfc0f3d81e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261670, "uuid": "44d96795-097f-4f46-aea2-7515f14fdb0a", "comment": "Malware payload (Mirai)", "value": "f8bd20350818163f0f94ae0d08c9e291846db173b1c5adcb526b70925edd729af1044446aef8d49017433c87ae4b530f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261670, "uuid": "7a46dec3-0c7c-480b-bcd7-8e88fcfcd684", "value": "T137E2F2510342B53082F4277878A04FD437952FFDE4B5A8B3151A196FBB560276BBC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261670, "uuid": "888a979f-996d-4887-bd1f-2700285e87e8", "value": "384:V3Zt18j6gKyzp4IDvIf+s2x+KCsD7b79XtPrc6roAbl7++dc+JFHpd/3IePIDhtk:F1Mi2ss7bDJ26roV2dFz6Ntw9q3UELA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261670, "uuid": "e4627096-2758-4a4f-b40f-8c5f6163b78e", "value": 32164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261670, "uuid": "70608532-d0e8-49ff-a44a-47efc59f3c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261670, "uuid": "b294ecaa-ba22-4f52-8a96-cbb9b326df64", "value": "c98eed5e309af8b90110471ed5bc6503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91f3cf2-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263832, "uuid": "0d55633f-b891-4872-a067-a794aa1f595c", "comment": "Malware payload (RedLineStealer)", "value": "baf21529603c01e900cee5ae3dd3ebc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263832, "uuid": "b85b0077-1189-40c3-9814-b0dd476318fc", "comment": "Malware payload (RedLineStealer)", "value": "657bd8865db52c1fc6209c1bdc61986f24081aee6d30d3d36396603ab856afb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263832, "uuid": "442e8245-8058-4a6a-944b-232c79cc0d36", "comment": "Malware payload (RedLineStealer)", "value": "6bd2f89ea18585d5a8d394b741a68bd9a69e659f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263832, "uuid": "a8d5e289-7242-4a46-8304-e7a5ca180c62", "comment": "Malware payload (RedLineStealer)", "value": "00636f35b3c6df82bbee7594d10f403208cc56b260f495015656f8c6d7d65f62103ef7b470ca5551ba808d74760ebadb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263832, "uuid": "b90420d0-e742-4ce5-a486-df8d3a6edc0f", "value": "T158C40212E6E94032D9A52FB048FB15D30F36BDE15B7982EB23849DDE0C721C4A5763A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263832, "uuid": "49067bf3-231c-485b-acd4-da8423301565", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263832, "uuid": "de169ded-4dcd-4c18-80b3-1425ba834d7a", "value": "12288:ay90LvvRgYszTkvmI6X4I2ajLyuDMSzbZIBDFl97mGCHP:ay2gc64I2a3yw8RXiGCHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263832, "uuid": "a33d9eee-4ea3-4e4c-bce0-f0e59cc89380", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263832, "uuid": "8a5061c5-5acf-4742-9152-1c08a8e0241e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263832, "uuid": "2306f0cc-656d-484d-bbba-78cf53f3e75b", "value": "baf21529603c01e900cee5ae3dd3ebc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7eec33-e174-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682212565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212565, "uuid": "9379fceb-2677-4cb7-bc4b-28f1a549fb61", "comment": "Malware payload (Amadey)", "value": "3a258d8358702c115a7345afc5a965d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212565, "uuid": "4dddfeaf-57bd-4d04-adf7-b5772efb1a5a", "comment": "Malware payload (Amadey)", "value": "6590488e1a02adebed0077d36c264389f841329689ee1e8bb18a91f4de075d67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212565, "uuid": "88451538-e521-4a18-a119-1dac750a1bd9", "comment": "Malware payload (Amadey)", "value": "0cbdead1d17aa2bd6bf5f3fb2dd3539c0c30af38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212565, "uuid": "f87cbcf9-0719-4486-8708-2808ab2a0934", "comment": "Malware payload (Amadey)", "value": "ac7a2ad2a3a5be90eb8b21e046589a55296e0073b0e434d44d2e46e845e96407727968efe224a7658b454513ae64844b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212565, "uuid": "5a142296-0274-4ff8-a313-eccc5547d4b7", "value": "T16734D0107AA0D472D9AB0AB5C830D6E4AE3FBCE15395C64B37192B9F2DF02C15A63357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212565, "uuid": "4a286e23-229b-41f0-808e-5bf1a9b69ee8", "value": "87fea0e8950277ceefd6f396dab02ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212565, "uuid": "166a3afb-81e9-4573-ae50-164e29bc7f5f", "value": "3072:IuSvv4dbBWQ8udCHAyqA3pyFwoksP4y/2iaprODB1uQeK5XZ6/Hi:IXvvJQ805A52iw4y/rsrGBYQVZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212565, "uuid": "f79b97ff-c628-4d7d-8f4b-7172b2e4746b", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212565, "uuid": "6e2933b0-3c39-4362-8172-66765cc7649b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212565, "uuid": "94827870-511e-49ec-ad3d-b320a0e87bd0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96abcdd5-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266324, "uuid": "40774445-c12f-4bff-ba0d-e5f0c0935cfa", "comment": "Malware payload (Mirai)", "value": "3ca91f5a06f3c1bcb3f354fecebcedc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266324, "uuid": "add75165-9113-48a0-9138-af41a5ed8bc0", "comment": "Malware payload (Mirai)", "value": "68c4e50742e1c7cf26adc7ba21ef7457ac02c7bb840a9eaa693e2b67e086148d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266324, "uuid": "486bafbe-e931-459f-a1d3-6db3f96cbdd1", "comment": "Malware payload (Mirai)", "value": "60d9c2abfb0e13b2754de77ad0c8ac728385ac61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266324, "uuid": "c594e71d-51d9-4933-8cf8-1c63785af5cb", "comment": "Malware payload (Mirai)", "value": "59b8f34023dee898ed6de629355d1342aad0990d4e5d3bef32f0a8718fae752642a8fc696db0221cf914b91d756a0c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266324, "uuid": "30609c5d-8ed7-4cbd-9f0d-5c2a73516611", "value": "T1CF23E13CC61278B8C77410B5EE58A25C259D4F3CB56DA70B2359A6C67EC39B638F4423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266324, "uuid": "40769942-9d9f-48d9-90f8-4fcdf531a8e5", "value": "768:B4Ko8N8VXGN07Mdn0FPJ0ylDlODA/mB6AgLeEZWn3xa+zJNbXcu6eHvtTyC8D9qK:BWvWSY0RGSDlOk/2tkeWG37JNYPEvtm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266324, "uuid": "9d0f4826-0613-497c-80ac-482b88d8fcbe", "value": 48404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266324, "uuid": "83100ddc-72b4-4b64-99d6-e9d390719ba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266324, "uuid": "33b429db-2f3c-4b7a-a475-d09e2b47f453", "value": "3ca91f5a06f3c1bcb3f354fecebcedc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a824432c-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266354, "uuid": "44f75062-51d1-438a-bc83-28f98779b134", "comment": "Malware payload (Mirai)", "value": "c865ac50be2ec5860e4dea2742269d7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266354, "uuid": "166fc540-53c0-40dd-96ea-7d1859b01550", "comment": "Malware payload (Mirai)", "value": "696c5feb5aaffbe619749cdb9f058156af60c532883b6ad6753114f4116429e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266354, "uuid": "b5401321-0cb4-42cb-9ec8-d5d6ad238f4e", "comment": "Malware payload (Mirai)", "value": "098011236fc4aec9a5c4c7388e2c6868a4502b4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266354, "uuid": "81c5a4d6-6831-4543-a6ce-7a39f93f5f79", "comment": "Malware payload (Mirai)", "value": "1063b37c2293d8ff8c224577d2a61300ce1ecba0f6d8c78a2e13385dbc095bedf0cd8699f8cba5ccf27bbadffc9fafb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266354, "uuid": "1fe5ddbf-869f-428e-b957-eb9bf267c693", "value": "T1A6332B662409B0F8E8A44075F40B29D616D34A3D38EEF2D7F8678522FF9570D6937D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266354, "uuid": "cc8bc608-ff25-44f5-b426-087fda04cec3", "value": "768:2OIDxZnt/kdSwOIBHm4hj5cOgdf7Gd65jicOTPS0i1Tt9R5h7v4:2OI1r/k8kjhgdja699PR5hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266354, "uuid": "c6c7b0aa-f8df-4658-899c-c4914e2937e1", "value": 50828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266354, "uuid": "ce32ab86-5c4e-47b3-bd18-1ae8b2740da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266354, "uuid": "f0b672bb-c0c9-4c15-86dc-05cf0af2e62a", "value": "c865ac50be2ec5860e4dea2742269d7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f204043-e1d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682254313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254313, "uuid": "1b88923a-91b8-4856-a3f0-60c1702f310c", "comment": "Malware payload (Mirai)", "value": "5cb93fc536cf2d91d3efa717b83099f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254313, "uuid": "528f2613-6614-451a-bce7-482f0d5b28d6", "comment": "Malware payload (Mirai)", "value": "6991f321a871c5f03f6b4bbfb6c7f59ebb6b70316bb852de2746bd11d586905c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254313, "uuid": "19ae9918-711a-4c8e-95c0-9921991e48af", "comment": "Malware payload (Mirai)", "value": "9689b3335d0a6fc8559d04dc830eb7d020c99c26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254313, "uuid": "b8d94212-e709-4ef9-8452-a6a2cda2fec7", "comment": "Malware payload (Mirai)", "value": "d5ac534174874acc8d4c287550c3469d29f7063ee22cc93038b1dc6562f26cf876f4486136f9afec56d0862a5cef1c58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254313, "uuid": "30b0dd54-84dd-452a-acdf-a5a8deec0f5b", "value": "T150B2F1C1CEFB5BD7D355C33290BC886E82B52A960BC58203A641734BA7D87060F76AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254313, "uuid": "a903a6b3-a39a-45a2-af0d-9f5b76c3d501", "value": "384:M8DKKQOcRpmYLdn6RBOFRFt5rUF110iSelCo3AnupAnEpM6ADjOTcn9v1RcT:R/QOC0Yhn6ROHWFbrcwNmEG7O4pcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682254313, "uuid": "b4355522-9b3c-408f-b371-fbda8a72a452", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682254313, "uuid": "1df48a65-8864-49eb-9097-bad3feb1c2bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254313, "uuid": "b6026281-9ca8-4f19-9ad4-d1683a39b79c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b8240c-e1d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682254943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254943, "uuid": "071fbd19-97cc-4b5a-b3f7-6ae3e83401e7", "comment": "Malware payload (Mirai)", "value": "88577b9b775c6332c862bb5bc774c3c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254943, "uuid": "a3cc74b4-2d76-4639-b86e-7c4d1c023f80", "comment": "Malware payload (Mirai)", "value": "6aba32f10ca3ef04577da02747be7a9bfc29a9fa26a438df1cb5e298699f0a1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254943, "uuid": "54c02c8f-0c94-44dd-ac0c-51811777d6ae", "comment": "Malware payload (Mirai)", "value": "a7a85c04c813f1f991640ccc436a6e0d0cc45354", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254943, "uuid": "7bb54860-e1d9-4b59-a881-f3877d711384", "comment": "Malware payload (Mirai)", "value": "384a0523e9f5b7d4ebd6233305130518008a37a1f69b228d656aaca71023a0dd469488884dc5bf0187fb0f87b3bfd41e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254943, "uuid": "156bf047-1246-406d-a979-1895020ecaa7", "value": "T12AC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254943, "uuid": "593bd94d-c392-4dc2-93a8-5577746f7758", "value": "3072:cowpuQyNSG2/Ra1styK9flTQPHoErScVM/9OAvjik:cowpuQyNSG2Za1styKdlTuIErSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682254943, "uuid": "81eb0755-f1ac-45de-88f2-dd527fd5e2bd", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682254943, "uuid": "19bfcc3e-2380-4365-ae7d-765d8970de58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254943, "uuid": "a1aa787f-d57b-4699-929b-4e832133d117", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c04b991-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260965, "uuid": "2646cc37-94bf-4940-a3ea-c7680bd1f9ff", "comment": "Malware payload (Mirai)", "value": "af4ea7ea04bdc894c20e5f6c988d991f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260965, "uuid": "0d4a5c5f-d81e-40d9-8a0e-b89393e75c2d", "comment": "Malware payload (Mirai)", "value": "6b2b7277243a01ecbcaab63c7dd4ab2e97cec1f37e4096cf842a3e9324c898a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260965, "uuid": "c1cc1382-076a-4c7f-b0a9-add62860d2f9", "comment": "Malware payload (Mirai)", "value": "b979d95e3047029f43c6728852941d235e580599", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260965, "uuid": "a22b927a-d2d1-46a4-83bb-1aeb44198582", "comment": "Malware payload (Mirai)", "value": "02c42ed1fbb20bed7f9021099b6e772f03e397df69dbca9fffd9670f3424fd338c83b8d255c19bb41f69a9c8e368e64e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260965, "uuid": "dea2a042-97fa-475b-b130-529370632cb5", "value": "T181832A45BD815A12C6D522BBF62E028C332653F8D2EF721BCD219F11778A92F0E77661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260965, "uuid": "a3d66aa8-d36f-40f0-aae7-504ef75f5e96", "value": "1536:YI7RUiAd+ZYqbvnjfI3I2P423p9rk1mOaYeozXH8iRBDfgXjG5va:YI7RUiAd+ZvvnjfiIaR3HreSn0XH8in+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260965, "uuid": "c42f2385-c9f3-4df3-ab92-6939e51be442", "value": 83088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260965, "uuid": "e8db47e7-a380-40a1-8347-b6a84e47bec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260965, "uuid": "55dbcaf4-a1c6-4785-a7df-e0993357d611", "value": "af4ea7ea04bdc894c20e5f6c988d991f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb459bf-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260912, "uuid": "22878578-f653-4975-b0af-c43976693e66", "comment": "Malware payload (Mirai)", "value": "5bd8d3a40b794aa22213319ad8f035f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260912, "uuid": "0c1e77d4-793d-4899-be64-33a2a87dbf0b", "comment": "Malware payload (Mirai)", "value": "6e4d480e0691c4041c0b7d292e8b58c4bf102624797756a49ef41961aabf1d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260912, "uuid": "64fbea07-16b9-4823-ba31-59c52cfb5173", "comment": "Malware payload (Mirai)", "value": "04d76ce4e89e5120afaa04cfb757fb1d9e1d8f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260912, "uuid": "ab284a96-b82f-46bd-9d9f-ffdd9088555e", "comment": "Malware payload (Mirai)", "value": "08355ca88fac9fd1ea8c6bd309427e6aed058369c09ea11bd384ae87721081151e12a621c87f9f8f0d7a0cb9e03583b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260912, "uuid": "e687d24f-db10-41ba-9629-ee637dd39250", "value": "T14BC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260912, "uuid": "39ad136f-0eef-4b62-86dd-07ec07a001a5", "value": "3072:4jDy/+mh1vtbPIKaTbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaTbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260912, "uuid": "0c7b141c-74a9-4a4f-aabe-ba1d79c78a15", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260912, "uuid": "694a672f-7bcd-4eb7-aa46-333456101701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260912, "uuid": "417c4fcd-285a-4850-b223-eb6c0a68ef56", "value": "5bd8d3a40b794aa22213319ad8f035f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0e1fd2-e22a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682290811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682290811, "uuid": "5da155fb-06f8-44e1-80e9-4ee841f39ca6", "comment": "Malware payload (RedLineStealer)", "value": "29a871c32818efacc4da0e5c726ca0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682290811, "uuid": "66128914-1c5a-4531-b26f-cad7380c1e5c", "comment": "Malware payload (RedLineStealer)", "value": "6f83d407d92e23b1cc44eddf3127a2b367befb9ea845a20bde25cd62550f0524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682290811, "uuid": "0a3abee1-c1bd-4a04-914e-fc9b5bc4ced0", "comment": "Malware payload (RedLineStealer)", "value": "9f5bedc69ee862e5fe9b2c712fb72594e54df89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682290811, "uuid": "6403086a-9992-452b-b4e3-1a22b921325c", "comment": "Malware payload (RedLineStealer)", "value": "ab3c3554c2cf72766c04083259d19f9cec06d2b9bd2bf6e4401f3f56154c98ddd7ee1eadda050f191c83678db10b23c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682290811, "uuid": "78372a56-64cd-436b-a885-9964aaf324e4", "value": "T1DAA35D2127EC9F19EAFD1A756472122047F1F0C6D092EB5E8DC0A4EA1F6BBC14916EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682290811, "uuid": "f6f33e4d-b773-4593-9473-31d134ca7983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682290811, "uuid": "bd882090-0927-429f-aa9e-52f4e36686cf", "value": "1536:1KxECZ9KG6jejoigICLfiblFuF9C/K4Zmbfqxv0ujXyyedurtTh4MK5c:o9SYaf2lY9N4Uc0ujyzdPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682290811, "uuid": "da17a55d-43e6-40c5-b001-1c1c2e0dfe76", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682290811, "uuid": "71d832c8-ea6d-4f41-b0d5-e8c0ce39d0ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682290811, "uuid": "1a718818-1775-413c-9527-2a2dc9b32c40", "value": "29a871c32818efacc4da0e5c726ca0e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c339110c-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232469, "uuid": "562df9bd-7f68-4087-9153-1f14db7e9be7", "comment": "Malware payload (Mirai)", "value": "2a99de328bf754578602be88a1423248", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232469, "uuid": "e7f09ba6-a8f6-4924-836e-39ff31630abb", "comment": "Malware payload (Mirai)", "value": "7246ae65d8144822591c77df633a4f3c50348dd8cfa86d486e2571733f0b7372", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232469, "uuid": "1a8e1392-db26-4632-8802-f4abeb2d65fc", "comment": "Malware payload (Mirai)", "value": "3156e95abfb4897dd4bfaeca08cae0f74500fcd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232469, "uuid": "8a169a9a-350e-4e38-ad70-73d4d0d35cab", "comment": "Malware payload (Mirai)", "value": "685bf3cf914237849674d6676d2b6e78483b4f6df9a2b3ef78cc39c58ca50cc5fd03a2611b6d8d96410fd645436f80c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232469, "uuid": "20811942-bd93-49ba-ae46-62f686c3dbbb", "value": "T161C2E19195DD0C04CC3A45B3A37D0D7E9661DF895B8EE10B375A722A31D30F8E81D9B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232469, "uuid": "89aa7de0-c91c-4234-a91e-795fd852be7f", "value": "768:UwCXzkgmpJF5wX33g27gYHSyZj7X43Pbnx/F2HD+T:azPmrmoY1LAx/JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232469, "uuid": "8cf1827b-87b2-42ac-b58f-53d554136af9", "value": 26764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232469, "uuid": "ffa172ad-da51-4e5c-a79d-2c776bbf2474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232469, "uuid": "8a6b173e-20cd-4d39-8e99-51824b14af2b", "value": "2a99de328bf754578602be88a1423248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d17e9dc-e1e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682262282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262282, "uuid": "637a6aab-e2b6-4523-bfb8-88d926c08ea9", "comment": "Malware payload (Mirai)", "value": "df62f5461051e414ba352c32876e0666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262282, "uuid": "f5785fa8-40ad-4f01-9952-3d989cd44501", "comment": "Malware payload (Mirai)", "value": "730b7acca2f1a5fd37de5b290ceaeb3256460e833a52f50fad4f03a89a919827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262282, "uuid": "8cdfa821-b2c4-4747-89ee-88c48a7dfdef", "comment": "Malware payload (Mirai)", "value": "69377fd3c53e956a03b0bce99cf60e9216d2fd62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262282, "uuid": "906f4db4-d0b8-4df0-9193-df45f5362151", "comment": "Malware payload (Mirai)", "value": "2055abf73ed90f60631bc07c0e174933618100c4c90627037f958862b16b77c3ea6a9eea97d1a923a20fd5ac7a2dad01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262282, "uuid": "1c1e7f3a-cb2c-4d13-b751-ebd22b964c3e", "value": "T1FEF33AC1B163E8F4DD154A742137FB332E72B476623DE99BD3E52A23AD81B81C4061B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262282, "uuid": "768f13e2-21f9-46f0-bc4d-d9219d2aacfd", "value": "3072:+9fMnIGPXMQOpWrGHukdp7owDmzvLKYSPoUZLwbVeJ1uYEyh/tdAPfndh8f0E5Gv:+9fMIGPcQOpW6HtdpTsjKYSPoUlKYJ1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682262282, "uuid": "8e5c5016-ce5c-4e71-b861-076a7924e510", "value": 169200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682262282, "uuid": "fdfc3f81-1fd7-471f-bb4b-1ffa96feb868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262282, "uuid": "8b3b06f8-fdd5-49af-9258-5f50bf45b288", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294f8671-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258410, "uuid": "fab44ff8-1e84-4757-bb92-1804b05f9b1b", "comment": "Malware payload (Mirai)", "value": "9afc1c6f4f10d3bc95b126fa91beca80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258410, "uuid": "810f6ba2-a99a-404a-bd22-fff8a9011e5d", "comment": "Malware payload (Mirai)", "value": "7397332813fd26931353a76123d8c155ad5e767c8254d60f38592cc77fc7826b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258410, "uuid": "efcdb325-07ab-40fb-b15c-2ddcbd71a03d", "comment": "Malware payload (Mirai)", "value": "e2681abc131ab3c96bf9e405019e8d9fd61c6f49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258410, "uuid": "878839f4-97dc-477d-b87c-35cf7e06c7f3", "comment": "Malware payload (Mirai)", "value": "c848532b2f479fd0f7aa845efd77833ae6a7480fd3bc422c872f394000a08d368c7fc6d26d1bcd35c644eca75c2367d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258410, "uuid": "31a0de92-d157-46bd-a968-9e196609a715", "value": "T161335B4272280B17E4970AB0353F5FE057BFEAD025E0B685659F87768A36E371482F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258410, "uuid": "f3453086-d996-4325-b761-b599d65729d5", "value": "768:Y1BuOjdRfuaun/t6N1K87WHRqJ7xQ0DaZ2KfhROM6HPG7qc:yBu8G16N1K87wUDQEa/ROMzqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258410, "uuid": "2051cd61-004d-4749-b6fa-f2117e17e333", "value": 54360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258410, "uuid": "2c3b2a09-2522-40a8-b315-84d66214dd21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258410, "uuid": "a942de07-9c05-4adb-8fa8-406d68feba11", "value": "9afc1c6f4f10d3bc95b126fa91beca80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ee94be-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261681, "uuid": "59b18226-a651-4abc-bc46-a1ee41e90e51", "comment": "Malware payload (Mirai)", "value": "1772f9f02a37a0e54734e99164ce14c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261681, "uuid": "5238bee3-623b-44b8-a378-8909734a8b44", "comment": "Malware payload (Mirai)", "value": "74484704c86952a1a46ae6f7b795dab3e90d102070c822af8d500dc10c5638db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261681, "uuid": "5bafb4cf-558c-462e-a0e1-4fba63ae6187", "comment": "Malware payload (Mirai)", "value": "7187a95f41326fe2b60f455221333c1dbba4a72c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261681, "uuid": "b36733d0-33bb-4984-b701-733b38191b5c", "comment": "Malware payload (Mirai)", "value": "fe57bc033bef9598f9eb44754ba835570d118264555d1f7d83049119ed3a64eab2c1f826df100a4addd3e8e74ab33a52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261681, "uuid": "527d8dfb-4148-4848-a93d-ef54d1116236", "value": "T187834A2279762A2BC0D9A5BA21F78319B1F1678E30E4C61E7CB20D4FFF6464425476F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261681, "uuid": "8352a130-cf65-416e-b93b-e1a23766f46e", "value": "1536:WM1tkcyJUeVKr48SvnWRVQO8zuXHQeK+75E2s+t6Z:f10CaTO8KXpK+VE2sHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261681, "uuid": "47c68fe8-4cfd-43aa-8c7a-9db6f8894c8f", "value": 83100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261681, "uuid": "98aa03b9-9e44-4b81-b1dc-5500fd61bf7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261681, "uuid": "486b7fb0-ad05-4254-9957-284cde25360b", "value": "1772f9f02a37a0e54734e99164ce14c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33844d6b-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682258427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258427, "uuid": "1f108266-37be-487e-a23e-b47078069c4b", "comment": "Malware payload", "value": "368edc4404ecf9b46e237491a54c3af2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258427, "uuid": "7d9aad11-dcfa-4e2f-9009-f29ebd8c02b0", "comment": "Malware payload", "value": "76524b636718961dc92769eb899171390e04fac410f20039eebac73e309c0306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258427, "uuid": "79de39f6-ae78-4674-a613-ff0e2cf2e98b", "comment": "Malware payload", "value": "46b0b9329bed2b52d5ddccd03ab07e990178a0d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258427, "uuid": "073f537d-627a-4ce9-8c0f-2449def75551", "comment": "Malware payload", "value": "81830034b175e9867843c95535425e20606ca793e0c8d8ab1f23c489c6e9ffd5f9012939955523a426497659014c2a64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258427, "uuid": "27ca5cd5-c757-4c16-a976-824536da33dd", "value": "T112C30892F901DEE6F40AAB7604D74B20B670FB624F532626735B3DA69D362D43827F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258427, "uuid": "6e2616ed-438e-40a5-b2df-6285365611c8", "value": "3072:yakkrkyDHKkBM++JDARitZOEyVeFvIBPJaW/mm2/0lLHssVYN0:yg/BM++JDhyVavyPJaImm2/0lLHssVYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258427, "uuid": "a99e7d5a-53cf-44f4-9a55-bc01398b67ab", "value": 120390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258427, "uuid": "4e1d3d67-6ff6-473e-92ca-2da35e0c9847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258427, "uuid": "c72dc5cc-f746-4e0d-8aab-b219a5ca0a33", "value": "368edc4404ecf9b46e237491a54c3af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3eeff0e-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257837, "uuid": "3fc6f564-6680-4890-87cb-fd7e8c8557a9", "comment": "Malware payload (Mirai)", "value": "d97247674780093c77da9effc3575a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257837, "uuid": "bcbbd771-53c5-4ec8-bab5-36b85a8a9c0d", "comment": "Malware payload (Mirai)", "value": "7805211d7e659d7817dc4c9e4ea4f7f8516deebddbc0e076e5a83a5bf5dceabb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257837, "uuid": "10904116-caa1-479a-99e7-39e6eed54362", "comment": "Malware payload (Mirai)", "value": "0b4f3846be91cf16cc077321bfb6837470fec767", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257837, "uuid": "28ca3ddf-7deb-4f41-918f-ce204d362685", "comment": "Malware payload (Mirai)", "value": "c928986587d997ce0c0a87c2f185f4d63e3cdab391d2159415f0c91695b8d2347a8e2fcc88c76e6158fa39659757d605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257837, "uuid": "8d85da15-3e66-4289-b1b1-80152f49be94", "value": "T1A0337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257837, "uuid": "3435e675-c7e5-4283-8738-353a2982ebcb", "value": "768:jaixFwtLSYAagMo0ebH4/ovQX3hyWfs3INgCJUU/qMCqKomQRCvd:jaQFwtOGQvQXxfs3kgCJt/qMF/RCvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257837, "uuid": "1c49bcb9-c306-4101-b5a5-0b25e09803ac", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257837, "uuid": "eca3a3ce-4315-46a4-85a7-090ebbbf11ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257837, "uuid": "5f767772-cd13-4cba-ae12-9bfcfccf886a", "value": "d97247674780093c77da9effc3575a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0187448-e19a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1682229028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229028, "uuid": "f4582065-5c5c-48d1-b851-d7cecb599e27", "comment": "Malware payload (LummaStealer)", "value": "8fb5fb043d32cc851f3c3adb5ad9464a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229028, "uuid": "499bf506-1d61-47ca-91be-30d24f2588ea", "comment": "Malware payload (LummaStealer)", "value": "784fc4352b78136eb80cbf19bf89707ec2414c1daf3082774cecab08110b6ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229028, "uuid": "fb695a23-2c79-44f4-9b68-f049cdfe2ba5", "comment": "Malware payload (LummaStealer)", "value": "da88c77a4303520cb05591fb0d09d20bee4c3be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229028, "uuid": "e25dc0b9-af76-4e30-8e46-e454af8982b6", "comment": "Malware payload (LummaStealer)", "value": "37e17fa9ff6f15aee1af11df44ec69872c923fdb908740b6f97b8bf26bfb4757bba07b8668ca5b117fc35ca64961b801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229028, "uuid": "aa1ca2c0-21bf-4ffe-9f15-798f869d2227", "value": "T1AF84CF063184C17AE42BECBE5CE1CB74933C7A36279F84C727C8165D4E526F1E97624A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229028, "uuid": "bcbcb33b-38db-4bf7-a7e1-1e54bc522d50", "value": "700f5813efd204f7328cfcc176187f03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229028, "uuid": "e61963c2-839d-4f57-b105-d7ecad76c175", "value": "12288:jQJCcGe4/a5qUvmaziL9iEVBfGr/w+au5:jQJo/IqWY9R5GDw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682229028, "uuid": "7ec399b9-638f-4f98-abed-21cf6bf31c2c", "value": 401568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682229028, "uuid": "f34cb8f2-eac0-41bb-93ee-c07c74d83169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229028, "uuid": "aacd1936-eb23-4b02-a825-dc8bbf69c82c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42166fc6-e1fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682270907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "666e329d-0b25-480f-8ce2-9a18ba6d98b4", "comment": "Malware payload (njrat)", "value": "87ba872271973c112cd28143d5f8e3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "46d6eb30-ad7c-4013-a3f8-4bf009aa4916", "comment": "Malware payload (njrat)", "value": "78bcc288861e1f97fb08d28ee49c1e0d7ded354fdc7068948c59fb8f505f41e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "2ac658b8-2dc6-4709-b17f-868114cf47dc", "comment": "Malware payload (njrat)", "value": "fa9a9bbfa9b9230a857e9a7889b681d57dd77081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "50f6791b-96b1-4d06-b5f5-6ae9bbc8d18a", "comment": "Malware payload (njrat)", "value": "e6724017b201f0ece74eb719fd888a202ca1686eb044fe71e1b4ba092f8d1e3002a41e439ae76dec5a2074f767aef359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "a757d112-bef1-4bf6-a59d-aa4125240224", "value": "T1A7C3732039FA5039FA73EE775AD0B4E6DD2FBF22271E947D205133670662A40ED81939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "18f70f8c-eb11-43cf-8640-30cccb7b50f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "f7e5deca-74f9-430b-8915-d3d101e1ec46", "value": "1536:g4BkuyaInguJT4bZ2Nk1CzjJOQq2IKx7QSeTz9xlA7/kmk+ChiH0hLP+VVVVVVVK:gPaud4bZL6OQi6sz94km5bH0hLNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682270907, "uuid": "94a597e0-c589-420e-a36c-f3a04e53daec", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682270907, "uuid": "ff2dd38d-c6c5-4f4b-950e-e4d077069270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "55657878-a52a-4ac8-8548-7d23bbef53c2", "value": "ccccccvvvvv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6854a488-e1c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1682249067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249067, "uuid": "48c6967d-5e67-4078-ba90-61f012d969e9", "comment": "Malware payload (Fabookie)", "value": "6e8c451e608179271ee457f8e72ae334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249067, "uuid": "8e66b7bb-83e9-4d02-99a6-e470648b2f73", "comment": "Malware payload (Fabookie)", "value": "7903487228dbda76f474d72375478dcea993fb1954b54f7cd93cf3d63c2f9c67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249067, "uuid": "921065b3-385d-41a3-a764-f4c8d3798b26", "comment": "Malware payload (Fabookie)", "value": "9251ec15f163cbd01ecbe313ac058a476a35f19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249067, "uuid": "bc1ad4fc-9812-41bc-99ae-0d7e5d6194e7", "comment": "Malware payload (Fabookie)", "value": "9d0b3f3898d9312d8167b85af0705bf878e9a5695670be8c4d13b11f5d7b3bc681e137898b234240e1c358462aec79d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249067, "uuid": "828c9245-8497-4bd8-b9b2-bc726d23d81b", "value": "T18734AE11BAF1C072E2A74A714470D6E8AB7BFC62672586CF27542B6F2D307C14A76323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249067, "uuid": "8105d1c8-18ac-47da-9bcb-429d1585b150", "value": "e4f8cf00c234eb20415b669f060aea52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249067, "uuid": "e246234f-82d7-4caa-964f-de803d1fff69", "value": "3072:+6cs7Koeg9m5q+qZB2cLdY9ACUnSowRltVkAuq5ZG4l:ny498bcLdwXUSowR9k/yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682249067, "uuid": "c829101c-8c39-4705-acac-8acaa6d0ccaf", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682249067, "uuid": "2884993b-4a45-45ea-b325-8cfa9664136e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249067, "uuid": "14962538-2ffe-4058-b74f-92a4d08209d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909bad62-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253429, "uuid": "9e8f9c87-8f9e-4cb0-803c-753f28f7586e", "comment": "Malware payload", "value": "cb66e62752711c583a14a349388d1b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253429, "uuid": "0deaa56d-fa34-4070-b89a-0accf6ed44ca", "comment": "Malware payload", "value": "7a22d22ee97982ae6e1895a213d14fd92544704ce491aabe1475c16e3991c949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253429, "uuid": "a52bcf16-2c3f-41a5-b57a-7df3b79060b2", "comment": "Malware payload", "value": "adbb0f55e4e9c3cdb0cb57f4bb08009a3ee187b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253429, "uuid": "89da679e-9099-47da-8582-77b1c1d06fe0", "comment": "Malware payload", "value": "39c54b46743eff3004fca2396f5e3b3b3ae857d07632c918ff7b07caf9f05e5aae7d86ba4fc5481cc0b64e23094b0ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253429, "uuid": "da21b218-5e6b-4688-81cf-f412ee5c85d7", "value": "T1E7D4E1CC6755D3D3C6653C7C226A717D3EB088DBEA5AD9A2FE8518693D71BC81E00388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253429, "uuid": "5adf4642-1426-4ea9-b7f4-1a8aa3612586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253429, "uuid": "9e6a5e9d-dad7-47c5-bee4-afc8d643b0c1", "value": "12288:870ux2iNXMQ+yZPq1WGW8i71zhKSh4rS7cis:e1ZAy1q1T87h4rS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253429, "uuid": "4e36c8dc-113b-46c8-8ea8-aac45b707921", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253429, "uuid": "20e40865-a77c-4853-a00c-297a67a164e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253429, "uuid": "5af7323a-246e-49a6-bf73-0d75a65305db", "value": "SHIPMENT-INVOICES_DOCUMENTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4791d2e-e1de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258214, "uuid": "b16f60ad-fea9-40e6-9b9e-2188bdd3b334", "comment": "Malware payload (Mirai)", "value": "c6108239175539272b0b530ef904be8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258214, "uuid": "027afe3e-9e99-4f0c-94ad-140f23203754", "comment": "Malware payload (Mirai)", "value": "7c1acc0d102464f9a115ff702b793570398de6532544a644b3a9c8f67f31470d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258214, "uuid": "41414599-9918-41cf-a0e3-4ed7b6d3d202", "comment": "Malware payload (Mirai)", "value": "e4d02c699d14f7ede5f06971c7367b0018a0e04d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258214, "uuid": "16e952ea-994a-455e-b0fb-734c03317299", "comment": "Malware payload (Mirai)", "value": "bddea4d3f59cd8186c7bb6877ac07e55faaf4970f0992bbd8b7fa26c82caffbb468ab4c60585241b00ac93dbd3ca5be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258214, "uuid": "76029f17-bc35-4a71-8d39-be9370db9b3c", "value": "T180635BC4DA53E8F4E91706717672F7328A36F4791129F687EB9DAB339C82650E10328D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258214, "uuid": "c549b40d-79cf-47a5-ac19-3ba4bf04879b", "value": "1536:0aF4oc7UB6aYJmjq75Ut7032ABVq2dF/TsIqbPdVoEX9i9PjSGg:0aF4R7UB6aYsjq75YQ3JHq2X/TsXb1CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258214, "uuid": "f731f3dc-04b2-4f97-93f1-54cc8bba7578", "value": 70708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258214, "uuid": "a3bce7de-19fe-4951-a555-47ea9c5c0a10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258214, "uuid": "ddd65b91-1b0b-4742-87e6-764f68326aa2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647e0812-e20c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682277837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682277837, "uuid": "8e53d19d-854e-4c42-8fc0-b1c2d1720a12", "comment": "Malware payload (Mirai)", "value": "b183d639a5c334b640e5411168b4e2fd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682277837, "uuid": "52d4d36c-4bd7-4ae7-8d2c-831ce67bab35", "comment": "Malware payload (Mirai)", "value": "7ce87f079ecd0a5a6ae284f43fe1031b1d83c3ad55272788dcc97e37bedd0f07", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682277837, "uuid": "c4aa5379-bb05-404d-ac7b-c2f228bb7cb8", "comment": "Malware payload (Mirai)", "value": "486dd22285b85d83d5fd4ae84c2f2b8eb96820b1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682277837, "uuid": "3697e8c9-2e79-4b90-903a-353b467f362e", "comment": "Malware payload (Mirai)", "value": "36679c4e25662c6dc6fb6c50d8e74e647692def980316447f758a318b1d67e32f7742838600d80073ea9f1e46c583c0f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682277837, "uuid": "25ff909d-39c8-4dc2-a9b7-b9924183b096", "value": "T1BC536D1764C080FCD9D9C2F41A6EA936E073B07D2266BD5833D8FE256D9EC712EAD201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682277837, "uuid": "edb159e4-e134-4038-8e5c-8052e1c0675c", "value": "1536:qUf0KqzUm6J0CYFpBya7+SBTfUB1yyP08DBtdl6Tmms:uKhJNYDBya7+SBTfU1fRDBtd+mms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682277837, "uuid": "55c461f5-f4ba-43d0-8f06-6ec2494ac7ad", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682277837, "uuid": "e7673140-845e-4f4e-ae89-b610347ba05d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682277837, "uuid": "b30d80b7-8380-4458-9253-4c5502495dd9", "value": "b183d639a5c334b640e5411168b4e2fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a04dd0-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253431, "uuid": "0390db19-3b69-42e8-9f6f-aec9c52cd06a", "comment": "Malware payload", "value": "f4c70cfd126e882a525f0caa01c617b1", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253431, "uuid": "11dd2a1c-7f88-4f11-8652-332e2640dbb0", "comment": "Malware payload", "value": "7e4f0dac4387bcee839b744f5ff100038974abf659dc04d2d7c3d9db5b6bc089", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253431, "uuid": "eed55dec-f433-48f5-ac42-f5aeb9f22181", "comment": "Malware payload", "value": "8a974bc2c113b3adee859c2563ce9a5fa98ccefc", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253431, "uuid": "57edcf61-ef81-45de-8b30-68a42efde750", "comment": "Malware payload", "value": "8e2725cec45a378945fafdce607e2dba1632586c3ef44726c6b940b84c2d588da73347ea56d831296b4df51c907c9969", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253431, "uuid": "d65cbdee-2d9d-419c-9be1-7b168c7ebccf", "value": "T18BD4E1CC6755D3D3C6653C7C226A717D3EB088DBEA5AD9A2FE8518693D71BC81E00388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253431, "uuid": "90b3f59d-0af0-4dfd-a700-08796ddb5214", "value": "12288:570ux2iNXMQ+yZPq1WGW8i71zhKSh4rS7cis:n1ZAy1q1T87h4rS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253431, "uuid": "8a6de270-5b15-427e-af1e-7b6f928bfb3e", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253431, "uuid": "68787368-d2a8-4bc1-a274-3b2fc9f14db1", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253431, "uuid": "866623de-5872-4151-aa45-9e3173943401", "value": "SHIPMENT-INVOICES_DOCUMENTATION.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60ed81a-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259156, "uuid": "32d44891-9a81-4544-ad6f-5b6d28246d1e", "comment": "Malware payload (Mirai)", "value": "106535077b6c8082b95ebcadd97716df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259156, "uuid": "8847f3ba-4d35-4907-80ec-ba75e68e555c", "comment": "Malware payload (Mirai)", "value": "7eb1b5f38f9b857334f5dc0bfd6b11c6189ef7832e2da0c72da61cfcc07d8764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259156, "uuid": "78eef133-5bfa-4378-8070-7523aa0e3dd5", "comment": "Malware payload (Mirai)", "value": "0e7b2653684192513e389d3c690964d091db64a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259156, "uuid": "18d9c56b-6daa-442c-aa3d-0fe0c042654c", "comment": "Malware payload (Mirai)", "value": "1d89eb83be4082590747abd08ef22e73ab70893446380ff73c2821235329601ac76e42c206a06897f72cea32992f55a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259156, "uuid": "fdc70532-9268-4e39-b310-60439a289402", "value": "T106B2D03502CDAEE2C9109570FAE9C708335306B9D17F719A37824B39C7923A9A3751AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259156, "uuid": "b429b307-fef6-4e88-bee8-efe9cfd63cab", "value": "384:tWdWyZ1lp0E/Z6uy1AEZZBTCU9HT5SExCDtEFL88lKOsl0zjMzIEhymdGUop5htR:tWdWCp0E/oZ1zZBT31TYsCcL8zXIQhsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259156, "uuid": "fa0fafe1-8937-4598-b539-3071fa156690", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259156, "uuid": "0785f200-4d8c-4555-896c-ea38ecfa6b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259156, "uuid": "494c15bc-fa7d-417b-831d-c824a26fe622", "value": "106535077b6c8082b95ebcadd97716df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee6cbfb-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257829, "uuid": "0689cfaa-8d7c-4288-9c83-65802c416982", "comment": "Malware payload (Mirai)", "value": "c7aab0bdd46abb125243cbb95d861e70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257829, "uuid": "65f08e17-72e8-4715-9fce-6942eac60fc6", "comment": "Malware payload (Mirai)", "value": "7fa2f815041893d3a6822277a32463be9468ad8fa58c199f933b2a8b8c368d88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257829, "uuid": "7db50be6-6c8a-46bf-b549-af816aeeebb0", "comment": "Malware payload (Mirai)", "value": "e80e5bc16c01af7e03cf3bfa6169c19c62d13ba0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257829, "uuid": "c91618d4-1b3c-4364-8288-649e94b31c48", "comment": "Malware payload (Mirai)", "value": "6a77ef54b7c168740dbea4c5ddcee9df8c884ecdcbae0a416faf6a3c0ba85c5402761c8635917b3dd1e0b5eb8776758c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257829, "uuid": "155e1fe4-8ef8-479f-99c4-8ff6fafe9c5e", "value": "T1DBD2E0ACE696BEA9CD8D547C0ADE02766EC434C3769D49CA23134448377EA8BFC1D224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257829, "uuid": "865c1d08-fdea-431e-8a0b-2d818e488d72", "value": "768:r1uUtLrVDsAp6tLkFqok//xDMfPMJbaWUM:rbDs06t4fYpwsOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257829, "uuid": "4d76c84e-0188-4f6b-aad3-d17fb69edc97", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257829, "uuid": "c06bae5d-7d06-42f1-b74f-634ae893da83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257829, "uuid": "a225e75a-8253-4bc7-bf50-af8cd01092a0", "value": "c7aab0bdd46abb125243cbb95d861e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e29fc0-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682258433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258433, "uuid": "c5d5ada6-c2fc-4398-ab89-c2004384cced", "comment": "Malware payload", "value": "e4282d67478685297147a0d7555552a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258433, "uuid": "ed0475d1-43b2-401b-a57b-4211b330f089", "comment": "Malware payload", "value": "80a4cbd17f87bc7f5726eabcd464e48b8bf19145241cc68aa94f2aee2d7269a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258433, "uuid": "a0d8929d-acb2-4bf8-bc7c-68e8fd3b8128", "comment": "Malware payload", "value": "f3e2fd14024530c07ed64ebd91f916ae4d77a57e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258433, "uuid": "498f634a-f4d2-4715-ae30-4f232dcd30ce", "comment": "Malware payload", "value": "88becacb8972226d86cdd6a1e1420c7901030c9dc032a37998fe81d285c8bd1f6886461d1ef65cd7bfa2f0a9cafad7cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258433, "uuid": "cbd37b26-9b7a-497f-bb21-590ee1c915d7", "value": "T1D0D3093B67230E23C0C9947109E30332B9B9D74934FE97D3A9D16E9D6F0AA8434667D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258433, "uuid": "e8708474-845b-4ab4-b962-dfc7a231ee48", "value": "3072:Aif+s+Zr4E1CoJoP+0Egaxcfd8cBWmm2/klLHssPTN0:XDEl4lfddWmm2/klLHssPTN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258433, "uuid": "183a9ffd-e307-458f-a74f-cb0c8e83d556", "value": 137842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258433, "uuid": "df262b7e-d219-470e-b442-e5f0be37793c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258433, "uuid": "7eb5e441-3b49-49e0-9df2-4200413eda16", "value": "e4282d67478685297147a0d7555552a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34f9ec4-e1d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682255179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682255179, "uuid": "55fd9382-ff42-4802-8d92-b28cbcf75d13", "comment": "Malware payload (Gafgyt)", "value": "cb95bc9e3c506caa0dbbe258dc22ecb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682255179, "uuid": "9e0a1634-f077-4f55-afa7-91ddab7f741a", "comment": "Malware payload (Gafgyt)", "value": "811915c988ff17a6d129209448910446e49f4524d5681c0820672bc5cb5a0c9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682255179, "uuid": "4c8fb544-102a-4bfa-bc8c-2b0e907ebfbd", "comment": "Malware payload (Gafgyt)", "value": "63c50e43a21270c4e7d536815409c4bfb66f25e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682255179, "uuid": "f2e23754-a4c4-4aee-9066-0b49c9c378f6", "comment": "Malware payload (Gafgyt)", "value": "fbcb968f5c85705b135d6812919ae2ddb32eecbdce88d4ac8113c9cb0a66e44393c1c208027fc555274a9621e7836ae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682255179, "uuid": "99602e35-427b-493f-a05d-435adee6deb6", "value": "T1A3C31827B7F2C9BAC242A1F526DF85E1D412F53C0B32622B77946F652B2C8C91D5A303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682255179, "uuid": "d632ea74-9e9d-4a59-aff9-bbb727d4e260", "value": "3072:KwVadvAP+WXpQHBszj6P+Bpi3IbGzgF1ymY2eGH4+9PIdoGDzh85YvuYddnm7qSs:7lj6P+Bpi3WGzgF1LejAGDzEYvtm7qSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682255179, "uuid": "08dc1b19-4d79-4275-9ee1-7fb72712483e", "value": 121437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682255179, "uuid": "b05e852e-7a4f-474d-8ce5-7cf09c27d476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682255179, "uuid": "02858d9b-6d70-4abe-aad9-16f378b5a7d4", "value": "deelo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab26f3e-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682259245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259245, "uuid": "3cc97591-470d-4699-b384-dd8753b59748", "comment": "Malware payload (Gafgyt)", "value": "c9e1f13b78285785a7f649275467c3aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259245, "uuid": "65e86716-43e5-43ee-92e1-6ca770c4ab7f", "comment": "Malware payload (Gafgyt)", "value": "817f77e010f2339a60243d0b629371b62c302c7cc8d2651e261c09c1aa68302c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259245, "uuid": "05e221ab-0be2-453f-bbf7-26bd9031ca99", "comment": "Malware payload (Gafgyt)", "value": "120e5aa8c0338e650a2ef90bd669d19a4a712fab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259245, "uuid": "8a60169f-45d3-4ca4-8f95-06d1d0dd9047", "comment": "Malware payload (Gafgyt)", "value": "48ed56ae40622ff5cf38895d48c623bd2cda38ec86c53fca1fc1de903fdfa4bf25c07a26890a64d7d59a718fe897ce2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259245, "uuid": "d638a876-379d-4975-adc1-2f00b28677a6", "value": "T127B3089ED307C2F3C9830EB2065BA66B4520F97A593E8A4EE71D2CF497368C4712D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259245, "uuid": "17cc5e58-48dc-47b7-abb2-82a8f3308b64", "value": "3072:wdPU/Pu8VjSW6zzopZHR26mRX2HVfpsFmmqi05m0iswEc:wK/Pu8VjSW6zzsde21BsFmmqi05m0isg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259245, "uuid": "108bc5a2-272d-4320-809b-66241aec4b6c", "value": 108018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259245, "uuid": "ae932cc7-9a17-4b99-95a8-30de92bd030e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259245, "uuid": "63090e92-8085-4258-bb16-eef3c6f24664", "value": "c9e1f13b78285785a7f649275467c3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04245949-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682259207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259207, "uuid": "05a99043-c219-4673-823a-573693ce9800", "comment": "Malware payload", "value": "56acbbe66e6db329ec132717508e0f88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259207, "uuid": "fee53552-c7f9-47a7-a8ad-7ed0e3af3227", "comment": "Malware payload", "value": "81d3dc6fd72deee65ad9a9800431db66ef1f8ccbd2432895bf0de8cc8e31e4c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259207, "uuid": "d80ffe72-a2dd-40aa-b140-ff2bdab1faea", "comment": "Malware payload", "value": "462a93d77f27213c09b0c249af8747a7c4ed3720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259207, "uuid": "248e3097-a37d-4250-86a7-71fbfd2b9445", "comment": "Malware payload", "value": "6c0935e79b550fb53130e1ca7cd6f3a7da3b260f714644d3a13f749884bcc0c87fd8352bae3612940493a19ce2f2a168", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259207, "uuid": "67fef4b9-ee50-4332-94d9-8df040993039", "value": "T194D30844F851876BC6D227BAE78E03CD373557B863DB33255A38AE742BC17A81E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259207, "uuid": "82178423-9769-4716-ab82-349517d1f3cb", "value": "3072:r5OTcn/nilb1bpcNdGXNnbkn3QEqmomPtbGQ7fJogpnN0:j/ilxNciXNYn3gFmPtbGQ7fJogpnN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259207, "uuid": "d69c5775-6054-46d0-9188-3e864360462f", "value": 136460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259207, "uuid": "9c411fd9-f2a8-4851-9780-0c857d2ccf4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259207, "uuid": "91ce1b7a-ede5-40ec-a2d3-9c1ec3fc6430", "value": "56acbbe66e6db329ec132717508e0f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dd62e9-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258453, "uuid": "c3528ff3-aa5f-4626-b952-e24a8b26b206", "comment": "Malware payload (Mirai)", "value": "2c9d886204dd591040426c073a2925c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258453, "uuid": "3ac79166-7780-4cb3-84fb-296f4f69b9cb", "comment": "Malware payload (Mirai)", "value": "85ca60ba89347d8254134e4e879abfb7d6e3e57913f75a3ddb40651b84bd928c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258453, "uuid": "7fac1e7f-d74a-4966-95f2-95ae8b0290f3", "comment": "Malware payload (Mirai)", "value": "844dd1335befa07d692a87cb6d3be75323dc2666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258453, "uuid": "b5433389-8976-477b-bdea-0ed415cbe01d", "comment": "Malware payload (Mirai)", "value": "6d8b1888f5c7e9531f2246f9266264609dd505ac4d9d1ef4cb38875c7368fdd0cd77491a817f0f6e1e5ad7f7ed13427b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258453, "uuid": "5619b893-4527-45ee-a153-b8d4b1934a3d", "value": "T16D333A96F4065E2CF94BE5BD50170E0ABE31239062D31B2B67B6FCD76C33268AE11D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258453, "uuid": "7022166a-cbe4-4c4e-acad-7f2877d86bc4", "value": "768:iGeIE5gSSMkgPW/wiTS+RKeyAJ8WMYDX+qXpzaZ05g:jfgPW/widKsJ8WMQ+qXVaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258453, "uuid": "a2b1ba06-9045-4cf7-b9ec-748505936b4d", "value": 55132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258453, "uuid": "838cf737-f875-474b-abb0-b4bef923b337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258453, "uuid": "6fd8ede7-6ed3-4ddb-a926-1c63b9685b31", "value": "2c9d886204dd591040426c073a2925c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41efc79-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263770, "uuid": "ae634d3f-0e3a-4e32-9b6c-b3c8f5c04a12", "comment": "Malware payload (Mirai)", "value": "1aaa1423323f189b1ee877df96efebd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263770, "uuid": "72f22420-f372-48ae-9200-977a27a3e46f", "comment": "Malware payload (Mirai)", "value": "8693274cb25271c01743c0d9babbbf6d71a971c05df03b7c1c60a205fc94259a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263770, "uuid": "722b4c60-c98b-4fd1-a386-c121b2d45f49", "comment": "Malware payload (Mirai)", "value": "73486e3a7237f92b531f9d120663fda1c36f69a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263770, "uuid": "3e41fa82-6013-4b7b-9c4a-f5b02c6fd94a", "comment": "Malware payload (Mirai)", "value": "bbb928c484341623c8b304599f74e550f8c167f0dfe57eab93e115d4a91c6095128f2b2a2fd1b79a5fb8a03e65f13a0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263770, "uuid": "571e159a-71e8-48f6-beef-ac56342e0de3", "value": "T16134B6067B240FF7FC5ACC3B49E93B01158D691A61E9BB35B924D809F54B31F29E3A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263770, "uuid": "5c406761-3808-41ac-8227-7ad98b37c7e7", "value": "6144:BaQaF3eNyYbW6qK0OeXjxTO4DtOz+OEGOWaQW/p1NIYE:wQaF3eNyYbW6qlXNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263770, "uuid": "56f469ae-38f0-4483-88ff-c2518013d22e", "value": 252344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263770, "uuid": "bfce51c6-6061-4ef1-ae33-a1290bf4e689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263770, "uuid": "15701462-f8cf-4842-bfd5-34ac8e98bd38", "value": "1aaa1423323f189b1ee877df96efebd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ffe0bb-e1a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1682235165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235165, "uuid": "5b96410b-8f92-451f-a783-9f8c96b1ac1c", "comment": "Malware payload (zgRAT)", "value": "6dc9032c2c6ab3dd737990cec8cbaf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235165, "uuid": "aaaf3aed-1edb-4426-8a67-55511b9ab3bd", "comment": "Malware payload (zgRAT)", "value": "879b5fef5bd8bbd8a81ae74de86e38f88f60e4da9aa35941ee3e676ebc386718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235165, "uuid": "a8cd87b4-cf94-4a7a-85fd-9fc3479f30bc", "comment": "Malware payload (zgRAT)", "value": "ea917c44a751a7183c8243a192a86a3616a0fcf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235165, "uuid": "310ef423-aa6c-4448-b831-0e9fcdecb09f", "comment": "Malware payload (zgRAT)", "value": "13eb1a9be08beaa5bdd99a9f78e9b511dda4d753aa2aef58834d38cc56a59dc6afd8b1002ff2c873b205743e47442870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235165, "uuid": "ad00092e-c0b5-4a8d-ae8d-36f3ad010aba", "value": "T129B501B316C3FFD6DF6A0DE8E48217444F8058B7435CA698AC8895DE80A9504DF7ADF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235165, "uuid": "fc3d9201-2ae8-4cdd-bae9-8b67fb7d94aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235165, "uuid": "62f30747-b3c3-46f7-8dde-e3b49ead669f", "value": "24576:RwWbMNFGY0xgLNrQYDdpnGfmvhS1rwReU3RjCcxg8V0FEdq+SrMxRr6XDcY9B:fEPGevhS4eIzLVPsS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682235165, "uuid": "dde1fe0d-3823-44ea-848b-efd4ac182227", "value": 2305536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682235165, "uuid": "29c972d3-caa1-42ac-8324-89ffbc1f937b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235165, "uuid": "fcc77cd3-6a30-4942-9883-fe489cc127a6", "value": "6dc9032c2c6ab3dd737990cec8cbaf94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223fe754-e19c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682229622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229622, "uuid": "6d089887-ab16-44a2-b85e-3e7673fdce86", "comment": "Malware payload (RedLineStealer)", "value": "e9664900b206df97a31f2077532a1f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229622, "uuid": "aeaf0c86-f89b-409b-bd59-a00ee41ba619", "comment": "Malware payload (RedLineStealer)", "value": "885add311f35ea42a800051755249785a5031fa45abf41a7bc4bf4e0d0cb81c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229622, "uuid": "37b6bd92-ea25-42aa-b97b-f459d8560401", "comment": "Malware payload (RedLineStealer)", "value": "4929531a6054fbfd4a9829e38a6dabd5c834b251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229622, "uuid": "dbc16c76-74ff-4013-94eb-bc6b20b3ff73", "comment": "Malware payload (RedLineStealer)", "value": "1d88ea92a82be679233133a13ce14c36f3663d715efff20290199b428a40133593b9d1c761d0ff75463ff5311bd7f186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229622, "uuid": "6d171fa9-b520-4c8f-a701-cb3ac6b2be77", "value": "T1AE452240ADF2D535E56AC23551A0FB20DA3FB8E1789582D732243B3EAE217C2976F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229622, "uuid": "07e4bc9f-dc35-4c92-8b5f-4ed3e721a751", "value": "f88982a603d93c22b0731529c5e6f4b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229622, "uuid": "47b852e3-cfeb-4f40-b07e-269365f08c91", "value": "24576:g8WP6XlIJGBLj1k9E8MK2MipAlFlQoqIhtjrzPnd+DHfsYbvtwgq:moqJG9d8knqlQoqIzPd8Hfsgvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682229622, "uuid": "ea611d9f-b42f-404b-854a-3515cb8b5dde", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682229622, "uuid": "45471d4c-0a92-48f0-bd30-cf4a5f409104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229622, "uuid": "9c9d1ac5-ca39-4082-ae3a-613e5c90d216", "value": "e9664900b206df97a31f2077532a1f18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fcaec7-e1fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682270907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "0ddab82e-9cba-4e0e-94f8-a8d77506eaa4", "comment": "Malware payload (Mirai)", "value": "4052db34082dab1df663738fa6e0d69b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "e0e3db4d-bf63-46af-a604-8aa6482fe200", "comment": "Malware payload (Mirai)", "value": "88e0e28633fa76f2d278064f69e316a8b25691b2fced686d82aa24fbda76d0d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "47404eaa-2fb7-4c3f-8a28-939f58be706f", "comment": "Malware payload (Mirai)", "value": "10f07526526459adfb1fa5ce3d8eb3eb194a9da0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682270907, "uuid": "04d19d07-33c5-42f7-9a74-3d763d6617e4", "comment": "Malware payload (Mirai)", "value": "a1a0760de45933c5fa102f17d989b97844f00f2acf36b3843c04dfa57305a0107b435310b502abcbdf3740d81432462f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "49479f8b-dbcc-4cc5-8ec4-4989e0d85542", "value": "T175D2D03C230103AADE45CC7943E647AC3F665AF6F182EC5E90E3E8C799550633947ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "6454d5df-a0cd-4a82-b412-b7ce25d951f0", "value": "768:qElTKiQLC/V3GI/SGEY9Mr/18bgCJgGlzDpbuR1JKN:qElTjaq8ibgGVJu4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682270907, "uuid": "29976cf6-9101-457f-bb98-dd03628fa310", "value": 28428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682270907, "uuid": "f4fa5c1c-9d9f-4226-b879-58fab56e27b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682270907, "uuid": "0dac6ae6-7e29-4a71-93b1-e211796085ed", "value": "SecuriteInfo.com.Heur.20230423162906888196221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b9e7c1-e1ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682264128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264128, "uuid": "63caff4f-d8cd-434c-984e-622fdeabbf70", "comment": "Malware payload (Amadey)", "value": "f133002f538caff67f6aec614449ee72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264128, "uuid": "e0b6f863-9bb0-4dfc-a972-66879ed373f6", "comment": "Malware payload (Amadey)", "value": "892cead6a434fb47024c39b6f089afc9fef69ddeb28bae4458e793a44a7a391b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264128, "uuid": "39955dd4-3e4f-4be1-bd50-284e9122245b", "comment": "Malware payload (Amadey)", "value": "9adf0b0e625ec4304c3e40efc35e505698b935fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264128, "uuid": "be242ef9-aff4-4516-97fe-def645d9906b", "comment": "Malware payload (Amadey)", "value": "ec67f0e75220c8272649af0f158ace4d6fbaa9b8fb047844527abfa3fb56c5bdf47fcfaf2d51042e8f1ae9dc2f5c3d28", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264128, "uuid": "2baa9379-843d-44f7-ac96-0723b15cd444", "value": "T16045230179E0D07AE59FCA319421D6A51A3BFD72DB3680AB32352BBE1E314C29975372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264128, "uuid": "30a17e72-979a-4e4a-ba37-1f610bf219cf", "value": "2821f07e04708b885221a29f6cc88220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264128, "uuid": "c0a781d1-16e2-44d7-af37-bde7533b772a", "value": "24576:MUcKJEq27vir3VnDKRthL4H70Hop1YZzBOVkicYVgcLtFonRiv:MSeq2MZSjLg70cCZdITrrARi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264128, "uuid": "ae048a0b-1ca0-43a2-8aa3-a80add1acf68", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264128, "uuid": "2a5f40be-a3b4-4712-8835-82402a1e37a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264128, "uuid": "9cca8842-17fd-4c37-9533-486c2f73b00d", "value": "f133002f538caff67f6aec614449ee72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d57ec0-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257805, "uuid": "64c86fff-2a12-48e7-ba71-c7cc55ea6047", "comment": "Malware payload (Mirai)", "value": "1af676d5beb2f94745deea670ec4725a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257805, "uuid": "1dacc2c9-9bbf-40e2-96fb-7afacc2c05a3", "comment": "Malware payload (Mirai)", "value": "898375de0dbf5cbe1ff241a7edd91f6a16d80903938287302f4e424a138f56f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257805, "uuid": "fc1125fd-46dc-4b6e-83f1-cb48aa8c6d13", "comment": "Malware payload (Mirai)", "value": "d9e15ce66ad43d96a1b6ad260d397d85efa5a7f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257805, "uuid": "5323638d-6168-4a89-a4ae-77cc737c04fd", "comment": "Malware payload (Mirai)", "value": "3c31a73800d70f02cbe140a360386d726e7d50a110f065ed78edf622595a532337acc7b5ee59374e19a7527696fdbb61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257805, "uuid": "79b57849-5073-4d49-a6dd-4df7ca492fe3", "value": "T1FA535DCAB8119E7DF5CBE6BE85210D0EB821722150931B17BB6FFC83BD721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257805, "uuid": "da98cfa3-6579-4cb2-a539-c6aef4096aa9", "value": "1536:sXyRgQFVTbSX5pxLepSGYocF1ohON2P3B+qo76E8I:R1UvA8E9oOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257805, "uuid": "120db0bc-6cca-4f72-a7f8-a58191b2cc11", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257805, "uuid": "6fdd2bdc-7d8c-4c9a-96ae-76e2edb882e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257805, "uuid": "dcade67f-c380-44f8-9f52-a5c83518c645", "value": "1af676d5beb2f94745deea670ec4725a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460ac7f3-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682212932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212932, "uuid": "d79ba02a-7149-418d-8c09-af2b0f1c74c5", "comment": "Malware payload (RedLineStealer)", "value": "6238ee3186124699d63c6ed96ea43ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212932, "uuid": "e874eb5d-0d9f-4f97-adc7-647f9adfc777", "comment": "Malware payload (RedLineStealer)", "value": "8a5bdda3e0d9bf0732cde8632ffd9466a230d395c5134e718a64650ed13bd083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212932, "uuid": "0fcceda8-6951-4499-87be-145455a57fc7", "comment": "Malware payload (RedLineStealer)", "value": "d73c80b941ec87184e1e3e305c82249ff0aafe79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212932, "uuid": "537358b1-1eac-4a74-b089-c3af8b0955dc", "comment": "Malware payload (RedLineStealer)", "value": "ebe417b2300edf4537c7f7aef6f2e845239726d7879aa64b026374fb1b3bfde413763172027757cb326b05aaaf4268c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212932, "uuid": "dab3e473-9085-428a-a08f-6482c454b825", "value": "T1C1352352F1D84077DEF923B499F902C31F39BDAB8A3586AF7646EC499CB26805430763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212932, "uuid": "ff0a6142-de66-4dc4-a49a-da2fc2bebfff", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212932, "uuid": "e978490c-9b0e-4661-9435-3b1dc2dedd2a", "value": "24576:TyB4q/Dy90T8wIA2tBOm3YduedhvJsVl5zm2YA5JLUs:mBT2O6LMH+Xy2YuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212932, "uuid": "5f0e1479-5697-40c3-bae7-b1fdb902665e", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212932, "uuid": "f539b1e9-c6fe-4b8d-af54-9d71a0f5a2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212932, "uuid": "75178739-b3ec-41c3-a250-f79f6766f6f5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a26755-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253433, "uuid": "627c7696-fbca-4a32-aca4-580ea476dde9", "comment": "Malware payload", "value": "b28ded2bcd95c584f056196af2ecc48b", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253433, "uuid": "df04102b-032d-4b0a-9fae-0d3071c62326", "comment": "Malware payload", "value": "8b025f1a8aed72a3b9017f35cde8fe94c8bfb47651d3c45dccc542dbd14795b6", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253433, "uuid": "ebee4af6-ee60-4586-a28a-77f5e5e3bab4", "comment": "Malware payload", "value": "a6f99c0ab76dc41cb16a30ba50d83f3f6ddba640", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253433, "uuid": "dc966d2d-e14a-4c4a-8498-f75bd53f7ce2", "comment": "Malware payload", "value": "ba7e46f38e1537e4201c546493c073a028be755e2b65c10dabfbaa7eabe49856e56312cfa3e0cc40c0e4535c90a63022", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253433, "uuid": "7b027e8d-3997-4856-920a-780bafdd3f74", "value": "T197B423081B420611B9916B0066A07626C4BCFE22F7783CD45B553D7DDFBDC5BEA2B078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253433, "uuid": "53dbc6cc-2b86-4474-aa74-4652987ac92b", "value": "6144:UxPQdKnqqZZPQwceLCgimJQqehjwdQHjzHW8Kzix0VZ31KIhMhSh+tVCinQudvCz:MPQ+jZPq6BGW8XS1zhKShaHiIGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253433, "uuid": "5c58157d-a035-4e25-8388-b97da281e6ca", "value": 503740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253433, "uuid": "5924fafc-807c-4e8c-b9c5-cf18e05e66ff", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253433, "uuid": "ff248e30-c6cb-45d7-bdbe-b9d72324b1e0", "value": "SHIPMENT-INVOICES_DOCUMENTATION.tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60760cc-e1c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682247936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247936, "uuid": "4c1b1204-7fe8-449a-b004-36bae70cf038", "comment": "Malware payload", "value": "1011442d1739150b42381657559c74d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247936, "uuid": "3dd91ccb-0829-4a74-b3ba-3b222502ae9c", "comment": "Malware payload", "value": "8badc6c3510dab62dfd38d2eed58498dfc5db1591dcbec6a189da4898f84eac3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247936, "uuid": "2131bca8-a388-4a42-afdf-75b4cf243265", "comment": "Malware payload", "value": "1a6f31bfeeb6df7d862756273d5ef98f1486420e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247936, "uuid": "da687380-b540-440b-b07e-7e527a0c4ea4", "comment": "Malware payload", "value": "eb9c0f74d52251769893fc9d600f8ab3d79c55d97a50050b0561687c9fffb3e7363261911f4b5b9401926ebc8812337b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247936, "uuid": "6a355147-2c41-467f-ae7b-568159864f51", "value": "T16934AE15B2D1B472E4E30676C978AB41692DFC100B7439DB62E3269B4A720F39E36B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247936, "uuid": "e1212d96-7520-4de8-864d-0d2ae55c95bf", "value": "3072:l5K/B0toLOSNJllZHQsozTS+SMqqDL2/TrKmzGumytJKF7G:lcytwbL1yTS+xqqDL6HKjvCJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682247936, "uuid": "e972f8ae-2e93-4553-b5cc-73ba687241fd", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682247936, "uuid": "bbe0c537-8b35-41ea-9549-c27ebf99f5f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247936, "uuid": "62a0252f-ba0c-49a2-afac-52411607441b", "value": "2023-04-22_1011442d1739150b42381657559c74d8_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa22bc-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263725, "uuid": "6627d596-157d-494e-bf94-969069878d04", "comment": "Malware payload (Mirai)", "value": "30aa5b3e7407984f8cd8475898170068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263725, "uuid": "5e7d0042-6f88-48bc-b05c-1b7806032e3f", "comment": "Malware payload (Mirai)", "value": "8be90502f3ef639b9505035bd1cc631ef97afa948522aa7a4935c8fd80e97c1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263725, "uuid": "f3a03e2b-02fc-4e25-b175-a3d9d3dda20c", "comment": "Malware payload (Mirai)", "value": "da3726e1cc1029481f05bf59d8188e6d0ae21709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263725, "uuid": "acd992f7-f1a8-4ff8-953e-49aaa0282a73", "comment": "Malware payload (Mirai)", "value": "6537d257595eb97e6972d7a36e24e06914b02d09af4ccf96f86a87e574a9d042bd7facd40ad6dc32797d166010c4ee86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263725, "uuid": "39e785cc-6ba7-4fd2-bc24-f2b5f31eeecb", "value": "T14EF3E601D4508B6BC6C35BBEF755A2CE73725E986F873306C719BAB027D06AE5E2D201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263725, "uuid": "617a6f3a-020a-406f-b518-83f86a09b7a0", "value": "3072:Cv+azlAqsJt/oxSMpJKH+kpP6P510FwBf75rzOVayzz4oHd1N1AC9qG/MomyotqG:K+Py5rCVaYf11F9qMMomyotqauUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263725, "uuid": "80955345-7304-4cb7-8faf-a4f61b88f426", "value": 164079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263725, "uuid": "954e4186-a888-4f31-8137-39fcad126bb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263725, "uuid": "b985bef0-374b-475f-8093-c18d31c99f4e", "value": "30aa5b3e7407984f8cd8475898170068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a7cbef-e176-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682213580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213580, "uuid": "70325479-5614-482f-9bb8-54b50e5482a5", "comment": "Malware payload (njrat)", "value": "007cdea0728faef26898a84ac104fbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213580, "uuid": "ead18511-2894-41d5-9106-c7c00b766961", "comment": "Malware payload (njrat)", "value": "8c2cf235f0e459daf479b493814953bf3ff5ea8fbf636ec613db29b753817e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213580, "uuid": "c2f35b75-f383-410f-8535-17de6a69ea9b", "comment": "Malware payload (njrat)", "value": "9e287465ead2e8c2fba4ccd836f846d5b4b31b58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213580, "uuid": "aa919c0c-02cf-43d0-8031-639379e31953", "comment": "Malware payload (njrat)", "value": "616b1edfb10542ceff820190ec8f9fa90888cec820cde1ef3f84f3758496640933f68f6d1cc3c10416fd08f27a946ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213580, "uuid": "9a93b846-547c-43ae-8c0d-a955c66905e6", "value": "T10103194D7FE18168C5FD057B05B2D41207BBE04B6E23D90E8EF564AA37636C18B94AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213580, "uuid": "16805e12-1ee8-4fcd-beb3-85a3b3f2f950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213580, "uuid": "b1eb114e-a851-4a9f-8c25-ab85595c49da", "value": "384:VBTMUiDHblmJEpRGyEfBffXuKCYyEAurAF+rMRTyN/0L+EcoinblneHQM3epzXGY:PTqHpR9EfBfWKClEHrM+rMRa8NuIot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213580, "uuid": "73981ca5-62e9-425c-ae23-e610572f73a4", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213580, "uuid": "d164323f-8391-4bd8-ae6a-6e622f4ae18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213580, "uuid": "33dcc6d3-fa35-4ee0-b636-9aee46764d1c", "value": "exec.crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0103a56-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259173, "uuid": "38f9bb60-b90f-4ddc-a4ef-8f7add560ab7", "comment": "Malware payload (Mirai)", "value": "33078547857ed89015a0996baba63e70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259173, "uuid": "c15a6cbb-7b68-478b-91aa-824a26744f4d", "comment": "Malware payload (Mirai)", "value": "8c808dd826dbc1d4ce1346fa3f80f45aec4facddb4e8de9feb72649eac010169", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259173, "uuid": "c4fe782a-cf1a-404e-92a2-af70adc4b8a7", "comment": "Malware payload (Mirai)", "value": "b55bef5f0e900e67b2785f2074ff6b6f9da28043", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259173, "uuid": "2adebfe4-eff5-48aa-8e9d-c5a1edb22a43", "comment": "Malware payload (Mirai)", "value": "884ad64bd740f65ab5fc293bfae42bff2921e0ec2ff578d25ee61351969ad9c5ced2409a0641b6a9e19f1ddc01e4ef42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259173, "uuid": "2e408258-8554-4000-b058-ac073082f12d", "value": "T1C5D33A46FA818F13C4D5277ABAEF42453332979493DB730699289FB43F8675E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259173, "uuid": "e31b298a-773f-4cb8-854f-3a98348e706c", "value": "3072:B91/oiI0Or1ugFZNKbWiVBh+vvPrpyb+kT+Q8A4M/9lEeC6Zfc:P1/oiI0Or1ugVIzBh+vvzpg+VfM/9lE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259173, "uuid": "d099c720-10d9-4291-8f07-1521122bcfaf", "value": 131469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259173, "uuid": "fcf08160-a680-4f80-a05f-4e8c7e987dbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259173, "uuid": "44646512-1cf3-43f8-832a-f9719eb36fdd", "value": "33078547857ed89015a0996baba63e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8dbd0b-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232428, "uuid": "5d58970a-dfd2-4707-a9c9-521f6b38457d", "comment": "Malware payload (Mirai)", "value": "175d59d91580100693e36b058dee7f8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232428, "uuid": "0cb09664-7f6a-4449-8f5c-adcf895efafb", "comment": "Malware payload (Mirai)", "value": "8da9d6527ab058f627f9fb635c64e3cccbe944a2281d4a1aa184b0469d3b8ff7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232428, "uuid": "6faedbef-6880-4dba-93c7-7495a1a24796", "comment": "Malware payload (Mirai)", "value": "62c9d3c8fc031f72c2a48ad32b09a6a608a46a4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232428, "uuid": "3cb70cfd-4f59-4fe9-b270-c30f0bbe35ce", "comment": "Malware payload (Mirai)", "value": "4dc085c8d44dfe6fb1481abb6565e69f754d15c9a68a9097ef9dc9501f86d65b22c8a2817ce7d9f62c5fb85d55e407a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232428, "uuid": "d9707e2b-96bc-4edc-9db2-02efce4e2e60", "value": "T1CBC2D1369C47ED37D2E81C34E97D47C622D506FEC0AB30624568222CBA8790BD5B82DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232428, "uuid": "e532100c-6bd4-44a0-abd4-9735b0012bd7", "value": "384:bhmEt2HC5yIuqDhHFWUpz5fylESo28wOqgHVIs+oDBGKSUyFBgRywh4SG6jGhym/:bhFtjuGhHMGAn8wsDtkgRbCGjGs3UozU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232428, "uuid": "42cdeb5f-bd85-484f-b3a2-9f0f8f27b5e5", "value": 26920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232428, "uuid": "e0811fdc-ed04-4eb9-8451-cf1d4a7df805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232428, "uuid": "5805fa11-ffb0-4c6e-aa81-3a828f426763", "value": "175d59d91580100693e36b058dee7f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d25e6e1-e1a4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682233157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682233157, "uuid": "48658386-4d00-4025-be9c-24ae8838796a", "comment": "Malware payload (Mirai)", "value": "7cdaddc2e340b92a06bab492b1483483", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682233157, "uuid": "0a37b14d-0ef2-4436-a2cb-a8849d8b90bc", "comment": "Malware payload (Mirai)", "value": "8dbae080809bf6f09d1fb8f7bfe6117f38831bb3d8db7d83c460388219301eca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682233157, "uuid": "823853d1-c01b-45f5-80da-873dffdd6263", "comment": "Malware payload (Mirai)", "value": "33be67c30ed231be976483ebced7efcb08bcb442", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682233157, "uuid": "b70c1830-5442-4f50-b744-40f1ac3a3363", "comment": "Malware payload (Mirai)", "value": "6d0ceb0540fe5cb2541c984b97e24cd8818f4cffd37d5487f5cbfe03f6f6b86d91f728f234b49ae3ef5a0facf17c8da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682233157, "uuid": "abde563b-f609-4d2a-a6ab-c9f7d4507522", "value": "T115437D7AD42BAE90C04542B46429CF741F73F2C443A27EB66F9185B6508BDACF909FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682233157, "uuid": "c2a650f4-e068-4f33-9032-92714577e607", "value": "768:zaxY1wtU6JJZKvlKgxexuxe+Lw6/wXgGSVGQ/6F4d7n/qGCpoJvFC1CM6wzjp:za61wtvXROBRUQ/6edj/qGVJg1CMT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682233157, "uuid": "5a11c25c-8b19-43d2-b84b-c5934333b8be", "value": 59816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682233157, "uuid": "5453259b-0d1a-4b9a-9a3a-6972abf483c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682233157, "uuid": "746e30d3-4154-43cd-a25b-3d27777a520e", "value": "7cdaddc2e340b92a06bab492b1483483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a741d63b-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682263775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263775, "uuid": "52e49ede-d340-4b08-9fd1-2b02e8862f86", "comment": "Malware payload (Gafgyt)", "value": "3cab7f8cecc4c90a3cf5609e372d9c9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263775, "uuid": "6bea3e7e-8158-400a-b1da-8201b495ca63", "comment": "Malware payload (Gafgyt)", "value": "8f11ed2a4e80990113ceebb2ce196739aa30f8e4c83a41f0427d9c717762138a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263775, "uuid": "74d95d1c-a0c9-4b40-ab15-7d71422354c7", "comment": "Malware payload (Gafgyt)", "value": "0b191b78aa39d378634a21e4db902d377d1140a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263775, "uuid": "ab684e8d-f2bb-4c61-a9cc-11546f5d01a5", "comment": "Malware payload (Gafgyt)", "value": "b5dcc007274a76aeee6cada87b775d697d0874e5ebbcf2662835b26dad3978575d800156043d8f3ac3a2aaea6ca965e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263775, "uuid": "8fd18cd8-54fc-4215-b8f2-fed794adc813", "value": "T1B0E3F801E9504B6BD7D3ABBEF74562CE77719D982F833306C71A79B027D06A96E39200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263775, "uuid": "e16b096b-0741-424b-a18f-53974b1e66cb", "value": "3072:8vbJHGtcG7jLq+rO6I39G3ci0QWBapq0y6zZzH4eXcB5t5DYuXv5HEXA+QXfEPQT:8vbJ+zH4Ck5tpYuhkXA+QXfEPQA5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263775, "uuid": "fe1d7d36-a8c0-447d-ad68-556a46135c47", "value": 149171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263775, "uuid": "271d4783-2285-42e9-a268-aedbbc77871a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263775, "uuid": "73a87ea3-9c88-4fca-9520-3d59472156c0", "value": "3cab7f8cecc4c90a3cf5609e372d9c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e429af9c-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260871, "uuid": "05c0a757-ea77-4611-a058-18718da95c89", "comment": "Malware payload (Mirai)", "value": "ef72d1abc2854b0fc5821c9682f296da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260871, "uuid": "822d860b-49a9-4648-8aae-91ad6114d935", "comment": "Malware payload (Mirai)", "value": "9258ff49dacc38b84126bb5f72515206dc78705db0c5d02c678873e728da30a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260871, "uuid": "b59ed814-2d05-4811-bba2-aec7a150864f", "comment": "Malware payload (Mirai)", "value": "c0bf3a04d98f84dd0b09f65904f6f6bd1f71de65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260871, "uuid": "83ab0ea4-a650-428f-867f-de20e0d3cb12", "comment": "Malware payload (Mirai)", "value": "cf696eadb89b15b0639166c57b913943d4af00639427665315f1b3128ea1a1c50676883e8c8ad91364a39673a284c7ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260871, "uuid": "d4e8f972-8e33-42bb-869d-ad127ac36c56", "value": "T183535C9AF5029E7DF5CBEABD41220D0DBC20621190A30B27BB67FDD37D72168C916D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260871, "uuid": "42d38c1f-d1d7-4b48-ae33-66f1a121be1d", "value": "1536:KPWx198TZSXi5/0Yo2SU2dTFli2KWG00a6p1vCUaW8aT:3x9J1VpcvVaiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260871, "uuid": "95fd4644-d0ee-4a8f-b2fd-9c111d5b9e2c", "value": 64412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260871, "uuid": "be693c1c-0c3a-4c27-8b87-a8ba4e4d35c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260871, "uuid": "d9846477-3dd4-4bc0-a080-2e2b7f879c8c", "value": "ef72d1abc2854b0fc5821c9682f296da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f356b892-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259178, "uuid": "8e09ec27-72ca-4c81-9fd7-7f0c989b1e0f", "comment": "Malware payload (Mirai)", "value": "68cefbfcc2adc71bff81ecd300090b78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259178, "uuid": "7ec80f47-2a9f-4ed9-9579-3505a1d380c5", "comment": "Malware payload (Mirai)", "value": "92b221f5cd85d951f1759471bdbc305b822f2dcbdb342a827147d1a1df691202", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259178, "uuid": "702079d9-d60a-44af-8eaa-6b817fbafd8e", "comment": "Malware payload (Mirai)", "value": "cb580534016821c3b972e290b7b9323bd04191b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259178, "uuid": "d8fc90c3-c3af-452c-a041-b1f25b35f34b", "comment": "Malware payload (Mirai)", "value": "cb693f826446562fe476a7cdac8f595b76b9ab23e00c291a1cda583fde7ffaa30655dedd55ee51d2ab4223c8ee94f771", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259178, "uuid": "b00f2d40-2695-43b7-ae16-3706dada4e2c", "value": "T16163951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259178, "uuid": "3edca091-08cf-4297-bc50-e589509ff031", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAv:UnN4ZH2SyOyuIq8LMzIUq+cvtpvXz1L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259178, "uuid": "a8ee7a0a-6869-4295-ac5e-c894ac67dcd3", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259178, "uuid": "ee3742af-8227-468b-b92a-b24174ff0586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259178, "uuid": "4df636cd-53d2-45ab-b412-0c7aea3bec3b", "value": "68cefbfcc2adc71bff81ecd300090b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06cb247-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682264730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264730, "uuid": "bdd4d84d-0089-485a-97be-61b6bcbe8442", "comment": "Malware payload (Gafgyt)", "value": "fc7c6717fb1cd3f620e2fe7c215a846d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264730, "uuid": "229012d4-0761-4f11-bfc4-7b25909c550b", "comment": "Malware payload (Gafgyt)", "value": "9345189a5153ba4428d9300b687960d0efb1eb2787cb57b51b56e992e4c7586b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264730, "uuid": "9649bf29-c882-4c42-afc1-c0267cf8fa93", "comment": "Malware payload (Gafgyt)", "value": "338e0e2624ac2baf20ada22a0ef5783fc94ee35f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264730, "uuid": "5823af45-040a-4818-b500-3d32d629d672", "comment": "Malware payload (Gafgyt)", "value": "66cee5326a826e2fc3d95dbdce3f950ca56bce31b2b80825ac5b81b91e509237506208fe2dd52f3ba071ba89135e26de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264730, "uuid": "501f9741-d7fd-40ae-9615-ddb1160fd68b", "value": "T128D3E701F9104B6BC7D2ABBEF745A2CE77719D982F833306D71979B027D06A96E39204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264730, "uuid": "5bd5ec6d-c959-431d-a21b-01a12419b66c", "value": "3072:MwbdrGtcG7jLq+rO6I31G3ci0QWBape0ypzYUXUEyZd9L8WlQNukHPNmyXVHDLdf:MwbduUXUEkLbqNucXVHDLd/kQcHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264730, "uuid": "6045182a-8811-4d17-8309-5bfd0a0c8666", "value": 141625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264730, "uuid": "26027677-6423-4716-9340-e2e1388586f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264730, "uuid": "4ae22f15-11d5-46b9-acd4-0d1e642c0676", "value": "fc7c6717fb1cd3f620e2fe7c215a846d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6617372e-e1c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682247775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247775, "uuid": "28f61136-9731-4c9b-8f57-384aa9d47835", "comment": "Malware payload (GCleaner)", "value": "5d1a25c5e840e0252a095dcdec54ee4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247775, "uuid": "0c2ef14a-6a63-425a-9b6a-0b50c2331383", "comment": "Malware payload (GCleaner)", "value": "938424ea7842153d48d5b7f2e23b51f4f3a8beaf9dedc7251bb6ad57bfbde23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247775, "uuid": "265d77e7-0cc0-4c4c-96a4-c76d40210483", "comment": "Malware payload (GCleaner)", "value": "aba5f7e8ccd1ef9204cbf54280235a34ad25a411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247775, "uuid": "76a64a7c-5223-4af7-a877-f60cadd9637a", "comment": "Malware payload (GCleaner)", "value": "4893313e2d2a03429dd403658b542291e0f3e0b1a174bb21b23515ab678267a6a8920901039bf0a01802f9032b5b5941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247775, "uuid": "6de9b33a-c630-4638-a52b-a91b9ac0b8f4", "value": "T1D6E5332A47E2A435D131DFB92DA7CB65D22F36540D3C922CF1EE09AE4F3675192807E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247775, "uuid": "f9d485a9-52e9-435e-86a9-507d2ce93004", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247775, "uuid": "8b5fee89-135d-4a8b-9d1c-33590511719f", "value": "49152:zGlJfsZDWVU9RPkqJ9pLMIc69aWLAZggmVjKFrjJDneyZ0l/vY8aYEyDcUwyT6WQ:qHVU9RcqzVMC9xA1mefNU/vY8aYYWSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682247775, "uuid": "7da4bb32-002d-46f3-8ce9-d52cfc3cbe97", "value": 3115654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682247775, "uuid": "71c5bcb1-7fc5-4f07-8299-056de566ce1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247775, "uuid": "2d8f5b1f-0c34-414a-93de-913f4775c363", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af94d6c-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266305, "uuid": "0cd3ab4f-6ef7-4d9a-b6de-2c258be5bcb6", "comment": "Malware payload (Mirai)", "value": "1a97c9f88b691e34e8abcdb1bdd2a60c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266305, "uuid": "34285733-3e6d-44eb-a1d1-6fabea18a43c", "comment": "Malware payload (Mirai)", "value": "94704de1e15492dd79071809212f0629e2b09532ff44952e67ce2978db0446f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266305, "uuid": "dbf0d2a3-1b52-4b24-8304-50da85fffa97", "comment": "Malware payload (Mirai)", "value": "45ab1d6647ed6e41ed84839aa8a3e800aa855371", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266305, "uuid": "46516d36-0215-43b4-910f-4a34069ede73", "comment": "Malware payload (Mirai)", "value": "51c91ad994123dcf12f9ee3b5171c6e94612f81c6a899cd898e019aa0acb0e6e9cefce8f3b99f58183b05e6927323a56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266305, "uuid": "1fa2e242-e269-4bee-b5a0-9b7cf5217ca8", "value": "T1CB13F168DB8D4FB3CE7EA67410A1DBF57B14363F975B8EA40A6EB52152030EAB1408D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266305, "uuid": "485acef3-9ea7-476e-87c9-825a6e454d50", "value": "768:q0VHgDN2BWhIq8SOYC4pTIdexvlnwplmB3vo4uVcqgw09a:q0VydOD4hqt34u+qgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266305, "uuid": "ee59a8f6-1c3d-41b5-94e6-b7b8bb507326", "value": 43172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266305, "uuid": "6e921cae-1d34-4919-ab25-d4b3c036ad8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266305, "uuid": "4d209a14-3fa2-40be-a7c6-f6a247a99255", "value": "1a97c9f88b691e34e8abcdb1bdd2a60c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff722dd-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266367, "uuid": "277a5e71-e63e-4459-b56e-31dae3e12b5b", "comment": "Malware payload (Mirai)", "value": "e3132cc894636fc081578138b8da1c20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266367, "uuid": "228956a2-1720-4bd2-8664-6ca440c0924a", "comment": "Malware payload (Mirai)", "value": "94a01a30af390acbc73c9cbf5dd81a2a9bd831288fc8b2aeb68b4b74d93042a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266367, "uuid": "a7fab166-6a72-40d2-bbc3-d0b9683a0b14", "comment": "Malware payload (Mirai)", "value": "2f5a1b91ce1e5631f8a3fbaf9103dea76469e14d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266367, "uuid": "0650c439-2745-4f22-961f-fbcaa7f1e7a5", "comment": "Malware payload (Mirai)", "value": "92262e2861673afd3a859047ec0adbc545cbca69f6ebe9ea2183e35ba016e8bcb3d6c8c0def14c5020e8f2825d53f356", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266367, "uuid": "2ffd3a5e-89a2-47b1-a7d1-6469f9cb0405", "value": "T1BD23F1FFF7C8A6DACF2C09F82A5E1694650C578479FD5B2C53621808B03A5DBB2198B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266367, "uuid": "c4775da0-3eea-4491-907a-882e729fc259", "value": "768:5zVZHXaHTmXG8aVJ/Z63tUeP1Ci+MpD3b459uwy063RhRPNyDajqTx3l3WV:5jKHTmWv/ZatUAdrM9mhyeqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266367, "uuid": "8a903c79-5a8b-4188-a6d6-e78481a60aad", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266367, "uuid": "9ae944c1-2284-46cd-b8c1-ee73ea5be047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266367, "uuid": "737f0a43-d274-4ce5-9b22-ba32a5b0551b", "value": "e3132cc894636fc081578138b8da1c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7b44a2-e1c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682247889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247889, "uuid": "cc5408fc-21c3-41b4-bb0d-ff4e4f79a3ea", "comment": "Malware payload", "value": "f75a9cda94f6eea42c8ac6ff7de77bf0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247889, "uuid": "5ffec9c3-123f-470c-a895-93de92c0c077", "comment": "Malware payload", "value": "9572db826cd8eb447dd13140142c82f9dbfe6a677cd888bae0f0f3cf380ae2ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247889, "uuid": "b86924d7-8806-4ee9-81b8-000861c758ae", "comment": "Malware payload", "value": "dc529fcc762e651858917fd0b99534fcf9c251dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247889, "uuid": "d84a8bd8-9024-4321-991c-2da975b04f41", "comment": "Malware payload", "value": "883424c0b8f761e82e8bcc9a494f5604058f351048f10dd10dceb37e9e40cf65437ab8de34972673e561c2f38941cba9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247889, "uuid": "7935a474-e02e-41ce-9f22-8ebdfcc5ec5b", "value": "T186445C2EB98465B3D1E3063AC9F4DA010C1DFCF13760B9DB56AB299A74A30F25C3465E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247889, "uuid": "e2f222d8-552b-4594-a981-3730369a0125", "value": "6144:lcytwbj1yTS+xqqDL6HKngIpxIp8mDtfPBRwasxX:Cyij1Rqn6qngIpxIhDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682247889, "uuid": "6172f90e-d462-4ce2-b177-2871a4f4a85d", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682247889, "uuid": "ed436271-5ce9-4ba5-9cee-374e965372e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247889, "uuid": "b00f28f6-4dd8-4e16-b45a-534b86e973e3", "value": "2023-04-22_f75a9cda94f6eea42c8ac6ff7de77bf0_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61ffdb2-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259183, "uuid": "0602a7d8-bcfd-40ac-852d-eacf5fbd6236", "comment": "Malware payload (Mirai)", "value": "1f7a3f96fc11865ed4b102dfd7d9c285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259183, "uuid": "f3001cff-463f-4141-9141-52de80e33fbe", "comment": "Malware payload (Mirai)", "value": "9640910988d1b2a4a265bc4630798b632aef652d42afc921166fc12b1ea31e46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259183, "uuid": "e2f94fab-d3c3-4476-af0a-b89b6482f0b1", "comment": "Malware payload (Mirai)", "value": "fcf8a8e406ca982fa9e63c0e797da5c19ce6ec22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259183, "uuid": "634e0b3a-73dd-49bc-ae58-31485f111ba4", "comment": "Malware payload (Mirai)", "value": "e511500d350cb424f41273117f1921fe8d98633e82d8994ca7366986fd89b1f8d2e731811a815b4b1f9ffa93ea42f605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259183, "uuid": "9854a28a-f720-47d3-8531-caf56ba83ee3", "value": "T1AE433A31BA362A23C0D9A4B951F78B15B6E156DE36E4C21E7D720E8AFF106006553EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259183, "uuid": "a7276af6-0d3d-432b-b254-406c2bcdfa1d", "value": "1536:knpq6t7Kmsat+nLgtg1iSgo3L7FTSq0ryYC6/CzTnTndluN:CNqey+AzXuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259183, "uuid": "da24d945-988c-45ae-9334-b898de99a6d3", "value": 59968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259183, "uuid": "db8bd6d8-5157-4f4a-ac61-b05c1f27c85c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259183, "uuid": "c82ec11e-9fb4-4151-ac3c-77eef98df79d", "value": "1f7a3f96fc11865ed4b102dfd7d9c285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f2062e-e189-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682221822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221822, "uuid": "23d6e455-6cb3-402f-ad4d-a1fce79604eb", "comment": "Malware payload (DCRat)", "value": "ff7851e8f7a952b18b60d073545ed4d6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221822, "uuid": "93d845cd-80d1-4831-9f26-d37305fa2296", "comment": "Malware payload (DCRat)", "value": "97689430b1de91f70ca84a646eca6695f91baff0dbffa1ddcd0e509b9eb22d89", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221822, "uuid": "bca6831b-7b98-4bc0-b566-1b5b99c575eb", "comment": "Malware payload (DCRat)", "value": "ec9f150ce8d71d108f59d6c39ff8d2199bd7b3aa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682221822, "uuid": "56f6b7c1-bcfe-4865-a9e0-67104fa1cbd0", "comment": "Malware payload (DCRat)", "value": "b4b0750cec89fcd0dfdbb0ea8054d11940431aab10f0c7d665f03cadabcb9cab34f3720febd527f20eaf6daf4dbed4bf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221822, "uuid": "7d65b741-45f3-4b5c-8980-cb7e39cd1a95", "value": "T189050605BE44CA91F0185233C2EF494887B0AD516AA6E32B7DBA377D65123A73C1DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221822, "uuid": "18e22d29-8e17-49b1-a5ba-95bacd8b79e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221822, "uuid": "00e4b56c-20b9-42f0-893b-45fb132efac7", "value": "12288:ZNpPvAW8J2PZ1HUYFDRdPT7KR33KHFCq4v2saVzQ:Z7PvAwPZNUOP7m3KHFCqeQNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682221822, "uuid": "d18e892a-3e74-4664-836d-cd7661700fd5", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682221822, "uuid": "59ebfa1b-566d-4587-91f5-fadae961d5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682221822, "uuid": "a2575030-9915-4dfc-b5b9-c6a4f44798d1", "value": "97689430B1DE91F70CA84A646ECA6695F91BAFF0DBFFA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf4ba85-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682257854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257854, "uuid": "eb2a0a9b-d641-4c33-a6e2-44a98f725636", "comment": "Malware payload", "value": "59cd7fd72de8a8ad2ecaa61311869ca6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257854, "uuid": "90b98d19-0c32-4531-8794-b05fac9753b0", "comment": "Malware payload", "value": "9915528d663fd608ca5b3e5256c22dea70f8423258d1252caa7c6d1bf6722f1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257854, "uuid": "028afd44-4578-43d8-893d-72cb9510dbbc", "comment": "Malware payload", "value": "c3b126a5db8a5fd8754e5c84f7997a55ca37f01a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257854, "uuid": "0f858d0d-9087-4f11-a655-4bef44307f57", "comment": "Malware payload", "value": "385bedb3e81cdf6bcae19c1dd2d67229a3606e9cd85ca852d04c4fb51d7217b36b1aed2c96303f488116989c92b177cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257854, "uuid": "9b95b131-2bb3-4a7a-a51c-a7f4db9211db", "value": "T168C3095B571C0F87C4D795F02DA737F18769BA7102AB11C2990BAF8043B39BA2523FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257854, "uuid": "6e392169-4bf0-4450-941f-2b37f84df1ac", "value": "3072:Dy0xjOU8x4H6wlReuJ49W7V8aBF+mm2/0lLuysVYN0:Dy0xjn8i6wj3J49cGM+mm2/0lLuysVYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257854, "uuid": "d3fe53fd-f638-4d48-bc3f-b1d228c7f7a3", "value": 124420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257854, "uuid": "59945a21-549b-4504-a9ea-a9e697bd3fab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257854, "uuid": "067a1926-fbbe-4c26-8b40-df9ccbdcb307", "value": "59cd7fd72de8a8ad2ecaa61311869ca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2266205f-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259257, "uuid": "8c388d25-9865-4316-8f26-6d45b9e611de", "comment": "Malware payload (Mirai)", "value": "53a264a616880f4f4ddbc9f0d6c0ab1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259257, "uuid": "adf23975-8e68-4777-9870-4f718aec8c25", "comment": "Malware payload (Mirai)", "value": "9a70d04d79d9ef222610e3414d4248aea9ae975c75289894c4617d6dddd3cd0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259257, "uuid": "5e55d1f7-9962-431d-b0ea-491cdb84c9b8", "comment": "Malware payload (Mirai)", "value": "e809974bf5aff2f9e3fd3c86dfcfe62ef9ef4dd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259257, "uuid": "0d6394d1-8a7d-4f79-ac9d-af0c003fc4ed", "comment": "Malware payload (Mirai)", "value": "5e0f59a464daf8ec717d76b138bdb86ca1cbdf31e71c6faec3a05d2f3486a8b80ba52066938cce4c261ecc254370a742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259257, "uuid": "5403f861-0f85-4375-a626-c95edfad5180", "value": "T16823029291833D03F4A418FA40934D9E77CBE67463BCB42B1A8A8F1E1ED68C6DD75885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259257, "uuid": "cc6ff161-b7e5-4af3-abc4-8dde3bc2fbc8", "value": "768:6K7y1XGOSKausPuUWMSd0aqjSnQT+nY9LPZMN6Mr9q3UELWt/iw+kvBGg6+fYtrA:k12OKvUMjayfoY9LPZiKLWhiw+kvBGgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259257, "uuid": "9964bdd0-d66d-446b-b22b-90e12f9b8a0c", "value": 48688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259257, "uuid": "5491218c-7dc5-48cb-96c8-0974038fab1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259257, "uuid": "77389b58-48d3-410e-b090-e45249656cf2", "value": "53a264a616880f4f4ddbc9f0d6c0ab1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c428c3b2-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261676, "uuid": "d6e024a1-78a3-48e4-97d3-d11a9a21ecf6", "comment": "Malware payload (Mirai)", "value": "bd7687749a8540e58f2f4ab5f52406f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261676, "uuid": "097d2322-3cf6-4aed-8723-16e0088f3ed9", "comment": "Malware payload (Mirai)", "value": "9a86ef769df900aaa28fb7e65cb8e5dd6c5b1765bd1a84da1df4109a278debc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261676, "uuid": "69b231f2-279b-4b76-9e29-2a01ee484e6c", "comment": "Malware payload (Mirai)", "value": "3d749ab8a19c7c53786ed93ced7d86ba8f08c11a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261676, "uuid": "d9e007c9-bfb7-47b8-b232-a6af8de15e26", "comment": "Malware payload (Mirai)", "value": "d0af2ec54dd0cc2ca98329195c73dbc042bf1d419113643f35710487979d5a4ea1a2cb49bfcf5f7eaa4d01e4729d0df8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261676, "uuid": "e9b3258e-590b-495c-a0c8-676ba9caddfb", "value": "T18CD2D09DFBD86E5ACD4D7E78800F076019E831A156660B0C13164D8CFF25D8BB54D9BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261676, "uuid": "45276239-5cab-4df2-b847-1e60541381cb", "value": "768:8sM2w2pp0MHr3CcLGt/fpKTCt1dqxXWWx:84wkuMHr3Qt/fUTCtaxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261676, "uuid": "55bd9941-2ec5-42f5-afca-25687b8d768d", "value": 29344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261676, "uuid": "9ea89a0a-489d-4887-80e9-a55f6811bf1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261676, "uuid": "9de3af43-6bc2-44f7-94fc-4d4f573c7e1b", "value": "bd7687749a8540e58f2f4ab5f52406f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca006c57-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264693, "uuid": "1d6062fc-375f-4fbc-9821-12a9db10e7ff", "comment": "Malware payload (Mirai)", "value": "173142e9eb5e66be4dcd2cc0c664ab57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264693, "uuid": "c66fe84b-5e9e-474a-9d55-15e18de8adfe", "comment": "Malware payload (Mirai)", "value": "9a873689f880f1ea4f586c1dbd8ad146e7d8346d245211bd574bd7f1c25fdd3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264693, "uuid": "0d52391a-75b7-48f2-8ec1-8bd7b653ae1d", "comment": "Malware payload (Mirai)", "value": "24398d0b0d53afe1c86170c0c2497a4d72d4d79a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264693, "uuid": "3d00fb8c-3958-4b46-ac8f-9e969b6b3547", "comment": "Malware payload (Mirai)", "value": "2e701a9333c6f6f8258d4582f08112f7c5634f0d23cd45836e70979f00f1f28d95e11f060761069b2329bca366238198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264693, "uuid": "7644c07e-5112-4f8e-9cd3-0a643c012f91", "value": "T1E1049E3AE01DE694C5128238E8F95D790F127048536B2DF75ED284A7009BDB8F7167EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264693, "uuid": "1d14ee51-cb37-4fef-80e3-1cf48c1599b8", "value": "3072:sh8bxatyEqbHvHLwmhRzYv8fQFlzqZv+PFfQ8v4fffZyBQkZJQ+X4f+v1HGO1dI3:shgstJkPrw+zi8fggZvWFfQ8v4fffZye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264693, "uuid": "d703fa62-159d-4c0e-8585-8ec037605405", "value": 177144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264693, "uuid": "3573f2e5-208a-4dc8-859f-99ebcea01286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264693, "uuid": "29bfd278-45be-4203-acaa-a5b61fbe345a", "value": "173142e9eb5e66be4dcd2cc0c664ab57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a0be39-e1cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682250111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250111, "uuid": "c7f7309b-1a16-46e3-a10d-c67c4e4be340", "comment": "Malware payload", "value": "bfbff3e7a0dfdec44f7a2ab52079cfdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250111, "uuid": "cf31ebe4-bc25-4c28-8c91-fff6cf813e60", "comment": "Malware payload", "value": "9b0da3cc4aa62aae34e78ec51141088518321b0ae3cd48fca8c7807abd33a3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250111, "uuid": "2bed89d1-c963-450e-8f10-8d64bf7ba2cd", "comment": "Malware payload", "value": "3c1a2a80089a2103eb868cb0e5a9f2237421fb87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682250111, "uuid": "879218e9-08e4-422d-b598-2bf917b9b7ef", "comment": "Malware payload", "value": "aed781b46b6bebf1ea9da33e97b939034fe0b0dbd379f72cd4c285406fe1bbffca6f30f6670e7588671fec942b02f46f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250111, "uuid": "a489b0f1-5c5d-44cc-aa4e-122c1c84794d", "value": "T133E5E09C72A072EFC867D472DEA81C78FA6178BB931B4217906715AD9E1D887CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250111, "uuid": "5d7a8478-cc89-4ac1-a8b0-d856e032df35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250111, "uuid": "adb16a6a-fda2-4eb5-a9b3-fadb7b3d7935", "value": "49152:cfBgDUzm5AdgJk1EfHUno1iVS7OCEKcWrBicWNg8R9QRjoPoTCK:dAaGgBMYiVbCZCH6fTCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682250111, "uuid": "8232950f-e98c-4f22-8c7d-b2a816952e80", "value": 3132928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682250111, "uuid": "749ac6a5-ecc9-41b9-91ac-4aa049ffe9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682250111, "uuid": "9289f5bc-3640-4ff5-b8bf-8f0ac0369a65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3bca13-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266332, "uuid": "0d8a9b94-204d-495f-9301-6df2a59b4513", "comment": "Malware payload (Mirai)", "value": "3aca8a818eb9169363e88b8a37a59f8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266332, "uuid": "f6abe2d0-c7d7-432b-9580-2322ab167db0", "comment": "Malware payload (Mirai)", "value": "9bad1a4b4ab3fa0ec21f44ec6addacfb8fdb611fb440b265f535ee30db5a65f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266332, "uuid": "6abb2e75-cc02-49d8-a56a-06d603d2a261", "comment": "Malware payload (Mirai)", "value": "100402ef9beb1602c7e9cbc5cdc1e61c01f5d8d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266332, "uuid": "6f1adbd4-c1cb-4535-895f-f0e88cbbece0", "comment": "Malware payload (Mirai)", "value": "4d528a62b43268625ce9c264201c559b4df855f9356d092c31224b37274d56475df37ab124fdb0954019360df2a60a26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266332, "uuid": "bf4bd51a-d562-4445-8048-8e0e7572137b", "value": "T16A630230D625D8914D924BA161F8CBFDDF2C5B7B6119309C21C526BCFDEC48A62DAC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266332, "uuid": "12d5ae39-87a0-4a7b-bbc1-81ac3ad15201", "value": "1536:COFwK53EkRE7TE60aq2eXWYr3vYzZGTPm9LGsCEhi0cCPzJ8:COFwpDfE6FReXWqvYIkLVCDnCPt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266332, "uuid": "a89e97cc-ee8c-4af6-aab2-102a90f9c5fe", "value": 70916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266332, "uuid": "89e61be8-6c5d-4db3-9e00-7e19c2c058fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266332, "uuid": "0d04f5f6-8963-459f-a373-086a2929c3e6", "value": "3aca8a818eb9169363e88b8a37a59f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c6d096-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260949, "uuid": "1f11e1dc-3c36-44b8-b2ff-4b2f9bebe174", "comment": "Malware payload (Mirai)", "value": "e513d5dc5965d67d146f03098270d258", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260949, "uuid": "d6dfe964-fe6c-4cdf-aaf9-1615f8a17059", "comment": "Malware payload (Mirai)", "value": "9c1f241e04e0d78852fa204058085eac3cad7aa93e63b4bcac9c9bde042c1b36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260949, "uuid": "6ed6b8cb-09a4-40f9-a28c-214f6f38c3e0", "comment": "Malware payload (Mirai)", "value": "7023f115f48785dc38082ee1d2bcea4041bf3516", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260949, "uuid": "a0e48865-280f-4a11-8acb-198904e75db1", "comment": "Malware payload (Mirai)", "value": "b0d6b0fbfaa16f8223206ea24a4221c15bfa1e43fdd565a26d9b5731e48da73f65e4288c39be56bcf4e2dfe294f48c85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260949, "uuid": "4cf46c74-ec79-4a04-90fd-9cf4c05f57e3", "value": "T120D2E1AB767ED4E7C458F0316F57929399506464F13E7A367A88E84383F7074CE228C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260949, "uuid": "28f42614-99a4-449c-a90e-a7c56e49ccd5", "value": "768:vNY1uxLEITGQMsU+xxD74+IvLlp00o8s/w:vNB2Q8+xYp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260949, "uuid": "bfd39b06-c898-4dcb-9be7-04369ad91851", "value": 29116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260949, "uuid": "204a5d62-5a50-4130-accc-70c2bb65b43c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260949, "uuid": "7c5b1749-aa37-46cb-872a-324630144f8f", "value": "e513d5dc5965d67d146f03098270d258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c1295f-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258372, "uuid": "37fb6ba8-1d37-420d-844a-3bb3e3fdcf56", "comment": "Malware payload (Mirai)", "value": "58347dea473f7c9f98af36a0e56234aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258372, "uuid": "8b0e708f-31b3-4b1c-a880-388a493303a9", "comment": "Malware payload (Mirai)", "value": "9d02338992933a7282544e3d72b92ce0ad68f19117f33abd010eac2c1d4fbb58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258372, "uuid": "388d23d6-07eb-4387-b8a3-f25064dc7267", "comment": "Malware payload (Mirai)", "value": "0f189549a43ff2a5cddda77172888687e4bca175", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258372, "uuid": "9a078f23-6374-416c-88b3-680dd9c52d30", "comment": "Malware payload (Mirai)", "value": "6ca88001b9b7fa9565fc0ca4b2e0174f65c5e71e10f8c081501402d1d0e5ed145babbfb29fd6d6ec461de81b679acd9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258372, "uuid": "59cfe050-732b-4afd-bcbf-9308a86dc1a6", "value": "T173430851B8D25A26C5E4227FF9AE408D372463E8E1DB3217CD216F507BDA81F0DA7E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258372, "uuid": "3b52c96f-2858-4d39-ad98-8d3ceedc3723", "value": "1536:QI01c0lUO7teZO20Fe8/gs5PDRhOjfdR5M5ChQ:QI01ceUyf5PDRArdR5MGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258372, "uuid": "8ff37370-a5bb-4407-85e8-5416a918a4ae", "value": 58360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258372, "uuid": "d1c53338-b757-4333-aa56-51e7c522a4bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258372, "uuid": "50c476e2-b6fb-4a1c-b1c5-2d2aa3727d2f", "value": "58347dea473f7c9f98af36a0e56234aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb1e9d1-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232408, "uuid": "e8d40a9d-4435-48e5-a48e-7d2accbf2b9c", "comment": "Malware payload (Mirai)", "value": "d59ac9649b0d03df3aad114701c9265c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232408, "uuid": "bca7dcfa-72aa-42dc-8c96-062d4453ac44", "comment": "Malware payload (Mirai)", "value": "9d555baef36fa85fd426fd9e2f109aa9ceda2616fcfd2ae87931f48281b3f81d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232408, "uuid": "c1fccdbe-d421-44d3-80a0-175ff7e5e01f", "comment": "Malware payload (Mirai)", "value": "91da44bb7b2e67cafb02859a2bacc1d31abd0381", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232408, "uuid": "1f65c9bd-4c68-4df3-b940-4ac5301b5062", "comment": "Malware payload (Mirai)", "value": "38fb24d99b8b95e58527d7d46c40e9c78addb49d4a8d2aec593a6516a919c9e32b04e7c9cc351a732107e3ac07aa150e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232408, "uuid": "2c0ca260-d6da-4a6c-a10a-adafd9236593", "value": "T1F3A2C064A2C7DF61C6309C3B9B69CB8767AD09ACC2A5386332550F1CA6C510A19BDE4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232408, "uuid": "cafb2008-08c7-4f9c-8d17-5127331d2866", "value": "384:W+cj0s5MokSKlvD0XKFtJ9GVuatIsVJWHpZpnRDZjx+sLEmSvRPMI16kY9OyOyhY:vvEkFvD0XKFf9kuaZV2t8WEr5TQkYLx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232408, "uuid": "f72b5ce2-3563-4b8e-a934-8da429dc4e46", "value": 23236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232408, "uuid": "e43bfbc3-d2a4-4834-a12f-0e1354874062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232408, "uuid": "d1efb016-262b-4631-8251-b44711525979", "value": "d59ac9649b0d03df3aad114701c9265c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defce1b5-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260862, "uuid": "e4b6b9e8-76ba-4645-a944-3029b6a1c5df", "comment": "Malware payload (Mirai)", "value": "377b7db1fa9aff155a78cd5e8e6e5b7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260862, "uuid": "6183b230-161b-4bbd-b979-5d81f81999d5", "comment": "Malware payload (Mirai)", "value": "9e9a6e15eb25cc74c18d6c848de9190f676d98b6a14f1d656507e9cbda093928", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260862, "uuid": "baf85c29-097c-41dc-b61a-c399c5aaa1a9", "comment": "Malware payload (Mirai)", "value": "02c06185e8bb91072ac417c6eb493b7f7da7c130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260862, "uuid": "8513751d-9e5a-40ee-b22a-9155ad3d1247", "comment": "Malware payload (Mirai)", "value": "25944f820508291c9dbcf0c52e62c6aad28ecd9dbb1c947551c462bb7b4f70253f78213ad659b9a6f32255fbff90e35f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260862, "uuid": "9b60101e-ff13-4b31-8614-3b2ccede324b", "value": "T1CAA3C75ABF650FF7EC6BCC3B49E9270528CC552A21A97B36B934C818F55B24B05E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260862, "uuid": "ed1cde53-b9bf-44f3-b768-1ef65a08dd39", "value": "1536:K+l7BEWafEMu2oxot2QX/B+dVRP0QoShUw2M:KWdMlGV9pv2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260862, "uuid": "ddeb9ea4-19b2-4be1-a0a2-0987ee9c2337", "value": 105556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260862, "uuid": "46338b7f-123f-4706-bdc1-0b6f0bb69373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260862, "uuid": "d458f67a-f33e-4afc-b655-9c21004fb8b0", "value": "377b7db1fa9aff155a78cd5e8e6e5b7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfc5b02-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232487, "uuid": "2485fcf5-ad3d-4472-b548-9ce58f48d420", "comment": "Malware payload (Mirai)", "value": "2ee2478afb6ac41e32261ca9b846c12c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232487, "uuid": "0869dfaf-8e6a-47e8-89df-8303e1de217e", "comment": "Malware payload (Mirai)", "value": "9f18f8c34ceb851c10c85a317222f77a7550064b9866f871b3703e1a7f5f54fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232487, "uuid": "fbc92b99-b4d0-48cf-bbbc-5c262f17a36c", "comment": "Malware payload (Mirai)", "value": "d42ad52145a7af238eb73ca44d63b2c6c78b882d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232487, "uuid": "7070dd00-caf5-4fb2-b218-4a56e841e628", "comment": "Malware payload (Mirai)", "value": "4955e0d7e4530dc2db8400ee201f19d6dbc2a0492b1e5cba66f6c4e9d1d4cc3a28170c6851da98ed117f52961e3462b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232487, "uuid": "440dc02c-2d02-4ab5-ade6-6fc711241d0b", "value": "T1EB33F264951AD6CEC5F72C317EBC462A2FA8E3E69DCB70B7129083C454D06F112F9247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232487, "uuid": "9fbcb145-239b-488b-8fac-0b2fc44345ff", "value": "768:sPDAAkfzwFb5juN3yW2omeaTzK3lgT9d3rt9q3UEL3p+rAfNDjWSI12/oV3izGHy:RNzwVJU3ySmeaKW9d3cLksvII/EwaO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232487, "uuid": "29704b26-e643-48e5-bd44-34ae2bf28139", "value": 51092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232487, "uuid": "a3be4a62-0e5d-402a-8c96-2239b0f8ad29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232487, "uuid": "727a3433-b8d0-4152-84d8-8a25de30d168", "value": "2ee2478afb6ac41e32261ca9b846c12c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d95439c-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682258390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258390, "uuid": "1ba5e14d-9eea-4b23-8465-a7e4e6ae498c", "comment": "Malware payload", "value": "bf07e3c1f2c0fd1f74bb6ac399526563", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258390, "uuid": "af9ea410-d37b-4882-b00a-7eadf9ab1c63", "comment": "Malware payload", "value": "9f32ab2c231faf31b358e1991d4b011af4c611b5d8799a4f513f67db5f66e67e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258390, "uuid": "2bcb1902-f33c-4089-b491-943b2ac79c8c", "comment": "Malware payload", "value": "ebf47fa799e146cdd02cc5c1bc7d97a23c18ff95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258390, "uuid": "fdaf5353-90d8-4a60-926a-38e158bfc92d", "comment": "Malware payload", "value": "f1c0e617f63c03a2e3c9e8f26bfb3d0938af401c66d8d0a8ad282874809f6ab656ad585ca9da9a215daac185d78c4273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258390, "uuid": "2d56e467-f802-4507-a2d2-dadf12fe78b6", "value": "T111C3294795A22FB7C043A97929A759205726AA172F6F0F8B353D5BF8038F4CD700EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258390, "uuid": "f5a0bf22-cc2e-4934-88f4-2a22fa078065", "value": "3072:HcS5628zEqeXDeLl6bXXXbb0m+W0lY2asVFNY:Hcq628QFciXHbYm+W0lY2asVFNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258390, "uuid": "8db37d5b-fad8-4b02-b017-6c0c4cd516b4", "value": 120609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258390, "uuid": "ad15aa0f-f835-48a4-b476-1e77a361c061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258390, "uuid": "bb38a22b-172d-4e12-a7c6-2d69b8925b3c", "value": "bf07e3c1f2c0fd1f74bb6ac399526563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2a0717-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263703, "uuid": "0f167b50-be97-4eb5-95c9-68341a2e2260", "comment": "Malware payload (Mirai)", "value": "0c9cea75ccec78e388964f179cf2dd45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263703, "uuid": "0ed40c2e-fb9f-4be8-be82-96385abde97e", "comment": "Malware payload (Mirai)", "value": "9f8868333f9195e0c678ff09d6df55c63703e7cd922597e2726ad2d5edd0cda5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263703, "uuid": "7d5dc539-9596-4582-a132-0561ca2f737c", "comment": "Malware payload (Mirai)", "value": "93a620e267a489c0160bb42f81039925108c2ce1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263703, "uuid": "e795e3f9-0f5a-43d2-a193-2d12024fe193", "comment": "Malware payload (Mirai)", "value": "3282e23d30e3534af13506fdc07c38ce6df86f4a501a72dbd703b2098c869d65473d6f244564ea9a2f591b264fd8efd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263703, "uuid": "244b2129-31e4-46fd-8a5e-4b2eb35edc93", "value": "T17834831E6E59CF3CFB95873447BB8E259588678B3EA1C542D04CEB022D6078E701BF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263703, "uuid": "08a9ed37-8348-4a5b-8422-948d43b0fcbf", "value": "6144:3385Nqbu6wFg6UbhJLZGsl1mUuqrhh7ixoBQac:qqbgFpiBDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263703, "uuid": "04ef3a58-bdaf-4124-acca-da2b99e1431e", "value": 240200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263703, "uuid": "2f5df109-8669-49f8-bb43-7eefc8232a60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263703, "uuid": "fe0d6b3b-c318-44b3-8c7c-1f1c90c0199c", "value": "0c9cea75ccec78e388964f179cf2dd45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0913fc50-e19a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682228721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228721, "uuid": "ca2996ac-b212-46ec-a438-4419f75136de", "comment": "Malware payload (RedLineStealer)", "value": "c526dbe0d82b649456e139a63d9efa73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228721, "uuid": "2e124f4b-14c6-40cd-b181-024c2deea1df", "comment": "Malware payload (RedLineStealer)", "value": "9ff8bca6194a93ae66c9d55067c3bddf5ab9bf37b175da61313f1a9e615d29a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228721, "uuid": "cad71f2e-f42d-41c9-a4a0-a3e1b7a4bde7", "comment": "Malware payload (RedLineStealer)", "value": "e801adbfcc7d9fb834c85a6506a24a19b3060fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228721, "uuid": "fd7d4c5d-a35e-48c4-9c20-280366b706cd", "comment": "Malware payload (RedLineStealer)", "value": "49e778a9d4f30355feb880595760676ece9ab552a0ac7988ac2a218bc22f07221010c787591106eeb792a6cbee37198a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228721, "uuid": "b388cf5e-b4db-4577-8061-6408144a9567", "value": "T135F41203E7DA9073D8F117B058FA07C30B37BCE19F78538B5981A59A48726D4A4327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228721, "uuid": "667c4984-e34c-46f5-839f-9970db1b545b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228721, "uuid": "ba4217b8-578b-43d7-a3b1-178d98878ed5", "value": "12288:6y90sntJ9K8U6Nlf663O7OAuKibY7pBPbjFTn1uquMVJ4ZhLrqXjWfux:6yH+8L/663OAydRlMYjWfux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682228721, "uuid": "f7df31b1-8d9d-4d9f-8b1c-878544b46003", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682228721, "uuid": "3d5d1029-910d-4299-918f-5f921974c2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228721, "uuid": "57df31c7-5183-491d-a423-84e57b1d9d17", "value": "c526dbe0d82b649456e139a63d9efa73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a10d41c-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258384, "uuid": "02581a29-a6e8-4d17-a2e8-f1b47d7d9ad2", "comment": "Malware payload (Mirai)", "value": "78b7f90e848ccac87edea132c4447e32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258384, "uuid": "639430bb-88e8-4f98-a9b4-48677fa9b4e3", "comment": "Malware payload (Mirai)", "value": "a1c31d00e34ab60b3112c7b9e31a4003dba766954173dfe07b171b4185362f68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258384, "uuid": "58430e66-4106-4634-92c8-dd5fa0f3d2d8", "comment": "Malware payload (Mirai)", "value": "d3254698772a36a9cbec90cd160e65bd60463f2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258384, "uuid": "e40ad562-ca31-45ea-a1c0-d282579daf1d", "comment": "Malware payload (Mirai)", "value": "01d53d6d8886af554c103d3b00b09ecc3e8716c2fabbc24f0d52d2b1c8b92a4f72bce06e5326361cafbe1397405af2cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258384, "uuid": "f4a1c371-3ded-419f-bf76-f0b763b6ae64", "value": "T15CD2E1A27521B9F0E5F02874E2398EC33B3D7D78E06532D63B5448B8B9F40A096BC943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258384, "uuid": "0c9e4ab0-0cba-4d59-98ea-1d575066789f", "value": "768:vusHfRavjyYoG6ohCcSsnWC8Gxr7kU9q3UEL7V:HRwyYoUxJnD8GxXk9LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258384, "uuid": "51e2a469-5935-4d34-8c83-5a4ee9143530", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258384, "uuid": "e572faf5-bfe0-4a4b-bf48-a463ca9b2d43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258384, "uuid": "b2f3acae-1579-40b2-a9b3-3f4205dbdbcd", "value": "78b7f90e848ccac87edea132c4447e32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8296e27b-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253406, "uuid": "f7ba468e-5309-4149-ae46-8f46449e14d0", "comment": "Malware payload", "value": "394352f17c50d768b8c4c8d2548462c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253406, "uuid": "d3fab7d3-a2e3-462e-9cd3-728dde1760a9", "comment": "Malware payload", "value": "a1faee80b8833514857f6501a559dffa3e550c2f60effe5d32640e71ff847ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253406, "uuid": "34e38fc2-ad2c-471c-887e-f7659f16a014", "comment": "Malware payload", "value": "557fcdc17146c13485a8eafe2945f3c0655707e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253406, "uuid": "487a70c8-a817-493c-9b11-49d4025f16ec", "comment": "Malware payload", "value": "56e87b413fe61d0e36952fd82e5e9d7f12472164d01a2d20af7225bc1b07330c2e7e6ab81ce7a91fe11b6135c6b5702d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253406, "uuid": "a8521cba-a5a4-491a-a1f3-fef40f0d43d5", "value": "T13FD4D035705AC893E02E8AF0A438F871077174F3A9E5D9B60E9691D0CDDFFE4288598B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253406, "uuid": "14c4df12-9943-4a4d-a2d8-795d51d59c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253406, "uuid": "106f59ef-2c8b-492d-983f-c663628a0367", "value": "12288:b09TPZ2/uEtRemTVAcybhZsuNLejKzjjqQyq0D43jyg3:bgY/uEumTVAnZzNejgjjFyq0D7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253406, "uuid": "370aa4e3-ef5a-4434-b209-f7088d1e7c83", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253406, "uuid": "c93c7f7f-578c-4107-9157-2bef99c7e5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253406, "uuid": "9401a598-eaae-4f9c-895e-65ef81879599", "value": "Aviso de pago________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958c169c-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682260739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260739, "uuid": "22742a79-89f5-47ef-8481-b2289b976a72", "comment": "Malware payload (Gafgyt)", "value": "fbc3daae1312562b72b6e71438cf8dbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260739, "uuid": "4be761b7-68f3-486c-8129-ec65622da422", "comment": "Malware payload (Gafgyt)", "value": "a2eefc05bddc525cdc234314b5c947be46b1eaf2ccf011846318dc86b2cdf185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260739, "uuid": "22f05518-6ded-4ba9-a986-73a2a9d1ae78", "comment": "Malware payload (Gafgyt)", "value": "7a59d9e1e2b50d81fb6c922bcb789e02fbb0687d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260739, "uuid": "0dd19c33-5474-452b-a03f-103493c9bb06", "comment": "Malware payload (Gafgyt)", "value": "81c237bd41781a2874d5697353bb193bf5a6ad945470c2ad95e7ea66483aa453f39f79c8b75902af9a16a8b1707d163f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260739, "uuid": "f6af7888-f377-4309-b7f9-95352f06705d", "value": "T197C3F849A141C2F6D4830BBA135BF83B00FAAE6D551B5B6AB317FDF4C67B58132113A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260739, "uuid": "cf41e398-4967-4777-8e45-a25282ddef26", "value": "3072:ktYghJdGPTZEqjTP3zHqCCkFUXln3Jcrg+Z0Ua3hgp6W:sYgAPXKCCWUV3mrg+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260739, "uuid": "8fe25ce3-7e67-469a-a35d-22605d6dee6a", "value": 120594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260739, "uuid": "b18e7ce4-6c14-4b1b-9c72-59dfe6ff79a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260739, "uuid": "3c352da7-c9c7-4558-b604-47794e8b844f", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868be072-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682253413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253413, "uuid": "10be4c67-1fc6-416c-b376-71f8b5450cc0", "comment": "Malware payload (Formbook)", "value": "712ae1bbfa2a02b14e435c4e4402a382", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253413, "uuid": "678f2be4-2063-4fe8-8b41-c60c68b8fd19", "comment": "Malware payload (Formbook)", "value": "a3ae4514e1424de44ddf2c74abfe7ab55d0076b8da3496cac86cacc903ebb875", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253413, "uuid": "4b496721-6fe9-40ab-ac5e-d31017b8d93e", "comment": "Malware payload (Formbook)", "value": "f74820ed9b95c095d26b3a9097021894703c6f27", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253413, "uuid": "cbdade31-6404-40c2-86c5-b4f0eb02e53c", "comment": "Malware payload (Formbook)", "value": "b3b7114f639fbd99056e0bc4c2b2f8594f97a9cf6dc55e4c212dce502f40b534d544f62152334e5468208bda1479a74b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253413, "uuid": "004b74bb-c7a1-4a2d-8d54-985a7c5bcc5c", "value": "T1C1A42318EB2B66A40DB445088EB2B8F685C136634DF42AF4C4D8D6D7B2D1394BB8477E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253413, "uuid": "b5442120-8fd4-4adf-a419-e22f6cd2621d", "value": "12288:1S+OiaUSTjRvHmFywizxCRPcsQLW/rpZIAiDkN:15OiaVTNHCizxKn/1ZICN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253413, "uuid": "98de0c46-3af9-40df-82e1-890e288265a8", "value": 464190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253413, "uuid": "dedcb7f7-6d74-4930-b3c1-c48accaeec17", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253413, "uuid": "b4853ef8-dcc8-429e-86fb-ce25005edb47", "value": "DLS \u10db\u10d8\u10e6\u10d4\u10d1\u10d0 19.04.2023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f660428-e1ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263225, "uuid": "ed8905bc-981d-4f33-b2f6-49589332224d", "comment": "Malware payload (RedLineStealer)", "value": "2adc205d0a0a2f36f9a58078c5df2832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263225, "uuid": "76e95522-8198-4fe1-a4b7-1eaf2dffd4fe", "comment": "Malware payload (RedLineStealer)", "value": "a5901a182ef0ec8f2d1a79ea0973e98c3875c9cd6fa67ea1c807e5900bfbd72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263225, "uuid": "d56093c5-6dfe-4cc2-b876-ce71b7b5ff51", "comment": "Malware payload (RedLineStealer)", "value": "dafcc1e3298f2df01966c477579604bb5342d94a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263225, "uuid": "353745da-eeac-48e4-a6aa-c42a68e36f92", "comment": "Malware payload (RedLineStealer)", "value": "fccf8dd22db347ad6c646b18c9c8c0d42c68bfca8bf034ca9d21986f9abdbbdb55c10df755224adf9d4b1dd378abc73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263225, "uuid": "235003bf-fa6d-489b-a0be-d89d4b5ac6c0", "value": "T1DF4522126DF1C476E6A785F04574E3E40BB7B864796488FF32252BAA8D313C14A3771B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263225, "uuid": "dc721258-4855-438b-9aae-89a6d0573fc3", "value": "8343a262286978d40d4bf43c0a822079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263225, "uuid": "2cfaa91e-30d3-4097-9eb4-f94cf205af6f", "value": "24576:rs2EkDKc0UEpRfPvnK6fkU1iPCmGafyTAqYW82xxy0hWD5UhgLany+FRsa:UkCUqivPBaAa82xo0ha2Lnya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263225, "uuid": "eada2724-65ee-4ce5-aad1-85f1823eeca4", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263225, "uuid": "3b0a6bc5-eaab-4ae7-bc9b-0e5ded29c713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263225, "uuid": "971e89cb-1416-4fbb-8710-5a96ecc93210", "value": "2adc205d0a0a2f36f9a58078c5df2832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80bdef8-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682264743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264743, "uuid": "da7237c5-4340-4df8-9b79-2e6a62cbe06d", "comment": "Malware payload", "value": "75246cba9d3426eea8cb27a2d09604d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264743, "uuid": "e703629b-59d2-4cb3-88e8-54216c8bd5d5", "comment": "Malware payload", "value": "a6cb600b2e0906a1cd18863327ad474c065eea37ce224de005bea3214b002bb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264743, "uuid": "af4edbd6-4c7c-4d78-b614-208861243c4d", "comment": "Malware payload", "value": "b553927f81195c48ab4ec649da59907077fba804", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264743, "uuid": "962269cf-4c77-4bb9-8062-3bff91bc05aa", "comment": "Malware payload", "value": "c3f79164e4d1736a52baad989ba42a8cf02583b93bb588308b435f284a07e0540f1abd5789a8b70cc1f8c0cf9aedd80e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264743, "uuid": "97294770-cab7-4152-84bb-9b98c9ee9254", "value": "T1E904416A7770AEB7F88EDE3B01894601108C8D5907DE6FAF7365E928E36A54F50E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264743, "uuid": "c3bbca70-4161-4739-8993-ae3449bd09cd", "value": "3072:ufuo+C+ELiax5x3ksOkHS/idDEo+EQ/HRsyf+lsqDpyi88s:ufR+CRLiajx3ksOky/idDEo+puyf+ls3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264743, "uuid": "783e6f4e-a4b3-401f-8f57-95f42fad355c", "value": 181825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264743, "uuid": "009041cd-d362-4134-9258-5cc45758d1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264743, "uuid": "f32116af-44ca-427e-a534-6611d423a2f0", "value": "75246cba9d3426eea8cb27a2d09604d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62ef44d-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260901, "uuid": "6a66190b-4027-49ae-be2d-99a53b7d0614", "comment": "Malware payload (Mirai)", "value": "7d54ad111a15fe03bfc3be88a857bc17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260901, "uuid": "799192a0-8fe5-4279-8882-b9427e6d88e5", "comment": "Malware payload (Mirai)", "value": "a7c84e7edc986d0f651419b8851f1171bb37894f920fbb32ad047d140c688383", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260901, "uuid": "1b45f6c2-bca3-4c2c-a3bb-ee335f69eace", "comment": "Malware payload (Mirai)", "value": "4c34b3e805c0158d14a8dc571e7579e370d21354", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260901, "uuid": "9b0f843a-6af2-405b-a1ba-57c9cccc9e72", "comment": "Malware payload (Mirai)", "value": "419e380624a728b1fc6801844750a0cd6536f005c64afa95dca83cd378e66a6e9947770c34e137582d03320a7b846d36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260901, "uuid": "4ea9ee98-a4bd-4846-9224-9cd6fd9143dd", "value": "T19FB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260901, "uuid": "c5cda86d-c363-4885-a210-72218c442830", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZ6oamm/QcuLB1niDNb:YuFX0GIk1MHyph/amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260901, "uuid": "0c28806a-7b67-4d2e-85b9-d26de9a06e00", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260901, "uuid": "fbc741c3-42cf-4921-8a72-b1dea44ea0f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260901, "uuid": "4d1312b3-aa53-440f-8bf9-0cc6eea265f3", "value": "7d54ad111a15fe03bfc3be88a857bc17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25024b5-e180-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682217918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217918, "uuid": "a65d14b7-7e4b-401f-bd7a-94c2bdf7e521", "comment": "Malware payload (Amadey)", "value": "7583f352df98586921c0b3096bc1a309", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217918, "uuid": "45c172d8-5df0-4759-b3ee-d639a1f457a4", "comment": "Malware payload (Amadey)", "value": "a89296bb1a0da74a98e1f35637d7ceba0b6d8b60d53736ff9109cacaa85c58dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217918, "uuid": "3041a2e1-78b4-4452-9052-1ef0941ec5fc", "comment": "Malware payload (Amadey)", "value": "453a9ab3aaafa55cde8caee1b28e306c51846920", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217918, "uuid": "e6db6adf-9b1f-4d8b-80b2-b02289df53b7", "comment": "Malware payload (Amadey)", "value": "5f85579ee5d2756da2b44aa87a037545e22f91b28fe6a67eeb27259bb76685526ae96dd004012e059380c84b37d7abf7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217918, "uuid": "1f13b8fb-4eaa-4cf8-9725-5a22c4a40526", "value": "T1BE352362B3D86037CEBD07F414F6039B0B3E7C855671A6EB2A81AD6E4CB1690643176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217918, "uuid": "026ae63b-f4ee-4c23-887f-4e8eebd47749", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217918, "uuid": "67d0d9fb-ac16-4f83-9dcb-ab8d93cb0839", "value": "24576:BylgE9bVK09wYl/Ber8LYSU5pkDw8NkQ+L1og:0FhwU5erXpkjkQ+L1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682217918, "uuid": "86aa8692-dca5-4fe4-b3af-f7f520768ce9", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682217918, "uuid": "adbb2435-1036-4a42-8145-7f848af26888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217918, "uuid": "6dad4930-113c-4e05-906c-f292e9acee7e", "value": "7583f352df98586921c0b3096bc1a309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8de4a9-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266338, "uuid": "b14c4a59-418b-446f-8a30-37a07e3888d2", "comment": "Malware payload (Mirai)", "value": "c5256bafe77b9def6894706026450ea7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266338, "uuid": "369810cd-836f-42a2-89da-fd49c6b47818", "comment": "Malware payload (Mirai)", "value": "a980fb513c0986735a73cfb5f3c9d2f5a83c2e48344ba7f7c240eecec6476d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266338, "uuid": "894fb9a2-722b-44f1-a090-4e2c3bb8d7fd", "comment": "Malware payload (Mirai)", "value": "af53dfc62b26fbfc228516a76f3e8b167e8466c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266338, "uuid": "29f382be-ed5c-46e6-98f9-d535d08e2253", "comment": "Malware payload (Mirai)", "value": "8e3a080d1fc8704fb53ed760497bd568768629500cc8aa8ddc94642e4d39e79a6075a7da1b6425eb00f63e11b12f031a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266338, "uuid": "7cdc5e41-95a7-4fb6-8d42-f768734819eb", "value": "T1AC93AE23C9202D24C1058AB171F5EA369363951691CB3EFAD585CB6D7843DEEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266338, "uuid": "26831cce-6c2c-4036-b959-766aa1baad92", "value": "1536:4PxmkLbgX0FC5+KgedpyTd4+2XiIOiPAqPwyCfwJhKVaw54JAaL5hr/:K3bSJYXsyTd4yI/7PwyaVOAy5hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266338, "uuid": "e82cd3a9-4c2b-4dc5-9586-a4d71e882713", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266338, "uuid": "74bd72ce-b146-4994-9cc9-0e6f283e6dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266338, "uuid": "18e09f07-04ac-431e-9181-be6526fa8548", "value": "c5256bafe77b9def6894706026450ea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a6b17e-e1de-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682258142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258142, "uuid": "221a2662-5976-4859-bae6-479e5e4d2a52", "comment": "Malware payload", "value": "40d724c749a272211cea7b9d2af6e5c8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258142, "uuid": "f62e3125-5d35-4bbc-b091-cfda2b13e65a", "comment": "Malware payload", "value": "ac12aa01b5f280e263bf3d85c38a518830df9494a9063da43ac3fb682aedfdaf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258142, "uuid": "84a307dc-8836-45b8-b782-03d99830f1bd", "comment": "Malware payload", "value": "4f2673914f3663ed539e2dc6205573dc6204b807", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258142, "uuid": "41686867-2ddc-4976-818f-b20002191991", "comment": "Malware payload", "value": "0d65b4f53d10e5762f729769e986e8050e54fa1d5f9fd2d4fad77dcf674068263577fa750d5aed9658696dfb0d804b0c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258142, "uuid": "6aa37a9f-0932-4fe9-9caf-c4fe979c2866", "value": "T1A8E633FA23514AE4E5B1E23EE4B5286DCA180FA6B0A5C2B1DF37C9018D15D0C4F95E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258142, "uuid": "43c68350-e579-4d4c-bbcf-4d8770822124", "value": "393216:Y5ZLv4+Hlq8VIpWZn8/rlFoa1MOKtMgpc8FFBp3b2T4:8bLHlCW18rlFNOrRD3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258142, "uuid": "5a846c8b-b788-428c-8696-4058e831e026", "value": 14677695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258142, "uuid": "cdfa08d3-14ae-4947-b375-cf80fd21d6aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258142, "uuid": "538812d9-2d9a-4458-8fdb-2abd4b6854d3", "value": "Internet Download Manager.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd45e258-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261692, "uuid": "155fe668-0b7a-4964-9420-d17f7ebf3e6e", "comment": "Malware payload (Mirai)", "value": "84b7f967706ceff6b0632d8db54a1bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261692, "uuid": "e1c1161f-779c-4ada-af25-78b151d4a36f", "comment": "Malware payload (Mirai)", "value": "acdb96f0cf395a186da43190c3e4d566093dc457ea16fbee95247cf207c7d522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261692, "uuid": "863ec12d-287c-4084-8415-a08bf6322698", "comment": "Malware payload (Mirai)", "value": "5749e3f72cf5c75d08db6eff1df1767f439f273c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261692, "uuid": "97c9819c-dd79-4f9e-b3ac-67375e04a1e8", "comment": "Malware payload (Mirai)", "value": "0fd165c23c2e90a2e8ff09748820fcd36c950b83cc31c26ff3918b0647ca0222210de5d59638e4692182b1e43f1429d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261692, "uuid": "f6a1e7ac-a708-4a64-8d6f-8d4564096c56", "value": "T1D6E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261692, "uuid": "a2125064-9a71-45e7-8c62-16d7b59c1e2f", "value": "3072:dgZc9h1jlnLA2PiXYeyCcbVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZbVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261692, "uuid": "fc11dc74-68ec-41a7-9c6f-3e939c09ef6e", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261692, "uuid": "a5b7e130-2f2c-487a-8a20-d24a37b59383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261692, "uuid": "ee518c5d-5699-4dc7-9bc5-b403af1946ea", "value": "84b7f967706ceff6b0632d8db54a1bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5050b3c0-e18c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682222827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222827, "uuid": "dbd86b67-1cbd-446d-80fa-9c3cf3ce0753", "comment": "Malware payload", "value": "b7be75d312dd3635ab965b9fa474e183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222827, "uuid": "9de93c61-286b-42d6-abf4-00ba389f6af5", "comment": "Malware payload", "value": "ad829cd3745ba3d5e2268b4db60304039e3b721c926359eba14efd7a1bee3d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222827, "uuid": "cf817fdf-3446-4025-8ebb-c5bcedd7f578", "comment": "Malware payload", "value": "9f2034b47d71fbe31b534b5f922449860c4a5b2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222827, "uuid": "ba7e2737-29c5-4ae7-8f92-d443501f9d50", "comment": "Malware payload", "value": "b966f07c9403451e1fa5e53c3e5e2d80c9d61346030f10d7715df784d304660b68add9c311899b088e953e46eb874f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222827, "uuid": "837df3f4-6744-4898-8614-ed6ff2efb5db", "value": "T101751258679009E5FCB7913E8C83C50ADA79B8220740E6CF077496662F276E26DBFF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222827, "uuid": "814ae813-1096-4c97-bc76-5dc6770531ba", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222827, "uuid": "6c5f52a7-b114-4fdc-ad5b-228e34e4cc24", "value": "24576:2fXq5aG/o0sMEZruPPueeXwprVHMi9b+gb2MZH7F+DDZtildPPbYumE:2fGoZCHbeXeVHTx+WxeZePTTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682222827, "uuid": "498346fe-98f2-40ab-9fa0-745375b2f4c7", "value": 1684565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682222827, "uuid": "5b342044-a653-4aa1-a60a-a5ec325fa045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222827, "uuid": "fcd3a9b5-a954-4844-8662-1b17d83418a6", "value": "Hitpaw Al Editor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5293627-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264738, "uuid": "b502b8a8-34b7-47ba-bd9a-2c116adee70b", "comment": "Malware payload (Mirai)", "value": "0258a9c990f7ae9e81fb8d96bc422260", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264738, "uuid": "ffea2041-457a-44ba-8ed2-79dad1932b36", "comment": "Malware payload (Mirai)", "value": "add3e163611260ea32cbbbbc491b662bfe22bb7b0b6fffb9d35d721372333978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264738, "uuid": "0ad2257d-04ae-4151-ac83-531b0fc6aeca", "comment": "Malware payload (Mirai)", "value": "4d7998d93d5869f9bbd9448551ceb4e72884e8c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264738, "uuid": "f11353aa-03ad-4a05-8c9a-3416312e7a8e", "comment": "Malware payload (Mirai)", "value": "759070ca1785f1b61b456a0a6c4b1e0f5020921983f916cb49e524d1c3fa7b1ea0c0c5c8658e164605df28e95ba029a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264738, "uuid": "4aa7231b-a4d0-45e4-a5c9-81536a3ea861", "value": "T115041B0335244F2FD9D212B4142E57E883BEF9E52CF47689595E8B730B35E2A148AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264738, "uuid": "6d62b6e5-b648-433a-8798-700eacb74aa3", "value": "3072:otSXVaZaF59d8ais/9omOSgkcfkdpKAEIEMZZ:oYXVaZa93OrkfkAECZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264738, "uuid": "bf809048-13f4-4222-bfbb-bc2db0def3b2", "value": 178076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264738, "uuid": "ac979cc5-eeee-42e5-819c-0ca4cdd4162d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264738, "uuid": "27967124-2d62-4e67-971f-10ca24c6b5fe", "value": "0258a9c990f7ae9e81fb8d96bc422260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42b45f3-e190-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682224820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682224820, "uuid": "85c33cc3-32e0-455c-809d-1e6bae36dfc4", "comment": "Malware payload (RedLineStealer)", "value": "57ccc08c1a067901d3a2c0bd44493b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682224820, "uuid": "436b9359-4554-467c-92dc-7c12149f1186", "comment": "Malware payload (RedLineStealer)", "value": "ae4caf3ae57f24320501e611a6659e0fc8e7d58e2a918b70aa9ea30af97e90ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682224820, "uuid": "7b181a2c-9902-459b-8fba-0e7bbc43737d", "comment": "Malware payload (RedLineStealer)", "value": "76af369beab1e701da051d783b0b8fdf6c53800b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682224820, "uuid": "19db0df5-e69a-42f6-ab7b-22ff237cfeb6", "comment": "Malware payload (RedLineStealer)", "value": "58b8aaa67f17d34d16355899949c82c57bbd1f6f2d3e5cace3a85cf83621d65d0a4fdd0bd3fc914bee512607284adc93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682224820, "uuid": "b7d6eaac-37db-48fc-a9d8-69b1013e0099", "value": "T1DCF41247FBDD0472D9FA277449FA13830B39BC928F7847D71A40965A9CB23C4A8317A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682224820, "uuid": "5176e0c9-691d-41ce-9a13-eea04c2571b1", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682224820, "uuid": "d443fd49-fc01-4a94-94f0-b027b4b182b8", "value": "12288:2y90S5P6jjcPIfaXfdKbA9dZWYrdU7r/GV2pB359FTn1jqu6VJl4+8p9wr/:2yZ96jaPlKb1qV2dReUlTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682224820, "uuid": "bfe9c097-da47-45c3-9f48-11614989de53", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682224820, "uuid": "05dfd367-2fb6-4508-af45-bcbf0fb68727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682224820, "uuid": "9fce3d42-82e5-4659-9462-ea7e4038e5d2", "value": "57ccc08c1a067901d3a2c0bd44493b05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8601b9-e176-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1682213449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213449, "uuid": "c65c1a83-13fa-445f-bf72-cc16ea0b010a", "comment": "Malware payload (Stop)", "value": "5f1fcd310b94f482061e9f2de93eff77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213449, "uuid": "73f20271-ea60-426a-ae97-ad19debff16f", "comment": "Malware payload (Stop)", "value": "ae92869ae1e6762d5686b1596dbf26f38d4c29eaabeb570d1196860ed75c724f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213449, "uuid": "e3a53aca-a754-4817-98dd-5d0965f625c5", "comment": "Malware payload (Stop)", "value": "e4c83e549da3738b4ede4f948eb0c104073d9c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213449, "uuid": "2b0c8d32-ff54-45f3-88a3-d077791b5a12", "comment": "Malware payload (Stop)", "value": "32b15710fce2aa974e99b23713479d068a4fc7e0c4326deca7d22e553a16a75d627ec15484c58cfb1b5eac5a6c6412f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213449, "uuid": "a818b6aa-8e5b-492e-8702-be58cbfad8cb", "value": "T1CDF41251BAD1D472E0F74578187486F46A3BBC62A2A5898B333016BF6E306E15B3B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213449, "uuid": "b9c00f0b-db51-4b5e-9cd0-b0583ca2fd8e", "value": "c36577d8970592a39f985677fb550958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213449, "uuid": "44d3ce56-3033-4273-9646-87004b90a83c", "value": "12288:YBkeEraFSV6ImiQOGfd/liCJUlnjSTWiWYqp0O7EpRxtwPixsKSxOSqjnEKCG:kkfWFLImiQOGl/lhqd+T1qp0O7ixtw63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213449, "uuid": "d5b5b78f-4419-44e2-9d8a-99a60b2c7b9c", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213449, "uuid": "93f8b0a5-643b-4634-9429-cb1606dbbad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213449, "uuid": "20da0481-3e8f-4f39-a9c8-40af472af9b5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baef5f3d-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682213128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213128, "uuid": "4ec2e76c-9a7f-471f-a19e-f15654ecc1b5", "comment": "Malware payload (RedLineStealer)", "value": "aadc428f0fc2ebe568c74e09b6509c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213128, "uuid": "aac74523-1acc-41bd-9a4a-d943bdb1f078", "comment": "Malware payload (RedLineStealer)", "value": "af55382339c3b253fa9832bbe3c193779287fdb7e4ca0d09c8add1c2f9e8cd39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213128, "uuid": "e50e3bcf-e9e3-4d41-abce-657cdc5a25dd", "comment": "Malware payload (RedLineStealer)", "value": "c7ac3fe245db9edb7303e24572ebdf4c21341270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213128, "uuid": "96c8ad29-ab04-4f40-8f3e-1787783e3b71", "comment": "Malware payload (RedLineStealer)", "value": "6574f50b2ed7a825fdd7278dbdeebe723702a5e39bb899f720ba5b8e62472f1bdd52b4475c354a1bac3df804a72e346d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213128, "uuid": "439a72ae-13e2-4075-88d5-990e16d85ae9", "value": "T191352313EAE440B1DAB41B706DFA52A30A3DBC9565B186E73385A94F1C736E4F931323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213128, "uuid": "448ec51f-2d27-4f14-b7ef-5fa5af1d3ebe", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213128, "uuid": "78903cb8-bb6d-4c21-ab70-fea38197cac7", "value": "24576:nykBXwp0+pDRq6I1luf9WNCWmoizdTeLo9aP0GZ:ykX0NDRq6I6FWN3izdKL41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213128, "uuid": "e2db46b9-bdab-4148-b97d-4a8bc28eae92", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213128, "uuid": "ca456be1-187c-4368-92be-4b9977f90db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213128, "uuid": "d5371515-0dea-4bd7-bd83-0c4cd711b124", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a415670-e17b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682215516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682215516, "uuid": "dac2f083-32a4-41ff-baba-facc2e8864d3", "comment": "Malware payload (RedLineStealer)", "value": "aede8c2eb9ff8ecfecbc642871ff2b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682215516, "uuid": "248a8d67-fe37-4890-bd84-50ed9d5ca7e9", "comment": "Malware payload (RedLineStealer)", "value": "b06ed87408bed1258d881357ee22061c371a0776144b00777cfa1129343cd29a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682215516, "uuid": "80058fe9-c90c-472d-b4f6-d3cc1aec46d6", "comment": "Malware payload (RedLineStealer)", "value": "ee4fa3ea209021cff5fb4f2fc03761b4ab5009b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682215516, "uuid": "c30d89ac-624c-4679-b3f6-86b72ac03992", "comment": "Malware payload (RedLineStealer)", "value": "3f0adc8c837c63de3cd9c953f6e60cf3a1b6e5fa2f04c4712f9e20c6457652e7f14cff889c13eb0a1031294dbcc009e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682215516, "uuid": "a26a3a85-b1f6-4709-b73d-d64925268dc1", "value": "T1DCE4121667E49032ECFA17B019FA52970B3A7DB10B71869B16847C8D4CB36C1A1367BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682215516, "uuid": "f2ca7288-c2e9-4d14-a201-a23e1eca5f96", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682215516, "uuid": "c9eb5b81-16d5-48f8-bc76-6d6a529164e9", "value": "12288:zy90uZyr7FI+OC/moEL0yLDRRgcnE4HOx4cCDPsEWsERcvc:zypxGXelLEMyRec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682215516, "uuid": "09b6022c-6121-4b07-940f-ff256c2773ca", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682215516, "uuid": "8e27ae93-de38-4dc5-9fe7-8e23467911ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682215516, "uuid": "a5091501-f32e-4f4d-a18d-c34d26700f8a", "value": "aede8c2eb9ff8ecfecbc642871ff2b85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78eab148-e19a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682228908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228908, "uuid": "6b7bcf90-9117-4136-9ab5-5d33a5e96cb9", "comment": "Malware payload", "value": "30584755bc2df400accb54faa793970c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228908, "uuid": "cc765336-70ac-449b-83bf-7608937fe3f3", "comment": "Malware payload", "value": "b53f0484fb3f45556acbd3a32301c6705631a31522e43e0bbf19f37d5e5fc863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228908, "uuid": "0502a003-3695-4bbb-9170-dff57ead17f9", "comment": "Malware payload", "value": "52cda4a912b42cc1804b16f2887f7dd88ed3d4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228908, "uuid": "94ba712c-3314-4577-9c21-07dcc25c650a", "comment": "Malware payload", "value": "2497c0fa444d30db089e7f1127a2ca90d69bb477b8221efb5c5d9b2824e53a9124fc36259f817d65d81b71b7c021f1a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228908, "uuid": "9b26856a-df1e-48a3-a44a-31bb11d302b2", "value": "T13A84F801FFF6CA66F3EE1737D5F548004BB5F851E026E75F269926A91803B628E01B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228908, "uuid": "873ae6d5-e478-4bd6-bfc9-8dc0254809ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228908, "uuid": "221ede61-04ee-42c9-9b91-11f9d611adb1", "value": "6144:el/21NM+dFn8OdjsZh3ImzSnegKOQIVjSkHporMvSecaRqUhvSC:W21RdFn82sZJjzSnhQIVjfHpoM3N0mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682228908, "uuid": "8ed1d185-6fd3-4699-9202-c1507c77b119", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682228908, "uuid": "232bb700-1ad3-48ec-b458-b5b81e6c5602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228908, "uuid": "e4e90f12-5079-4590-89a5-3af9ac112b91", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1ed798-e1a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682231519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231519, "uuid": "b0c1db09-821c-44b7-9809-1c78ca70b98e", "comment": "Malware payload (Smoke Loader)", "value": "42f79c5ea28bbb96ec7e2e2d3194d44d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231519, "uuid": "3daccbe4-b860-4978-a7fe-bd0928df4ca0", "comment": "Malware payload (Smoke Loader)", "value": "b690cf9d11df9842bcafd5515304322a1b912b31664af298b2e59a953bcbb299", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231519, "uuid": "7aafec66-3a8d-45ff-aee0-8dadbab07d61", "comment": "Malware payload (Smoke Loader)", "value": "d6a88ffa7dc055ad11df03879d642bd412490756", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231519, "uuid": "5a43e349-069e-45db-b95d-04ad41a83d0d", "comment": "Malware payload (Smoke Loader)", "value": "c3854a09f5d0a6990b0daf9cef39e60cc8ceae5ec59ea3969a84ebd8c410f9e6a7bac8667fe052033f315ea05dee72fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231519, "uuid": "6a46c921-a4fb-41fd-859f-4dc7ddecd8d5", "value": "T10634D0D1B6F1D0B2E4A788349464DB686A7FBCA15760818F331C2FAF2D703D15A6A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231519, "uuid": "be74a509-b8a9-471d-aa41-5e884854c09c", "value": "c36577d8970592a39f985677fb550958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231519, "uuid": "a1745ad2-a4f1-4f1d-a327-f6327e69edc5", "value": "3072:AWmfO2PDkpnpugz4uzG2po6gfUDTEzO+N9QoUQ51BI:AHycgz4uzQUi19QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231519, "uuid": "13bda4c2-ac89-430b-bbf7-87f99a2443e2", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231519, "uuid": "a00c256c-c32a-4d72-9f00-2ecf5e4fba99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231519, "uuid": "774597bf-ec82-4675-b63a-9674f949dbe2", "value": "42f79c5ea28bbb96ec7e2e2d3194d44d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f4ddcb-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682213005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213005, "uuid": "ba76aff6-c199-4afa-94f6-7b3333facb23", "comment": "Malware payload (RedLineStealer)", "value": "0e1557e622fa0f84fa7cbd2f0a5491f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213005, "uuid": "6a5a736d-f55c-4cee-8777-c002401678a3", "comment": "Malware payload (RedLineStealer)", "value": "b7572b0fb36781bd6ee0f12b4fc8a5af9ddea9960268921a4bb2bd5d2bb325f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213005, "uuid": "e7f4a3e9-4e30-4d68-8dfb-0b16e6120ac8", "comment": "Malware payload (RedLineStealer)", "value": "e21e7e00fb10533f3e93e1664dc21c82550f9343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213005, "uuid": "91654508-d82e-4fdb-a026-ecac1eba62a4", "comment": "Malware payload (RedLineStealer)", "value": "a2343013d4620fcf1482ab6c6fad64b939b1ff06e4eb02bd678eb936c5a1633f980d825651cc42778ddcb2ac30273337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213005, "uuid": "691bc5f4-f92c-4544-aafe-f6d1d198dce1", "value": "T1953523536AF89075E9B817B164F317930A35BC55AB3483DB2246ED8D0D73AD0A1703BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213005, "uuid": "6fdd7cd9-e7e0-479f-8e31-798575153208", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213005, "uuid": "f58762d8-c83b-46f5-8ef8-65b448cb389f", "value": "24576:XyqsDHw7tMiMvYu6FzfnAcryW8a5TUwkkq5JxvJ:iQdMvbITAcOBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213005, "uuid": "0b1488b5-e6ea-4d07-8f35-19b7b1dc6079", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213005, "uuid": "0506533f-d25b-4ced-a182-85b66f1d5396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213005, "uuid": "6248c4a4-25f0-4316-a7f2-118bce55545f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb25a046-e1d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682253930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253930, "uuid": "92db1b7e-0ca5-4d7f-8e85-8c08c459bc7c", "comment": "Malware payload (DCRat)", "value": "23893d8555269071f05ea02bf7f3559e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253930, "uuid": "e8a95904-8d3f-4306-a7f3-af982969dacb", "comment": "Malware payload (DCRat)", "value": "b7b36e6544e5770554a157fa26fcd7834c4f0b939fb7466be6328faeb04aa0af", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253930, "uuid": "4fee1606-1b8d-42a5-86a2-4e3e66f9285b", "comment": "Malware payload (DCRat)", "value": "04e1f8c2091b44c6e13175341d20c419bbe1e4ee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253930, "uuid": "14f9bacf-69d0-4dd8-8ed6-45667e132591", "comment": "Malware payload (DCRat)", "value": "39d9db468381fba1a8b01c3d18480b523cc836658635f7bd6674dc3598117c514626b1ff43a2ee1519d4b70de0b339a5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253930, "uuid": "40d3fe45-6813-441f-af30-7ac21d5435f0", "value": "T1B3D5D7E2709AA639F9BFC477B4CE7602DA7F5A8DA305BC48036512463963297FE43407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253930, "uuid": "fe630d3e-e05d-4706-a5d9-a4b2d0657679", "value": "2ad0bbe7b488ccd9b02faf0349f3e503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253930, "uuid": "e96e6676-f81f-435e-a894-92dbce8d0f7b", "value": "49152:Q8STIHIGoEDkGeNGqxdcVMmjIfMXvNmfdtJ8oCh7qXdA/4PjM9CSPY4gP5O67jRi:nScOQ7qHjM8AwBo5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253930, "uuid": "0aeb970d-e593-45a8-9480-fc4ed42e8d25", "value": 2785184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253930, "uuid": "9b01e57f-8877-497d-8d99-685206a4aa80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253930, "uuid": "7508244b-8b3c-4d26-b8eb-3a46f51f365f", "value": "23893d8555269071f05ea02bf7f3559e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6cd53e-e207-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682275812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682275812, "uuid": "a12d023f-4374-4e7b-bd9f-85ba2fbaa09c", "comment": "Malware payload (Amadey)", "value": "0c01ddda4c78daa4cbbeff49957285ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682275812, "uuid": "be474c29-e17f-40c0-99e0-d587fffcf8a9", "comment": "Malware payload (Amadey)", "value": "baf9d67e6e4577f6fec3bfdd18df58ce8c1e5e56401d98c5eaeeb13d5b7ed546", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682275812, "uuid": "c35ce4b7-9796-401e-a3ea-445f418acbb0", "comment": "Malware payload (Amadey)", "value": "3143f36df51a7864e39077b1c06c09860e4d60ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682275812, "uuid": "1180ef77-6652-4e3d-a1c7-be59c7e08fb1", "comment": "Malware payload (Amadey)", "value": "3bc4d4d62c81b95d45d27f67820f882a66dcab0bce83e4b646084e67183a38ad7652c4dc02de4c4000d5b8eaa627110d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682275812, "uuid": "0b985aa4-6bfa-47e5-9de4-05c18ec9e5e4", "value": "T1BD352346A6EC4632C9B427B05DBE13630F36BC519BB543FB3642A44D9CB36A2753073A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682275812, "uuid": "3e824cff-b5ff-4bc4-b1ea-ab4a38c8f324", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682275812, "uuid": "d47c2d90-0ba0-48ad-8eea-f08a001fee22", "value": "24576:qyheL0s76ArOLrFUQxeBAcniYS3JAj1wCTNT5QGdFRq:xQ0s76A0x9eBAcniv3IIGLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682275812, "uuid": "175c0e1d-3849-466f-95a7-0466521bff73", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682275812, "uuid": "1dac9089-41e9-48dc-be33-2aa19ed9578d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682275812, "uuid": "553c61de-8ce4-498e-b449-99bb67a1dd85", "value": "0c01ddda4c78daa4cbbeff49957285ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c4832f-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261702, "uuid": "dd59f329-6cc1-4396-b4fd-819c63ff026e", "comment": "Malware payload (Mirai)", "value": "2b997751cee468f9bc47a41741655b91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261702, "uuid": "7c257dfd-7577-4050-a79b-0af9d41f0a3c", "comment": "Malware payload (Mirai)", "value": "bbbef4329c59938f106e8d862f28117f4226b07002fce7e2f823179b22adadb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261702, "uuid": "dc635f19-13ba-4fcf-81a9-714b34fa1033", "comment": "Malware payload (Mirai)", "value": "5036f8a3f8362158115480d9b1d8acd5b0766745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261702, "uuid": "438839a2-4793-4a92-914a-901c2324fc72", "comment": "Malware payload (Mirai)", "value": "374731096c419ddb6656e26ac29f6307f82d0a91d952eafb4ebb4b20c68d5bd706abb4692d5931bc278d5d05ab978d76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261702, "uuid": "76e4fb70-efa8-4b60-b22c-a57c5b0917cd", "value": "T11DA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261702, "uuid": "b7993f23-f589-488a-9b84-9ccea3f8fcee", "value": "3072:wW8FUmgujld6Mkxm6AJ+4ffHmmFVcqq0GnDZT:wJFv4Lm6AJ+4ffHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261702, "uuid": "2045f04e-d202-45a8-958b-83d876468810", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261702, "uuid": "fa9b92c1-5139-48db-990e-3c4f45b8a257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261702, "uuid": "9e5e9ad2-f539-4eb4-9ed6-20d63ce64b25", "value": "2b997751cee468f9bc47a41741655b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53eae05-e1c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682247907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247907, "uuid": "17925262-3256-4dc7-8cd6-fe5af01acf51", "comment": "Malware payload", "value": "411d8b2e2099b7c0db01378e5fb0ea7a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247907, "uuid": "98b60541-6de3-40a6-93ba-e3739e6b97d1", "comment": "Malware payload", "value": "bc0cd1eba2ff99c013c9a139151ba9a2670ac9083b4b915802943f9778593585", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247907, "uuid": "3efc0e6f-7b13-41c7-be3a-38ca7a47a0e9", "comment": "Malware payload", "value": "8fec64569696eef7f592f22abf63143974f28ca6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682247907, "uuid": "a241cae6-a476-49bf-99ea-493fe06a96b8", "comment": "Malware payload", "value": "28aa6a3624b320500aa1f50a09c704839a52646eacfd244ffba8b1ef688c7413f0516c0dcdb0fc29bfd11323210d3cf9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247907, "uuid": "48edbc61-fe71-4350-95fa-8aea7ae380b7", "value": "T1A1446CB478D190B3E4D2463987A7EB950419BD361770AEAF26F32A071F701E2DB36613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247907, "uuid": "53611157-f77f-45ed-a779-ca532e847af1", "value": "6144:lcytwbG1yTS+xqqDL6HKJxRSuOvSYhMw:CyiG1Rqn6qJxR5tQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682247907, "uuid": "68c6b367-4598-4439-b5f1-cc6ab5e46427", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682247907, "uuid": "2244803a-a4cc-495d-ab74-09149633b8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682247907, "uuid": "30be4779-c862-4fac-b46c-d4086c446632", "value": "2023-04-22_411d8b2e2099b7c0db01378e5fb0ea7a_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a5c73b-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264679, "uuid": "7d87ce40-c785-4f62-a430-eb96aaea0eb5", "comment": "Malware payload (Mirai)", "value": "63f7bbdabbd7b904dde16e7b21f363b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264679, "uuid": "06c31c4e-e177-41ad-92e0-530abd7c6351", "comment": "Malware payload (Mirai)", "value": "bc34f5a82855cdb19f1d51637ecaa8fbbdc7dd27fdc967cdeaec0ced74373c08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264679, "uuid": "ebf9f40e-adf2-4d84-9708-ea4615770f7c", "comment": "Malware payload (Mirai)", "value": "0d79159d9759a785676325e5cf4dae813a5aa682", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264679, "uuid": "52aec067-7ed2-4451-a206-2c73f43925a8", "comment": "Malware payload (Mirai)", "value": "eeef653b3887a863abb89baa7c464667fc0eae3b706964cde215bb92779db16a4ccfae47400fd199b9df18213de94c15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264679, "uuid": "eda242c4-3e9c-4cb4-8f87-f9b3aae9c918", "value": "T1EA24D580A8828926C6E813BFF57E01CE331567FAE1CFB1628C511B1577C691F0DA7B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264679, "uuid": "b9839c20-c54f-4541-9f1d-e6b6bedd9753", "value": "6144:q0wbY+st0LXfPSjV4kNU9mrsplDKZUiQBKXAVanZX+F8Jyv5rGDSKKuy:q0wbbst0j8i9mrsplDKZPQBKXAVanZXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264679, "uuid": "c2197a9b-95b9-420a-a981-44d46af918fe", "value": 210224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264679, "uuid": "8240d325-22c3-4611-9f4a-3ad88cf7e31e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264679, "uuid": "0e40d91b-b82b-4dd3-808b-77c303ef1e64", "value": "63f7bbdabbd7b904dde16e7b21f363b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59458158-e192-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682225419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682225419, "uuid": "ad8f2a10-2112-458a-be78-09ddf0411529", "comment": "Malware payload (RedLineStealer)", "value": "2ffc45435bfb6ce32aa5b66d2b51dd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682225419, "uuid": "542570a1-159d-47cf-9a2e-23f1bb86bc6c", "comment": "Malware payload (RedLineStealer)", "value": "bc387bc247b1c4f1b6d7775e08f49aa85c52edd1c8b5c1d4e9d1d15ad330eb8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682225419, "uuid": "a71c12f8-9816-4d8f-903e-dd826b391128", "comment": "Malware payload (RedLineStealer)", "value": "7be17543394f8b195bde96a795ec033f0d04355c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682225419, "uuid": "b451b1fd-9137-4700-9f42-f5cc65c3758e", "comment": "Malware payload (RedLineStealer)", "value": "1a063304d1f93c29eb35444824bc55ad9501860f746f30a1966cbf12af92ce61e654fb7fb3f41c300a12b7ad3654e6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682225419, "uuid": "a7d612a6-b140-40ed-8d80-7a390798063d", "value": "T1C3C41202E7ED0076D8B61B7058FA17931F3ABC539F7892CF2684A8994C726C495327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682225419, "uuid": "9cf4ce41-e0c6-41be-b1a6-6863416895f9", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682225419, "uuid": "55d1d160-b1d5-4cbf-abdd-cb0ce5a88ead", "value": "12288:jy90plTPKO+pvUSiu4TevCAxSZphisZFTX1ByudVJVFeYVP:jyOdipcST4TTnxxpE6gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682225419, "uuid": "e61741b9-e546-4f32-8fd8-cabe44b6f144", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682225419, "uuid": "38f304d5-9710-4fc0-a195-2d8a2757f31c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682225419, "uuid": "b8ca8b90-28ee-421e-8675-467ca02819d4", "value": "2ffc45435bfb6ce32aa5b66d2b51dd4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b569e103-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261652, "uuid": "bd78e4a8-1dad-41fa-86df-f42913326901", "comment": "Malware payload (Mirai)", "value": "a1a4d3121de5e8df4484e4b99e68a253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261652, "uuid": "b598bc42-39b9-42c3-b1e5-0c54bd982708", "comment": "Malware payload (Mirai)", "value": "bc6a263dd5802df7362ba90d34472ead21f6cadd5af6c938e75d557ef6200fd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261652, "uuid": "963fb8f5-e500-405a-88cc-e57f43c8e5a4", "comment": "Malware payload (Mirai)", "value": "691b6f24e7a864640d340c1e9fb58a048184c0f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261652, "uuid": "7e43a26e-3b3a-4667-aec5-3fc99ec61f7d", "comment": "Malware payload (Mirai)", "value": "20b66fc69e189d89d44bdf67c68dff2d3a14ac7926f8dc2f6b5a94411bee5b60dac00baa3193eb88b2946af0b3211bae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261652, "uuid": "e47f74c1-74e5-4a35-a819-84e8ad0b7311", "value": "T1FCC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261652, "uuid": "032f947f-d628-490d-a59d-a171ebecde1e", "value": "3072:6jVlyaL5JCrIpv04sZbttiEiTmP46aQyfPlfKsNb:yoCJCN4sZbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261652, "uuid": "035fe4ad-6b2c-4407-acd1-83d92c76c1cd", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261652, "uuid": "bf1954bd-3214-4e0a-a6f9-e118dd634c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261652, "uuid": "f4434dc1-3e22-4781-af24-428d4185780d", "value": "a1a4d3121de5e8df4484e4b99e68a253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa333015-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682213234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213234, "uuid": "36106896-f85c-45e5-ad9b-1d2d62224cb5", "comment": "Malware payload (RedLineStealer)", "value": "89ff3329bfa461d4c5f6a43c7fee38f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213234, "uuid": "54172c06-2fae-4972-96d0-25da0ac50be0", "comment": "Malware payload (RedLineStealer)", "value": "bc83cf38e8a0254094978aa996c128cb2d95bac9370b9dbe6c3112a10023df26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213234, "uuid": "d2dbeeec-54c5-4953-8ccc-89b2f95e1d30", "comment": "Malware payload (RedLineStealer)", "value": "ca9cb41fbff8806bee7f7c5bce5cac274c1eae8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213234, "uuid": "c8ebf692-b341-4a73-aad0-b5f7accef040", "comment": "Malware payload (RedLineStealer)", "value": "b6665d0162a9a299e6a1dc064690faaac1e154d137d039dd3982af8eab8e0ca144eda72fba85c0188c2f6d4e78cce8d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213234, "uuid": "4c0c3b3f-9490-4e2a-807e-4b1038e08497", "value": "T128355B1130DECC32D5A51035089795A27D2D74293662F47BA7FD3A3A0AECFAAEDDC112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213234, "uuid": "42fbba21-d8f8-48e4-8c73-34ed3b1b1f42", "value": "e28b3f7484bd5db9ff26da5bec4979e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213234, "uuid": "9c3a21da-98d2-4aea-8c73-98fb279c2871", "value": "6144:z8IXHaRijlgDAObnpLPYIxtYxNr7ZyfuoUaY:z8IXHBqffxtYxNnZyW7aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213234, "uuid": "cd0daa41-4d7e-499e-b779-bb8e91f33600", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213234, "uuid": "727681c4-22aa-4b6f-8070-ab92fe48145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213234, "uuid": "70047c77-a331-4092-9eac-145d1e51e96b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67a5864-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261707, "uuid": "9f27eee6-0eed-4344-b3e1-f00192ee6da1", "comment": "Malware payload (Mirai)", "value": "bfdc9e8be71a8aeb369260b55ace7bb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261707, "uuid": "f87ce705-0328-4620-8e42-c138d8a3aa26", "comment": "Malware payload (Mirai)", "value": "bdd4d4824bebf72fcfd5d803f6894cb8c1351c0e4accc2985628f6baeff73078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261707, "uuid": "f1585bce-52fd-475a-aeb7-1b8cb4e0c045", "comment": "Malware payload (Mirai)", "value": "7869506b4e042ce2d5040d20ebe386b538c23f2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261707, "uuid": "c2cd2c12-85b4-4980-b51f-7fb7d3d72733", "comment": "Malware payload (Mirai)", "value": "9fa8d14deddc64bd45be5f9aa174b6775aad753b31bb903c5c1643d17d4f1435acf683cb7241cd49493e8657395a4b37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261707, "uuid": "3269adde-eb87-4c52-a99c-a904148b4bb2", "value": "T191734D02731C0E47E5A25DB0253F17E193FAE9D121F0BA896D0FAB5A8671E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261707, "uuid": "2d1758fe-dd54-4f51-86e6-59781fe48bfb", "value": "1536:57HYUSS63aFPW2uAJwVFn8SPu5v3VeZ0L4FRHRxr1JY:VQTsOP70pNR4fx/JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261707, "uuid": "def1fd8b-2041-43e5-a862-b3b7630f2a90", "value": 79092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261707, "uuid": "13538373-4f8a-4746-b947-767a83d7d0d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261707, "uuid": "7d37abe0-c249-42bb-8c82-218070dff996", "value": "bfdc9e8be71a8aeb369260b55ace7bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa0486b-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682213189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213189, "uuid": "40dc324b-435c-4993-87a8-0888bf7081b0", "comment": "Malware payload (RedLineStealer)", "value": "7e2d328e7e2552be4a862e83f9c7177e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213189, "uuid": "cbc538ab-20fd-4c03-aadc-a95db9333796", "comment": "Malware payload (RedLineStealer)", "value": "bdde06b2f10392b9c34fd2d03dc90c33542f96bdedd67b201dd0c782a1b4bf9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213189, "uuid": "11ece359-d57f-4ac6-85b6-31def2fb81eb", "comment": "Malware payload (RedLineStealer)", "value": "7d80b8b70676053aaa9d652b721c574ad81b011f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213189, "uuid": "f7b4fe9f-69a2-48f1-b48c-55a0113d6c1f", "comment": "Malware payload (RedLineStealer)", "value": "5a71867130603bfb01dce9d38e1c1a3c3c7c122985bd76ee22bcb95c65fc30b02f92c5441ca00ab23b10f8bf944297da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213189, "uuid": "4995533a-d4b5-4a05-a851-6b1c32a0c99d", "value": "T1A2A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213189, "uuid": "c70afe04-69b8-45c3-b65e-d73d0996199f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213189, "uuid": "ffed15fd-af32-4863-8669-71405e74d0f9", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2t3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213189, "uuid": "b0323f3c-87a3-4a9e-88f6-6cd29e659db4", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213189, "uuid": "666e5fb4-4984-4b49-bbc3-4d557b164345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213189, "uuid": "1e83cb2c-caf5-4209-9089-de5e1e613e50", "value": "implosions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889606e3-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682253416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253416, "uuid": "041ccc5e-108c-4624-a5bf-1aac698f0221", "comment": "Malware payload", "value": "eba5b82db9ed4e3ccdca4f45c2139744", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253416, "uuid": "d2b21e32-4b6a-4016-8a58-4f0feaceb73f", "comment": "Malware payload", "value": "be437e9fa9978893b0498c01df118d3667211ee9c9cf4ac12aeaf37f65f44b2b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253416, "uuid": "cb165577-80b5-48df-bd21-ea4153405b3f", "comment": "Malware payload", "value": "aa3e4669f0b8e2857a889754a9465ded5e0998ad", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253416, "uuid": "6f3721a3-0af1-495a-93f6-8ac6d29d98aa", "comment": "Malware payload", "value": "8f1126796443380e32ef01a84bee69c41e9d874e60533687833320e1f5c708caf647de0200f87a25270bfcb6c01524f1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253416, "uuid": "28e60edc-89c3-4805-81f2-ab817fd5286e", "value": "T1D0D42313C112DC9EB879D62ECAD6F34484390322560FDA83BA97835DF6F180FA539986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253416, "uuid": "d2175305-c631-48df-8154-535fb2e22183", "value": "12288:ki/Pe5iXcZJCVjwmRXT9XywVpzlLAEWYdZx6640fuejmH+kz9D9nM94hMLaSW:5MSyQXTMYdZjjfkz9D9nZq2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253416, "uuid": "8c0ed754-83c5-467b-a685-c55e6fb428cb", "value": 648570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253416, "uuid": "2794229f-b80f-4ada-9448-52212c701d13", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253416, "uuid": "99609fb8-0213-4be7-87a5-355ce9fd4580", "value": "FV0231600 MNS 21.04.2023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1684fb4e-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682212852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212852, "uuid": "7f877cab-5614-4e6a-b4ab-f51bf781c454", "comment": "Malware payload (Amadey)", "value": "73697bb39a8c335cd2e906f38fd42aaf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212852, "uuid": "354bcd10-40a1-480e-8a7d-be02b40a39e5", "comment": "Malware payload (Amadey)", "value": "be51a26d316ba39fe7d2d196937eab45293d6b2264c8ec7c2921212ae4ce53a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212852, "uuid": "0cab49fa-4cd1-480d-959a-b3ebf15969ec", "comment": "Malware payload (Amadey)", "value": "1e1348fd052d9933a7d566b1ada63f4c16485704", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212852, "uuid": "9c2015a3-ba15-4ee3-bf83-8a3a4179d9ec", "comment": "Malware payload (Amadey)", "value": "58fcc1d80e34f5e4054dc43b70094ca33e306b3b46fd5a95b8d3cfb77267a0be2a3c5a408eec3c01d803a3479b38b0a2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212852, "uuid": "91d20c92-5859-46b0-beca-d755b1f363a0", "value": "T16C352346BAE48076D9BA1B705CF603C306757CA6B6BA43EB1689DC190C775E0E538373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212852, "uuid": "0a2fe4f5-0738-48ae-a652-e9e93900aecf", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212852, "uuid": "3162fc2b-4b35-4857-b0b8-e7c88a675d6e", "value": "24576:RymNLNUlkbReq0ZDuYbOBcNcGfphevwkwjU2R0bSOa:EuYkbVeOBScqbevajUU6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212852, "uuid": "d5ba0e41-3b1e-4868-8d8f-0827a843c878", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212852, "uuid": "74ca164f-95a7-4bf6-b7b9-41692e97af15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212852, "uuid": "9f5c8800-6944-4ec3-8caa-9875aebf2028", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9820de-e1b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1682238712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238712, "uuid": "bd8238b3-2912-4fef-b4bc-4925d39888bc", "comment": "Malware payload (zgRAT)", "value": "5826e69f394b48f822644136a031cd05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238712, "uuid": "e1eab292-d0f7-4e0c-a34c-4d642468574d", "comment": "Malware payload (zgRAT)", "value": "becc5a80b6ddf5cce6701ee367b76b2aeff842c1209942891cacde5305b52f4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238712, "uuid": "7b85697e-0f5e-49fb-aaae-b7041bd3fe83", "comment": "Malware payload (zgRAT)", "value": "8e8b8127c602b48b1101c6f05c376c286d987792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682238712, "uuid": "6868e2fd-2ac3-42e2-8b91-496790fa4718", "comment": "Malware payload (zgRAT)", "value": "d3f1e5a26da3a3455aba1f4c6765222c30a2d6d91f56bace26fd11aee848fd0ded24fe50ea4f76d9520ddf74da570452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238712, "uuid": "302387af-0b64-4ff2-88e7-e47a216a12c2", "value": "T153C5F0330587BEDD53F76988D88B22440ECDA8BB2368D3957CCF159B61A9564ED83CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238712, "uuid": "5c7cc216-0ef5-45cf-8301-eb766c977bee", "value": "49152:iiL/QLctLmq4ncCbxiWCqDQhvqyaeXG6C:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682238712, "uuid": "50623a0c-dc8b-442f-9674-47a6ac74690e", "value": 2715648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682238712, "uuid": "d3b090be-13dc-4b1a-bf7a-0f8c0b6cfd7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682238712, "uuid": "e1c95649-9ae1-4888-9f8a-0c8d9cb6700e", "value": "SecuriteInfo.com.Variant.Ser.MSILHeracles.1709.24891.31417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1397d470-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263528, "uuid": "8d95aafc-bc75-4e64-b66c-163c58d2567a", "comment": "Malware payload (RedLineStealer)", "value": "b0790ce3c3c1479e1ff61593be55e6f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263528, "uuid": "912caee9-b907-4e04-a28a-c4c438e96671", "comment": "Malware payload (RedLineStealer)", "value": "bf27e3bb45bf755409271078fa9d776ed383c653bdb8e3d4c469583751996c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263528, "uuid": "2d6c6c82-67ee-4fc2-bc51-8f97b374d7a7", "comment": "Malware payload (RedLineStealer)", "value": "79ddfdc55b59311de5822c250482d763bd2405a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263528, "uuid": "ccb4d765-ea11-452a-895b-41d0209b27be", "comment": "Malware payload (RedLineStealer)", "value": "4e81397b3660d730779d444121e7e34d2db52f4f6c2b5b77534a1e65c275e43849bc83e0b8406c20b7500d83dbe4c38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263528, "uuid": "971034ed-5080-4818-8475-fb6d8e9a9153", "value": "T13BE41253A6D94037D4A61FB449FE12C30B38FDA15BB582DB6B95AD8B04737C4E03136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263528, "uuid": "83ec569e-b369-4682-a7f7-7b1127fbb52e", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263528, "uuid": "8cf962e4-8ae3-4229-86aa-07468f24cd87", "value": "12288:fy90+jxRBUzDZCDCA+dtYZ3IFAEs3vhsZwUBH1cg22oyzPDP2Jj9blNhEeXo:fy3dRMxn2GsvOSUBH1qhyP2nh84o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263528, "uuid": "ae125e32-3360-43b0-8f03-b2ce341b8faf", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263528, "uuid": "03888469-ab03-4783-9d03-d85bafe28d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263528, "uuid": "b812e5cc-35c2-4a89-9223-5fafb16eee73", "value": "b0790ce3c3c1479e1ff61593be55e6f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1395f24d-e1e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259662, "uuid": "ce47e232-0027-4655-bd58-52bbb43e9d7e", "comment": "Malware payload (Mirai)", "value": "c95f511f802359db10eac3a63fd41c8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259662, "uuid": "7fb57837-1838-48af-82ce-1c8901a5e810", "comment": "Malware payload (Mirai)", "value": "bf7be0ef1b6f176c2a071e81619ec3e3acce05f5806d7cf8b177373347d28140", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259662, "uuid": "d43a6a9e-9454-4b28-a940-b1c1adef3d50", "comment": "Malware payload (Mirai)", "value": "c2b3f3118a6e92c83cfdc13c92137d4173c354f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259662, "uuid": "0e9efeca-c3b1-4901-be6d-98727d8d44a4", "comment": "Malware payload (Mirai)", "value": "61f7f22ff040ccb0bc0990f6088697e3b187f3bf0da7e81c0d13c7c998df1ad0d1155d289820f9ea482d31aad5db70cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259662, "uuid": "76522913-309d-4144-b2ad-b8a140a52a57", "value": "T191739409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259662, "uuid": "3687a759-3230-4abe-8552-591ac03adc3f", "value": "1536:zJPEBmW5iNWqcGTlwnXHZ84OqdZerESty:zJPEB8NWq96qqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259662, "uuid": "da1b7d6d-706a-4f9a-8d43-22b90f241c83", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259662, "uuid": "5cecf729-2e4a-4901-8522-34e1ed72bdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259662, "uuid": "ef901800-0546-472c-81c1-abe4db53d8c6", "value": "c95f511f802359db10eac3a63fd41c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a6c575-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257820, "uuid": "8b931acf-49ae-43f8-8116-2ccdbb85d655", "comment": "Malware payload (Mirai)", "value": "e8a2d12d21e8ca83869222621e63d6ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257820, "uuid": "df25b016-16e8-4360-b7d9-b8759e5d9c23", "comment": "Malware payload (Mirai)", "value": "bfdf9fb8d4fbefcfe7d7934320495aef3368911b4debf7803aefe7300bb04a73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257820, "uuid": "4d1fcd83-af75-434c-9a69-bc94de56945d", "comment": "Malware payload (Mirai)", "value": "eeac2e03f86479b1e2a872622d6f3ae07a7dd870", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257820, "uuid": "dbfc5281-5723-4729-8444-f4633d6f2a01", "comment": "Malware payload (Mirai)", "value": "e1b70c120f8250e4dd3328af48cd3e4ffb8ff5643005748739ee8f752152ec7c60d7bcd5d17d803a19fa95d15bb4deff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257820, "uuid": "97d135ec-bece-46a3-8067-e4b778e07df1", "value": "T14FB2D0BB6281F872CBF01975766A8B47E3934FFCD1E5765728300A6CA78888780EC447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257820, "uuid": "bc4ea570-84d2-4828-8466-8dfd08637846", "value": "384:khZ0X9nxn8o9ir/nSdois0ovY29FZJtt6/x0GvPhymdGUop5hX:ZX9nxn8o9wnBrDTZJttiTs3UozN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257820, "uuid": "5d3c8e76-854b-418a-9729-7742ae43d5e5", "value": 25012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257820, "uuid": "54a700ee-73aa-4307-bc20-afb6bf826930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257820, "uuid": "9f3925ec-e507-481e-a006-4789566df34d", "value": "e8a2d12d21e8ca83869222621e63d6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be04604e-e1a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682231601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231601, "uuid": "945f34c6-ca75-479e-984c-8ff8795a819a", "comment": "Malware payload", "value": "d6b513b2be6b5daf42989747a6e17543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231601, "uuid": "b6bdf53f-4f92-4ac3-b031-032919ff6e00", "comment": "Malware payload", "value": "bfed711753334aed91c90fd445c73638be1772ae490b504375a24ea4b9ad3dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231601, "uuid": "3643bccc-b16d-4b4a-b7ad-566fc6d0a73e", "comment": "Malware payload", "value": "03557846f02bea7e1d1181b4372d987e61e99329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231601, "uuid": "8be0b3cf-c2d8-42ac-a0e6-83670acbce04", "comment": "Malware payload", "value": "12951174a59487db1c0f94264e0a3ae126ac04bf833acb18fa88bc0bcf7452995d575c2ce083e5beec86c9e164373688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231601, "uuid": "270c3596-6639-4ce3-9872-c8b4b7a2d3ec", "value": "T17C8308A837F98631E2BF4E79A8B121211377F552AD32DA0D09CD709D0FB37848865B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231601, "uuid": "a95b3b4a-272e-4111-9157-bc2eab7cd6b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231601, "uuid": "87b2ac80-aab3-43c4-93c9-3f2f609ade4a", "value": "768:bIdmENpxH6aRpqgEJBDitZRIZK2Y4MrtJ1siBJ8VeBjIjsIpBTSibA1oJeLnbKwx:bIdVVFPISwiNjKLB1bA1uezm16g6tY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231601, "uuid": "c3381092-e2e0-414e-8cbd-09481048c18c", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231601, "uuid": "2c8980c0-c74b-4d15-a490-d650cb95a1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231601, "uuid": "004a4026-6d5f-44d6-a36d-8289cd213185", "value": "d6b513b2be6b5daf42989747a6e17543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4b5dac-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257848, "uuid": "6023d26b-32e7-4b94-8c51-197a3b08a632", "comment": "Malware payload (Mirai)", "value": "5be6f4dc1db73a179b2d7accccc6ef57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257848, "uuid": "b61a28d5-1363-494e-bacc-4861a6f6b3c9", "comment": "Malware payload (Mirai)", "value": "c0b4d037fca9c8f13b2c5d61ca9e284fa0e85465768ead8fa5b494c5059e6efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257848, "uuid": "23dc9513-145d-4d1c-a6d6-dd1a66a8b1c2", "comment": "Malware payload (Mirai)", "value": "271789c5eae333bf58a441796b84acef99814967", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257848, "uuid": "ce57bb3a-9ed5-4570-9b5c-f79e051c8727", "comment": "Malware payload (Mirai)", "value": "acbf9cf52d024e6a7aa566c1c621fe42a5520f2fc7fd7220071796953c6250a87ad4bdfb23f3278caeaa17dee8693b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257848, "uuid": "6c81f679-2021-4e21-9806-4060d2e74e66", "value": "T11F33F291802E5DB5C8B12D76D89559E0BEFD0A7CF98FB32E7A0896C130875976FF4048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257848, "uuid": "f562d73c-af52-4e88-a7d8-176969581a07", "value": "768:LEbPpQwNueqlA/gS8wgXFuCAIDRFLoBcoXV9q3UELjCHVIpH3UQJc2ZVYCYjK0NS:I+wg7A/ww96joYLm1IpXVJc21+3on1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257848, "uuid": "13f6e0e6-7b7f-4afa-a9e0-9912335b0fbc", "value": 52524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257848, "uuid": "372edfd3-97b4-4122-8ff0-b92a29eb0e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257848, "uuid": "1e09b62b-ce9c-4502-bf50-dbfd6868dfd8", "value": "5be6f4dc1db73a179b2d7accccc6ef57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d9b8ff-e1fe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682271984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271984, "uuid": "5baa1f8c-3570-4c99-8116-074ea051d553", "comment": "Malware payload (njrat)", "value": "46f5111c7c871155091f0a7810b02235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271984, "uuid": "ab2e4c0d-4a29-4e07-85ea-f3d23a3dde9f", "comment": "Malware payload (njrat)", "value": "c0ee79dfade9330fa524500595c9a3489be87d8017e18a1a3997991de761603a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271984, "uuid": "1d865f02-5e45-4764-bafc-8edc9cfd758f", "comment": "Malware payload (njrat)", "value": "1a6e436333ba021e6971afd72c1ab880e3732308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271984, "uuid": "c95561f0-356d-4bf1-bc9e-67f9a95ca645", "comment": "Malware payload (njrat)", "value": "e8bf03f3a37b6bbdf296ffa7249002f1c28191e88577780e0cfaa288abfd5132a08e0664f3ed46113156004367794f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271984, "uuid": "91f5ddd7-8e05-43c1-a690-dd6d941307c1", "value": "T111448D92F28052F4C0599CF6351A64B10F733E573110A92E97627FBE2FF3392643669A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271984, "uuid": "909a33d3-35b3-44b0-a4be-7a83810d0c43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271984, "uuid": "ac7c0749-7189-4829-8c93-84d950fe67f8", "value": "6144:RdAECP0FqT2A+3vLlpQkIxZ9o6SCiYYYYYYYYYYYRYYYYYYYYYYiPhDc:R3CPsmNGvLov/66AYYYYYYYYYYYRYYYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682271984, "uuid": "d7f7b837-0fef-4933-9390-ca4fae0ac15a", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682271984, "uuid": "dfeb6cc2-5c7b-4d29-9518-0700cb26ce3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271984, "uuid": "3784d626-20d1-4c2e-a8eb-160754d0544b", "value": "teamviwer9988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac95e9ff-e1e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682262925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262925, "uuid": "b7795a11-a871-4278-88af-2b03c40456e3", "comment": "Malware payload (RedLineStealer)", "value": "22d402d9a8cb2b4031566dc1d3f1bdbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262925, "uuid": "f9539d4b-d771-41bf-ae9b-bae4aad0af1e", "comment": "Malware payload (RedLineStealer)", "value": "c11067b695162f02329d1f5b3e88befa85ad7f468fdfa700ff9bc53e9eb8a41d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262925, "uuid": "931b8b5d-00d8-4297-9e3d-03e6f4987952", "comment": "Malware payload (RedLineStealer)", "value": "a43050cf6baee587cabfef96252e0a3a22b5cb26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262925, "uuid": "d74a93c9-ba49-4936-a45c-32d4bbe49e3f", "comment": "Malware payload (RedLineStealer)", "value": "748b89a95acbafc6fb28a0fbdddd9126379c020dcda2b96455c6eda8410b418bb5162888e4d1d05db7615c07cb6e3bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262925, "uuid": "95ca04a5-b516-461c-adf2-eacc6296bc5d", "value": "T1D1F4124277ED4531D4A22BB00AFE13C31A38BC966BA482CF67849D6E1C732D46A35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262925, "uuid": "8010ae4f-5994-4e4e-922e-e1f80e51a1ec", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262925, "uuid": "dd650572-49f5-43ff-80ba-a59b8b745dea", "value": "12288:2y90VVp8LJw+KiKW8VCHzzFmXXY4Htdg22oyzPoSh+yN+sTv1a:2yEVp89w1s3FmXoetZhyvhX+sTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682262925, "uuid": "059210dd-ba66-4bd1-afcb-6d2961521d02", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682262925, "uuid": "bd624957-d27f-440e-92d0-1229bf507dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262925, "uuid": "47503f61-fef7-4c09-97d7-10ab3dadea08", "value": "22d402d9a8cb2b4031566dc1d3f1bdbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8befbaaa-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682213049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213049, "uuid": "0e03d0a7-0e30-4abf-b461-ae2bb8485625", "comment": "Malware payload (RedLineStealer)", "value": "cefc7fb667ec876223728946b5d159b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213049, "uuid": "d7a6ddb0-2294-4b9d-a718-040766fa6e71", "comment": "Malware payload (RedLineStealer)", "value": "c1312d2e0951f11698843e9095c59b599238e469a12d2955fb98dd1762de8d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213049, "uuid": "3ac0c676-1975-4490-ad9b-a904e891043e", "comment": "Malware payload (RedLineStealer)", "value": "e1a2a13183751f60a22fd0d8c9bf37d0e70ae909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213049, "uuid": "d6baa02d-5b93-427f-9d13-c06dcdbf600d", "comment": "Malware payload (RedLineStealer)", "value": "9da825ef40ae8001216ad71839bba59a435067cf48593bac6758ceaaa1d3ff19a501ff02a3789a98fc630253eea31f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213049, "uuid": "b28f1da9-1993-4179-a1fb-cd8e62c2915d", "value": "T10F25230A7AD44677DCF917B068EA17830935BC535B6A86BB7244EC961CB3BC4A03437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213049, "uuid": "6ce8dd7b-1b7b-42c3-9db7-30e56fbb3a0b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213049, "uuid": "b5d77b99-c6db-43ea-ac23-45e36f3ce79e", "value": "24576:Ey1hYkE9NKVh+/9WERilsuvDPazuwvKr99BHUU:TDYR90D+vRY7PazLvKJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213049, "uuid": "a1a013de-dd24-4a32-aa7b-a6fafaa478de", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213049, "uuid": "22dca005-92de-4c67-91d9-f76820f95617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213049, "uuid": "331a434b-9309-434e-b129-473e81458df7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241d81f3-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258401, "uuid": "2e635820-0e65-4696-a830-c5d79b7dc640", "comment": "Malware payload (Mirai)", "value": "9a769062cf1019ac535e55f584f4c516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258401, "uuid": "deaf9b0b-b7d3-450d-80a2-2671bf1a883d", "comment": "Malware payload (Mirai)", "value": "c27988d560c27e7980bec388a3eef515b9d180858f036cb5018d98423ff90be8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258401, "uuid": "99c2a0fc-0e59-4be5-a202-317a468ac183", "comment": "Malware payload (Mirai)", "value": "d45e27c3ec800e95e510d48e1bb5ac79bd5be1c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258401, "uuid": "a29e78ba-d761-41f1-8ff4-5650a639462d", "comment": "Malware payload (Mirai)", "value": "f6692ec0532de40480e109a2bfec0ace41f41c7d34beaee569bb6158b0cf7b373aa9aecdecd3e741ae036329676580f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258401, "uuid": "a30ca56b-ce81-435c-a63b-16acd03df454", "value": "T10E63FA96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258401, "uuid": "2580ac80-de45-4fb1-81c7-f781fe9ff338", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlzr57uscvIGiojd70k7h:VqVMkWV8PPM9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258401, "uuid": "38c4aece-27c2-4233-8444-1c6faed3fc77", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258401, "uuid": "cd693cad-ad64-4b3b-9736-7ddc5170b85b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258401, "uuid": "18c26cf9-771a-4e48-9d13-a31c28b1e1d8", "value": "9a769062cf1019ac535e55f584f4c516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa4c404-e1ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682249374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249374, "uuid": "3fb2344f-b2ea-4cbb-9dd7-154d6a226da6", "comment": "Malware payload (RedLineStealer)", "value": "55788f64ad3c335bbd16305726f46cfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249374, "uuid": "f191d0d8-7188-49cf-8930-6f8ba1dbf686", "comment": "Malware payload (RedLineStealer)", "value": "c28f573fa043d94fc23c99cca26987ba9b284b16df62accd81a706bf1cf70611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249374, "uuid": "cd0ebb51-1b12-4b30-982b-d540d6e371d1", "comment": "Malware payload (RedLineStealer)", "value": "c7ad6805b2a6cf17067fc4a6f2b8b65f6f8b974d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682249374, "uuid": "cf5879cf-3f1c-4f32-86b8-df8f74a3ab68", "comment": "Malware payload (RedLineStealer)", "value": "ebd104ef31b2d60ec0e2acf36c8f9112eaf1f139623d4e80ef34a66e77b4d2a490839731dad259ca4546e6fda42a1e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249374, "uuid": "021e3cf4-7224-4960-8e0c-3da5bf7fd97a", "value": "T1D284E1217AF0E071E6F7C8304470D6946B3FBCB2667481AF33181B7A6E316919A76763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249374, "uuid": "a0dd9657-8f85-4cf9-ae73-c9c626b6794e", "value": "8343a262286978d40d4bf43c0a822079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249374, "uuid": "71d111eb-a669-4691-8d96-9313973f648e", "value": "6144:JUA3T1l2H7SMrU/g8wNbeBmG4tBz4YvuWLEFAYSTkvb1rl:FT1lMOMrU/yeB14TPQFnVvRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682249374, "uuid": "fd1e09f2-89e4-40f4-88ca-ce1fd6a9da31", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682249374, "uuid": "bf2f9f56-b810-4657-9fbe-04433e908607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682249374, "uuid": "145dbee3-6e24-4fd8-90bc-a734a0e2d8ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57a1b43-e1c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682248445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248445, "uuid": "5906f654-eb35-473e-b7ee-5a8e378364b8", "comment": "Malware payload", "value": "1f29e8d5d2232f6bb8793b800adcd7a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248445, "uuid": "3d312209-cdf0-4ad8-a585-dc05be08b779", "comment": "Malware payload", "value": "c397751baff0243a160721ee79fc2412c970f8bc98cd3f6a46d692698d5fc3e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248445, "uuid": "a5680994-3e84-4ea7-92aa-d8361972dc6d", "comment": "Malware payload", "value": "b3071bf8db20dd960620d6419d2da7c083fda95d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248445, "uuid": "71f02bb9-b74f-4f77-8743-7aa190d1cfd7", "comment": "Malware payload", "value": "8f36eefa044fb7d0d5b6bbba2d4fcada879c46a704b4ba16ae55f147276a12f6c401ccc9f94e89f81e1306ce888705f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248445, "uuid": "6f5c545d-8ce0-461c-b327-718b9840a70c", "value": "T116A3CF20BDE1C073C4A3A57090A5EBA09F6E492123F599CF2B681A755F613D1637F38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248445, "uuid": "2614f2cb-d994-43da-85ab-36e57ea2390b", "value": "1536:76Fzr8cCcruzsyZeVSGhr4eXkA1RdOAwYRRl5oub5ktOYv0f:76FkccYVf4e7vGYRRlFbOUYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682248445, "uuid": "1dc75847-fcaf-4254-a7b8-3f9ec47c9669", "value": 103987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682248445, "uuid": "ac15f875-ba68-4dcf-afde-4e097acd923c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248445, "uuid": "cd59a57a-d086-47ba-9d7c-373c478e6aaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26214d3b-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259264, "uuid": "b2365c18-100c-44aa-bac2-68fada3b9d00", "comment": "Malware payload (Mirai)", "value": "2287acfefa0e1101421d2387a7bfc724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259264, "uuid": "c960c0fc-f27d-4bae-a027-d13c14dcd942", "comment": "Malware payload (Mirai)", "value": "c496574e68f81e71beb808d2111b8f1bfd892fbdd59ee29dd140d20220b7769c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259264, "uuid": "424c75cf-1f28-49fe-9cec-561c5a480c21", "comment": "Malware payload (Mirai)", "value": "930b1a14d8abcb9a23dfef969a7e7cc3090ee5f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259264, "uuid": "5b85e1d7-b8b5-4f2c-86bd-744da538f1bb", "comment": "Malware payload (Mirai)", "value": "5e1ac6081805b62e5f258c9cf4f52070a0fe8cfdd2c9d252c48de0ce07e891d1814bd6aaedf7add49ba2a70d0c278cbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259264, "uuid": "cb98a8c6-9a5b-4f8e-868d-f0edea3e87c0", "value": "T1DE431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259264, "uuid": "93969f6f-0731-4122-86a2-c56dbea9dbc8", "value": "768:eLobAxU6q9Hfymp0xginuYWCkLB6WsTwIC1DQdszoDaS0O+DCDt:eL0AxvSHfymp0xgunWCkV6vTMDaua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259264, "uuid": "7bacca5e-a8b3-443f-9540-90b2636fbddd", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259264, "uuid": "3ed71d9e-216a-4cca-9665-2b4a02bfe2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259264, "uuid": "21d238e6-c753-4755-92c0-a17fbbe97edd", "value": "2287acfefa0e1101421d2387a7bfc724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61808ff3-e1ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682263229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263229, "uuid": "fc7d0996-2882-462f-a266-17570edd7601", "comment": "Malware payload (RedLineStealer)", "value": "9146b8cdfeb1a0700b7a19ad2f7b4da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263229, "uuid": "690cc1aa-51de-4742-98e2-7df1fc9c2b09", "comment": "Malware payload (RedLineStealer)", "value": "c55c309bcd68445c253b179b160216244bed16d5ad6ef9b9d6f39e559807c547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263229, "uuid": "db3566b7-88a2-4b86-b91e-82a5f7316b02", "comment": "Malware payload (RedLineStealer)", "value": "c109f4459d35293a1f4f483cf2e51a6f006c7b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263229, "uuid": "b501a34b-fdd1-47e4-8547-6429a951460d", "comment": "Malware payload (RedLineStealer)", "value": "066089334b43c0519604d6a7c3b7a4cff999e57a6a4a42c85d4d6d5a8ff97aae244f94ca40d8d138b2f596b54a08483d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263229, "uuid": "a123a710-1320-46e6-8eb7-3c3a7ac8e28b", "value": "T1AAC41256A7F4C132E8B517F018FA12D3073A7CA25A78C3DF238559DA4CB26D4A53236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263229, "uuid": "694e1968-1382-4ae2-8f0f-f318f8efe7ce", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263229, "uuid": "b49b94c8-d977-4904-8b2d-6a5e8c13be83", "value": "12288:0y90Y/KGIgM+Nay2ggoR3gGh2qPs1J1CBHsFIp1XRc:0yKGIgoyDR3wqU1J1CBHsyXRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263229, "uuid": "9b9a5324-7d08-4625-adee-06c491ae3c36", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263229, "uuid": "a8b8db5f-6755-4079-8272-837dd03c4d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263229, "uuid": "4e53fb28-25a1-4331-b308-98c77e8af74b", "value": "9146b8cdfeb1a0700b7a19ad2f7b4da0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74e1edb-e19c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1682229926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229926, "uuid": "7f6ea069-5395-4669-88a4-4d820ad3a36f", "comment": "Malware payload (N-W0rm)", "value": "56845c8f34de9ef0fd3f779f2824ddd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229926, "uuid": "dc3bbea8-7288-4559-9dad-d1cc318307a2", "comment": "Malware payload (N-W0rm)", "value": "c5af346b42d47b64b7d12bdbf29890c557608f42511b8b7a09c6fe1f69605c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229926, "uuid": "348a3790-3549-4995-a4ac-e171c7ba2ee8", "comment": "Malware payload (N-W0rm)", "value": "e7f9e2588f312dcd341f59a53f2fa892e3057816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682229926, "uuid": "827dda15-7964-4c1c-b01e-b483d751b01f", "comment": "Malware payload (N-W0rm)", "value": "5db7dffa19ee04ba0707c7872844c2592670db15250adfd3989dcf4c5ebae039279c16dcd0daa2388d1d09bf5ec9b818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229926, "uuid": "703e32c3-b991-4eb3-9302-03029ba5d1c1", "value": "T179A533179716BE4BE6190FBBD0751BDCF15142286612FEB9FC092C08A926B148B19CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229926, "uuid": "72c143ff-e72a-4148-a603-14d1d6883bf8", "value": "49152:zkJWQgEW91vUkf8kOZIUWgvIcSKVMzZGNO0sUBKIDOJ:AbErvU08hZIKw3KIGNNsU7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682229926, "uuid": "97829d8f-d632-4e47-a92f-7a8995a9e113", "value": 2222080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682229926, "uuid": "114a5b71-e204-4596-85c8-0f6f25b9261c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682229926, "uuid": "4dc3a8b8-f165-4828-ae25-44fa43422a4d", "value": "56845c8f34de9ef0fd3f779f2824ddd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb61b89-e1fe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682272024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272024, "uuid": "d3215b82-0545-4db7-a080-e6f961c94dea", "comment": "Malware payload (njrat)", "value": "24b2856cb9840f3b7131827e32cb73c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272024, "uuid": "16683c4f-13ad-42ea-8c5b-b9d0b8d274c8", "comment": "Malware payload (njrat)", "value": "c688771d462dd43de49442bc6297db435c3138dddb7625e4d2fccb145463ac22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272024, "uuid": "e5c33173-209c-4633-8b5b-9732f5160d8d", "comment": "Malware payload (njrat)", "value": "306e69487143bb3756cba328f20aa55a3482c38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682272024, "uuid": "48bd2f04-0cc3-4c55-bdd3-9cadf6cb3fb4", "comment": "Malware payload (njrat)", "value": "2045e906b3b09c27fc390eecd441aadbea82ef532f8ca2cf0ee1ce62a80b473ba7bff130f1cddc9fd96e693dc73a8eb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272024, "uuid": "549d3935-d6b8-4d7b-8938-9bfdeb099e8d", "value": "T128F23C1322DE7DA2E23816703B3343C1C73CDE055A53D66E69D83129EA7E2877A423D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272024, "uuid": "803b780a-4008-4a78-ae46-6a21da709ab4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272024, "uuid": "7147f351-8e39-4bcd-a1f9-a037831eae97", "value": "768:b717qEQ4Un/guyq6tZ1f+escElzYcHeIm:b717Q4sDF6Z1mesbEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682272024, "uuid": "945e70c8-ec6c-4077-93ae-87a93eac28f7", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682272024, "uuid": "a65e08d3-532a-43fd-8f9a-edb99d2e5887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682272024, "uuid": "1a573cbf-c97c-4c1d-8f13-cf51732df8b7", "value": "domonica-gov.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4648030-e1a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682232417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232417, "uuid": "00512f2c-f893-479a-8bb9-d38208c0beb7", "comment": "Malware payload (Mirai)", "value": "a014f41f61a03a5c44595f5f50f3374c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232417, "uuid": "73b1faae-1aee-4411-bbd5-fbe8bd314e14", "comment": "Malware payload (Mirai)", "value": "c8b2528bd54db991f43cd56c83c4f5ebdb77a558e1e49ce4fc176e10f6dd7cfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232417, "uuid": "868e0524-4aea-4b4d-acb0-4b6ee36db6d8", "comment": "Malware payload (Mirai)", "value": "720beabcfa2f1f7c51a2f4ed013f207a58d22fc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682232417, "uuid": "36297ee4-31a8-418b-9625-82b34660018f", "comment": "Malware payload (Mirai)", "value": "1bf0a8e48e0a9e89b2439d193812d9ce32a3043bf953a05113c7cdc0e4485fb1bacdc32c756e3f60717a8667029efb71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232417, "uuid": "71b633a4-4828-43f4-847e-b8df5cef00f9", "value": "T1D7D2C0CC679AECE7CE3D4C3B2AC41A91C69161F475EBDB4F975988D9B412A6FB00D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232417, "uuid": "eaf7a18e-0f60-4c9c-8792-36bbc1f4bcdb", "value": "768:yWkYxVKH1t5upd4WxRSNhunlBLwbpiHduzrUtWP:yWfxIH1nlWe0xmgkr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682232417, "uuid": "fe0d3950-a933-4682-86eb-964ed74490b8", "value": 30076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682232417, "uuid": "d56c2b59-65ef-4f3b-9d9f-976b99fb02fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682232417, "uuid": "13ebb797-06e6-49a3-96e9-a9a24cb5c775", "value": "a014f41f61a03a5c44595f5f50f3374c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee112f6-e1a1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682231764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231764, "uuid": "c4a5e7ff-6351-4816-92fc-d147b9909643", "comment": "Malware payload (AveMariaRAT)", "value": "2f904cdaacc6b54e45b614f8fe61a712", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231764, "uuid": "5b94244c-bab4-4ae3-9cd4-d063facc81ba", "comment": "Malware payload (AveMariaRAT)", "value": "c8f68a3d3b00911920899df9f4c8e91c5d6e672f4456af41e20e58e88abde2be", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231764, "uuid": "07b7d8a2-da45-42f9-9576-c8d23e27633d", "comment": "Malware payload (AveMariaRAT)", "value": "0ce45fc1599e1c0ca27b757e15e7438b0872b787", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231764, "uuid": "df220a30-c68f-440e-9e1e-bba779f2dc5a", "comment": "Malware payload (AveMariaRAT)", "value": "992a303f1b9bcf88d4259bb8670589dd98725027ae254a3a7847f6c9d2b5610187fbbc06ae4d2613e9fb2a9289faf83b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231764, "uuid": "e1622e67-6501-407b-952f-cde6016d89dc", "value": "T13A759DF3DBE9BA9FE7A90E74D46130030C70EF73B1A8C37568419D992C6D606B811A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231764, "uuid": "56adee25-b805-4fcf-acb5-33a78c7adc6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231764, "uuid": "e4ef6743-eb06-4e6f-9be0-9799e34dac3d", "value": "24576:qVzze6u2jlUf/32xEwapfldtUqmnjUm65+7HbwtrWktKMa:q22BK2KnFWMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231764, "uuid": "89c9b14d-e655-4ead-9084-58b35943dba7", "value": 1663488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231764, "uuid": "1c6d3c17-1a8f-44ba-a174-a735ed136882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231764, "uuid": "c50699a1-b1e0-4496-8f96-ab2be67e4d39", "value": "QUOTATION_ APRL 310377FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49e144e-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257865, "uuid": "89521d91-9aa9-4a71-87db-a29b9d2a3455", "comment": "Malware payload (Mirai)", "value": "aa882bbc3ca513bc39cde5bcee954eeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257865, "uuid": "f3db4e3f-05ae-437f-9a52-8f46e4223739", "comment": "Malware payload (Mirai)", "value": "c937da34a23d259942c82ded7c3837035da67f33ed8c872811b55a10c3f2b928", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257865, "uuid": "d5450a37-b45d-44e4-b2ff-7d2ea3dc74da", "comment": "Malware payload (Mirai)", "value": "5e2efc250901e73afcaf6d2ae2371f62c2bbbb54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257865, "uuid": "f83e747f-cacc-4cba-ad55-d2559703b907", "comment": "Malware payload (Mirai)", "value": "c245d66efc077545214a04bb6de0d2d8dfe7300c7fe4f9a7371e37679f5bd0f909cc5493811de1002e3e6cf535f5bdcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257865, "uuid": "aa07ead3-e3e5-40a4-9065-1b77139346e6", "value": "T1E2332989F747DAF0CC4305B0115FFB3BA936B9A12224DDB7DBE0BA637CB16424416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257865, "uuid": "c13b4b4d-4fd3-4ac3-b1d4-e01e25d4b7a1", "value": "768:AYZ8SfvufWuq96fu8zOoevR0sRlzhJdt9QgcpORus0v7l/iE+nKPaO+hTvlwas:oSfvufWuq96f58Xgjv7lSK3+hjlwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257865, "uuid": "e65a620c-19f0-40d2-bcb5-9f6c33d28e53", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257865, "uuid": "aece3ff9-5d0f-4478-9c72-df29d2170d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257865, "uuid": "aa21880e-3b6c-46c7-8dbd-9fb5b32fca2a", "value": "aa882bbc3ca513bc39cde5bcee954eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2397bb-e1fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682271171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271171, "uuid": "f2818678-c992-45bb-aa18-00490dd451ed", "comment": "Malware payload", "value": "9cfc792134cd56a76fd3ab2b09592410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271171, "uuid": "28ee8799-a9bd-4ba4-a2be-a273519db9ed", "comment": "Malware payload", "value": "c99c9b0b775ca59ecdf12e7938d0a757a54ad223d1d6ae8f1049374beda0e0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271171, "uuid": "f3418156-b84d-4e55-83d4-9e2a3728392e", "comment": "Malware payload", "value": "f4856f809e6c324e962fd54d6415ccdc3b1f4dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682271171, "uuid": "d49eba08-913a-403c-acde-f756a8ced415", "comment": "Malware payload", "value": "6834edb86423e4bbb5df358d518b72ffac611aa94945bb9ea32aea2269f10b501dd32152878a3ad01af60a4785190d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271171, "uuid": "9cfe1bf1-f035-44b8-9a71-c298a4a7aa61", "value": "T1B553F144EE7DDA23D75903BF68C7E54927A6773A5453E78B3C0422812B0F792580B2BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271171, "uuid": "7237d257-3f03-4f83-b073-80d62e8563cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271171, "uuid": "9df90500-0f30-4267-926b-f7ae97c12507", "value": "1536:bq+Jx1ekCFxPNmHNWaW/CY8GxhnL4iARXiog7h6nVZO:bmr0YTLHAdpgVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682271171, "uuid": "776366c7-8254-4893-afc0-05d3e24d4963", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682271171, "uuid": "7f4e7741-9755-4183-a303-f05f5c1f2ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682271171, "uuid": "97965ae3-6d47-438a-b766-cf1a36afdef1", "value": "aaaaaaaaaaaaabbbbbbbbbbb_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf18ed34-e16e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682210128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682210128, "uuid": "e4f65310-9aac-49c4-9e8a-6c793d063bec", "comment": "Malware payload (RedLineStealer)", "value": "d8a767374ba5d13430802a70ff3376ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682210128, "uuid": "c6f66e86-92a2-4a57-964c-e21655002330", "comment": "Malware payload (RedLineStealer)", "value": "ca4ae9f580e4a00f646d216125a86bed4a1f9c327a61194dd77d902d4adadbbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682210128, "uuid": "f73ecc4f-f951-4b77-a80f-34bdf5006738", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682210128, "uuid": "4d4e5d23-5d86-4f71-9fc1-b649e01b2fe5", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682210128, "uuid": "91c43cd6-e3b6-490d-944b-70836a54db14", "value": 6605824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682210128, "uuid": "fade2386-d52e-4e18-9059-55be40ec89fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682210128, "uuid": "f6f37612-6114-4220-9c59-8377464935bc", "value": "d8a767374ba5d13430802a70ff3376ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddca883-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263760, "uuid": "025d6706-0434-41f7-b40c-73c36dddc651", "comment": "Malware payload (Mirai)", "value": "f928f60ec57ea6488f44e9b23514d50f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263760, "uuid": "577b560c-73b6-4061-bafe-ebdfa1e20fac", "comment": "Malware payload (Mirai)", "value": "cafda137e7835a7d72a64e555e81789e9aa2946446e2e4324357536f71e98772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263760, "uuid": "4b7c9560-d58c-439a-82e5-d89d3ff103e6", "comment": "Malware payload (Mirai)", "value": "5fcbc90029368d108f9b926934df7b5a16ed8e93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263760, "uuid": "6d83736b-6bf3-49bf-ae4b-e44020b39ed0", "comment": "Malware payload (Mirai)", "value": "9c214c1876989d0968c8e672a155094b3b778528769ebf4153cb33668f8fe19922549977dc810bdaaab0f7df6a6bce88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263760, "uuid": "197a6f0b-d748-428f-89b6-043d273d9b83", "value": "T15C541881A9818D27C9D813BEF5BF018D3321A7A9D3DBB2178C145B6437C7A5F0D63A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263760, "uuid": "31c9bbc0-aab8-4fbb-a37a-0987b7ce1677", "value": "6144:gonzqVM5tLjAwPMzrTjG59mrsplDKZUBQBKXAVanSX+F8JyvoPdbwxPOlURwy+Wc:gonzqq5tL7U49mrsplDKZgQBKXAVanS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263760, "uuid": "21bb734e-1f39-4ae1-a2c7-50042e348b9d", "value": 278773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263760, "uuid": "c77693e9-ea18-4973-b69a-048326806622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263760, "uuid": "ddcbc7c2-0376-42ec-8ab2-8b20d643939e", "value": "f928f60ec57ea6488f44e9b23514d50f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e3acaf-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260954, "uuid": "6da6d2cb-7d6d-4250-ab0b-5b7228cd36a3", "comment": "Malware payload (Mirai)", "value": "91376fd5527d3bb781d7433c8ea3ade9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260954, "uuid": "982e4f80-7850-4c7a-85c1-92fa9a97316d", "comment": "Malware payload (Mirai)", "value": "cb8e53f9b6f37879f6fb05d8bfe7312c1191da344d3e972f184707d298b8e52b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260954, "uuid": "3abcf287-d858-45a9-b7d3-2fcee9fe1742", "comment": "Malware payload (Mirai)", "value": "1d0102475008f48984dfd32c5a67cabdc6ca64eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260954, "uuid": "2cd65cd6-91f3-4f3f-a6ba-8acdae1f7efb", "comment": "Malware payload (Mirai)", "value": "2ce063751327d15ee90d27abe8367bf464089bbd235d29b0aaaf9c21f72b87aeb852b10b785ef9bb7491c3942522fa8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260954, "uuid": "3455a838-1b06-4646-8a26-29bafd155495", "value": "T1B2A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260954, "uuid": "4483c9dc-b54a-41df-98d8-f84ccad24559", "value": "3072:VK1z13U6HzHoXRtmTUhQogjEmmFVcqq0GnDZT:VK7DDeKlogjEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260954, "uuid": "d4a750e1-0967-45cc-bd38-8dbcac0e2cd0", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260954, "uuid": "5a218095-0e59-43a4-9f73-1108e0d1b3a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260954, "uuid": "2f60e65b-8d10-4cc5-b4c7-57234f956516", "value": "91376fd5527d3bb781d7433c8ea3ade9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b654f950-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264660, "uuid": "6b59e547-1526-4ad8-a5c9-927475c2882c", "comment": "Malware payload (Mirai)", "value": "a86dcf51dd771cd9dad42c135009cbed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264660, "uuid": "6c45f51a-4598-4449-a9c6-6a2ab86deb1e", "comment": "Malware payload (Mirai)", "value": "cbd8bd953b5e66e12b24087ebedcf8042f8e7ecf653660cb92f85b7a9c3125a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264660, "uuid": "5fb32148-f92f-483c-929f-75acfb8bd1a1", "comment": "Malware payload (Mirai)", "value": "6384015a060a5c56cafa4931b049409b2da615f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264660, "uuid": "fdd0e46d-dc54-440e-9a29-4ea2b0834f5b", "comment": "Malware payload (Mirai)", "value": "32d12cb82d78caad0bf8e6c2d024090b9bb3a553f5a8363808e7089e5ae7922680af7ee0fb1f4ec72255fd1ddcd7139b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264660, "uuid": "d4ebe2fa-c39d-4663-87b8-9e2dc3a1f0e0", "value": "T112D3E701F9104B6BD7C2ABBEF745A2CE77719D982F833306D71979B027D06A96E39204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264660, "uuid": "fb507947-d8f6-4945-a9db-83bc6549c0c7", "value": "3072:cebA0GtcG7jLq+rO6I3JG3ci0QWBapd0yJzFnB5RNJ9LQ9FayujDuKqNXVHDLd/3:cebAjnB5j/cMyu6XVHDLd/kQcHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264660, "uuid": "a5eb4d9a-ca25-4caa-b0e2-8c43d4fc856b", "value": 141625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264660, "uuid": "cedaa66b-5e2c-44ed-9c28-597d676e9ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264660, "uuid": "8fb5c08a-c54d-4b1b-9759-e9dfb89d97ea", "value": "a86dcf51dd771cd9dad42c135009cbed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a32a69-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264356, "uuid": "c26c1fc6-f7f9-40fd-aabc-6be7d6514fce", "comment": "Malware payload (Mirai)", "value": "0c35363087e0c4d320bad506c9467ba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264356, "uuid": "b6408f3c-9f2b-4d6b-96c6-5a732c1e79ea", "comment": "Malware payload (Mirai)", "value": "cc835c2aece0908b6bdde4a05450452c69c20ccd0e30dda2806964b549730e0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264356, "uuid": "768deb54-ac1d-45fe-9ee0-a2f81af1644c", "comment": "Malware payload (Mirai)", "value": "7b639cc6e39418a362963c1735ec19d8d8a87664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264356, "uuid": "c15f4db4-8020-45d4-8b7b-c698d3c7061a", "comment": "Malware payload (Mirai)", "value": "e5d29ac607c6ac6e8dbd5a875ba5404aa28f83926a04bde002a95a424cb7b65caab80ea48491248780b867babf862cc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264356, "uuid": "d1917f7d-ab28-457e-9282-8cef32167783", "value": "T183F2F136C5DA4F00D44BE036CA6EF96E1F22F134612C94E1ADC421779AEBEA97580369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264356, "uuid": "7526c230-51d9-40e1-b153-3417d886e962", "value": "768:QkJ7X33ezMJV9qRt8g5WgXQm/tnhopMahvfYP2lLfft5nbcuyD7UHQRjv:QkRezAXg5WgAm/tGlgP2Z95nouy8Hyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264356, "uuid": "d3e5a2cf-18d7-4348-aed6-2148ff53325c", "value": 36144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264356, "uuid": "de2281a3-2197-47ea-8606-eb283de375f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264356, "uuid": "bd7eb0f7-ed06-4a53-8e74-31fca67731bc", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acd2233-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263754, "uuid": "9741cbc1-5955-46eb-9f7e-a46ae9bd42a5", "comment": "Malware payload (Mirai)", "value": "cd326a3030f7944b3011b4c332c3d460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263754, "uuid": "2b5b6b63-7857-4c1a-9cc7-dc2c52eabe6c", "comment": "Malware payload (Mirai)", "value": "cd9325994d498c605a9bd35e9ab6241eb6e9baa9c5d7c627d87d4fbfba6da00f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263754, "uuid": "4ccc2352-2e33-4a94-8cca-38c390ff2d6c", "comment": "Malware payload (Mirai)", "value": "4049f53f5062b1254200da5262752e9faecd7c4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263754, "uuid": "98bc8ce4-2ed7-4c19-8e0e-f1e896197053", "comment": "Malware payload (Mirai)", "value": "c91bc1fea59d107a959226dca16e37a4947b874cb3275c1c09de0cdca25c8f7138b35c4775524f39282b005d522b62bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263754, "uuid": "5367e4e4-559f-4421-961b-06339425b4a0", "value": "T14514D5916C816A2AC6E023BAF9BE508E332077E9D1CFB16BCC614B0177C555F0C67B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263754, "uuid": "defea285-ff41-4c1d-b682-208da5708fdf", "value": "3072:UYtlfxx104gSM81YxHVda6lPEnLw09HrMwyyP:UYtlfxx10PZiw09LMqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263754, "uuid": "b5deb9de-a60a-49bd-9441-41f7d140428a", "value": 193816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263754, "uuid": "169f018e-c02e-4aea-b015-41c25034ed9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263754, "uuid": "b9812237-fcb2-4248-a206-a8e81cddc080", "value": "cd326a3030f7944b3011b4c332c3d460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034a6b76-e1a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682235153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235153, "uuid": "500ec531-3b27-4844-b51e-120ec5b57d11", "comment": "Malware payload (RedLineStealer)", "value": "09ac226132777869a4b3f22ac1bb0304", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235153, "uuid": "f3934a82-9913-4fb0-9439-56d2977572d5", "comment": "Malware payload (RedLineStealer)", "value": "cdb7bcbc0269d232a548b54543e5a98b109ca94dd15cd4c99bebaf6c458f9f4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235153, "uuid": "5fa24a20-a2a8-4253-8a39-611c32902789", "comment": "Malware payload (RedLineStealer)", "value": "9628fcca631b410bc51741973139904c75124e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682235153, "uuid": "ad33b91c-ca1d-40f9-9869-ebd3de28ad5c", "comment": "Malware payload (RedLineStealer)", "value": "23cd886992c74e47611e08664c4fe4c3d7f5ceef8b713484811278d0fb8bf40137b4d5eea7e9378bc49e4028d0d37f93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235153, "uuid": "48501d67-db0a-4276-83a8-67d6a4bbfec3", "value": "T15D452301B592F5B7E2EB427006B1C5747A7BB8609560978F336D6B2F3D313C29B4A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235153, "uuid": "7c84eb9e-208e-4c6e-93df-f5bc131d4307", "value": "f88982a603d93c22b0731529c5e6f4b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235153, "uuid": "d2b725e6-e961-4041-a1cc-b25523900eb5", "value": "24576:+Z/i8viZtNWceh50KP+8HInX9+nsbl54gOOm1J30y8zY:ai86ZTu7tWntyshqgOOoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682235153, "uuid": "27c223e9-9173-4467-826e-6c8835937725", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682235153, "uuid": "2f8ff199-525a-411f-9701-892df4e84675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682235153, "uuid": "e290c03b-8d28-4b95-b3fe-1da378ac0879", "value": "09ac226132777869a4b3f22ac1bb0304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87562f82-e174-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682212612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212612, "uuid": "2bcbf9f8-2865-4b88-b9fa-31b11ad9c6e7", "comment": "Malware payload (RedLineStealer)", "value": "04e3a2f06cec02dd1f57f00ae86ea933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212612, "uuid": "ac88824b-667c-4363-80c1-c755b8d6e073", "comment": "Malware payload (RedLineStealer)", "value": "d4fcfc2072716000b84ab09f56cebb9d5fc97b662b54faaf25795362650ef926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212612, "uuid": "3a5b86ff-7378-403b-9049-de13eaf64fc0", "comment": "Malware payload (RedLineStealer)", "value": "9d5a5b902ea6e32f6c96347fe021379b18a94203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212612, "uuid": "84285e64-abfa-4fdc-a76b-0064eb4b4086", "comment": "Malware payload (RedLineStealer)", "value": "ce7504bda05b748f59cfbd3e359670d13ace83acfcc5bf5762d76fe47bdac02d018c5d384369d5d7519f71b057ddcd9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212612, "uuid": "0de6916d-caff-4475-a2f1-4963f5273361", "value": "T141352357B6F89032FDF52BB05DFA07A30E3AFD156F7446A72615A94A08339D4E4303A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212612, "uuid": "2d78b7e9-1bcf-419f-ad1a-b2e72c8d3fbd", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212612, "uuid": "2fbb2d0d-3a9c-490d-bd8e-ff8d539ea9cc", "value": "24576:zy/HE8t21GF+j4hkuhCCrpWGL4FxcQcjf/uU:G/k8Nrxo64z0jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212612, "uuid": "31f44217-f3d4-47b0-8eee-8788ec66daa6", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212612, "uuid": "692352e6-70cb-427d-baa8-3559ece0fb11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212612, "uuid": "6c2a6121-cef0-43f8-9769-10292029ebd2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92276271-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263740, "uuid": "2a4fe7a6-b1af-4412-b63f-9712f0a4e1e2", "comment": "Malware payload (Mirai)", "value": "e10031111bd44e0978c0a8c57fb0d4e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263740, "uuid": "1c8f6854-c11a-4381-b447-8c396bc12ce7", "comment": "Malware payload (Mirai)", "value": "d516bbfe4556199ee7e2f9ae5f62b8b75c6505a70e1f978524b584d57eb60279", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263740, "uuid": "dcc1597a-32cf-4077-89f7-466c9d9f84ca", "comment": "Malware payload (Mirai)", "value": "b7ebf2d88f28ded82ca31e2d7bd05126c9519b13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263740, "uuid": "9ee86a16-43be-4028-bae0-f77f12e83d64", "comment": "Malware payload (Mirai)", "value": "dbbf2d0a1af78a35896d65e784aab57e6b8a223524951f24540243bd5f12491abf1108fe0b91f5d9dc6a0b7ff4e88713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263740, "uuid": "cdbd5dc1-7c11-4815-833e-9a24ea75d993", "value": "T16604852B7760ADF7ED4EDE3B0289460110CC8D4906DA5FAFB365E528E36A54F90E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263740, "uuid": "01f58e80-a5f5-4076-a449-afa52ae0b138", "value": "3072:rMrILlCWALXaPkLZVxL4oxJE8UDWoteVginryf+lsqDpyi88s:IrglCdLXaoZVxL4obE8UDWot5iryf+lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263740, "uuid": "c97cd31c-145d-4134-95cf-2649579f0e2c", "value": 181569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263740, "uuid": "bfd23c11-d283-4280-9e2d-5f0d8074d187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263740, "uuid": "58a2c684-bec5-46d9-b77f-ec306a58c448", "value": "e10031111bd44e0978c0a8c57fb0d4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f98ef3-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260877, "uuid": "c2947487-c9d6-416c-8f8a-46720c83fa56", "comment": "Malware payload (Mirai)", "value": "36634ac2ffdd2d20303221bf016b7ae3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260877, "uuid": "fd543303-3eab-4b7f-a5d7-80ad81536f2b", "comment": "Malware payload (Mirai)", "value": "d70d7024851d8542d1266ae07cf4962b9d7728f3de9820118aa04b8a137a47bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260877, "uuid": "97e8ed34-9dbb-42c1-a7bf-6c507c20d6a9", "comment": "Malware payload (Mirai)", "value": "d7e3e494b32efb01abb37d0314697db5f9809672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260877, "uuid": "c5c0ec58-2816-45d8-9455-9cd228d0057b", "comment": "Malware payload (Mirai)", "value": "6fe24d62094fe23b659363d671a0d7f52eb68ad9181940a86e0bbf8a79b8b3adea4e5c09cd3c1b642116df38e2dfe6be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260877, "uuid": "da8d11ae-f3e3-4518-b907-e0c3ef52f493", "value": "T125F34B06EA418E13C4D627BAF6AF4245333397A4D3EB73069D14AFB43F8665E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260877, "uuid": "a555344f-6f27-4982-8059-7af6e5226a59", "value": "3072:kVylQv0n3RmJCBfaWaH6bBRdpucWBU4DICaBSi8QM/9tn94u/mbWjhdo:pS80iyWaH6bBRdIcKMCuSi/M/9F/mbWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260877, "uuid": "f152445b-a04e-45fe-93d8-90f5b29e82e4", "value": 165092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260877, "uuid": "c48e97f5-9f3f-44b1-976d-a01f3b45b2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260877, "uuid": "bc6af0cb-c034-41e1-b8bc-af464905dea7", "value": "36634ac2ffdd2d20303221bf016b7ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48341128-e176-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682213365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213365, "uuid": "352f91c2-0c62-451f-acbe-b3c1f0b9fa00", "comment": "Malware payload (Rhadamanthys)", "value": "3a998df7e104ec9de35e6d944100797d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213365, "uuid": "e779d00d-eec8-4b2b-9e8b-ca67b7dd2aa8", "comment": "Malware payload (Rhadamanthys)", "value": "d74fc9655654c48db268f34463e10189f0f920a6bc48b49914601d5b2f7db7f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213365, "uuid": "c6797bf5-a184-490c-a399-f66c2cbe5041", "comment": "Malware payload (Rhadamanthys)", "value": "a52c4a39a5efe12479776a035612d828f3fa7d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682213365, "uuid": "2186c77e-0762-443f-b55d-8e2f3598a256", "comment": "Malware payload (Rhadamanthys)", "value": "6353c23390c68a6164e0ba5297c73df96ac35dc31d6ce5fad0e8d7af4bd6d8568b927ee8b7ca7c6f465452c80eb61d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213365, "uuid": "16961331-52fd-460b-a4db-81e56098d6b4", "value": "T18A54E111B6F2C476D5BA85384470CAEC1FBFBC62665481DB23D82FAF2D302D16B66316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213365, "uuid": "fe13eb36-f97a-47bb-9a0d-8ce01f4566da", "value": "c36577d8970592a39f985677fb550958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213365, "uuid": "ad88b390-710f-4450-9f28-2b234af4105b", "value": "6144:B5Mg5QLWwiA5EtSWRMYylHFzyY2hUEc4Jn0tU:B5MZLWwt5qjRMY2HN2hUR4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682213365, "uuid": "864bb08f-6457-41ff-a2ef-e0d3807c062e", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682213365, "uuid": "a857c586-81d6-43a6-8d20-19dbae128858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682213365, "uuid": "f07ee43c-af08-4a07-9e91-4d84c484092a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f837328c-e174-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682212801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212801, "uuid": "bf05c35d-4d92-4579-ba23-6be3a5ba8f90", "comment": "Malware payload (Amadey)", "value": "7cbee43a85e6b9fedbb3c7ca65236e0f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212801, "uuid": "a22513dc-9400-4d9b-bbc0-aa01575b989d", "comment": "Malware payload (Amadey)", "value": "d791065638678b872686dcc8d1b8b0ad55570b0f742be939f582da45d438141a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212801, "uuid": "dd88913c-da33-4919-903d-da53856082c0", "comment": "Malware payload (Amadey)", "value": "cf5c7e772561baaade2ba95c6dcfca71e2e5feb1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212801, "uuid": "bc3cd560-d64f-495e-8667-aed86a3f3247", "comment": "Malware payload (Amadey)", "value": "1f8d58a3ca9cec3caf3722a394952bfef08f7fe963eac4e32aa6c70e85e7ee86220e44be46f29af06b2580f6c8ae56e9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212801, "uuid": "8d66707d-4972-4d4c-8faa-254e7a39e711", "value": "T192352316A6E88131DDB917B099F712871A36BC54A575C3CB268BFCC918B3AC5E53033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212801, "uuid": "22d44891-67f8-437d-bd34-9596c1dfd8a2", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212801, "uuid": "bc744e27-6a16-46a2-b448-d24b98d28056", "value": "24576:gyxls/GwuLYVk7Vx3tuS4f3uXQojQQpUoPC4Q:nPs+PLxwFvSjxpUsC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212801, "uuid": "c63b455c-ebd0-4f6f-9571-5c085006bce1", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212801, "uuid": "81e05093-4a98-4550-8900-3ec37932bf56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212801, "uuid": "80fc0165-21e4-4265-a62f-f60d8908e871", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bb3891-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263746, "uuid": "269c54fa-ac92-41f6-9bab-8a5303af8416", "comment": "Malware payload (Mirai)", "value": "9896c8c6e9baf0bd74d3c1041c5d66cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263746, "uuid": "19c02469-c719-4e32-891d-4cfaf52313b4", "comment": "Malware payload (Mirai)", "value": "d82abf5d840489c22a49a27e039c2899d1e99eb792b1bde2a8ce9502141c51bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263746, "uuid": "2ec7ea2e-70dc-408d-b942-d2d982d1c370", "comment": "Malware payload (Mirai)", "value": "e29fe66158df39412aee95123e59648cfb46f2fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263746, "uuid": "488f08db-3e0a-4f0f-9798-6f8251140ed3", "comment": "Malware payload (Mirai)", "value": "21a9718b3da96c353f429dd2b151b31f85ad388c444e2d14df8fa95227a1dc8ee20e5865459a08487336257ae867432f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263746, "uuid": "bf6a680c-ca9b-48fc-b5b1-9152aa6a3c22", "value": "T1EB041A8CA4031E6CFA87A8BE94614F59ED515350B1D31B1F84EEFED33D2226F9E46881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263746, "uuid": "7d611ce3-41d7-4f3a-aef7-c1a3b8ed3258", "value": "3072:FfF1RNcVDxSShv16jITM6b4XLVQMpfB4a2i9k:xRkLv16uZ4ZQMp2a2ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263746, "uuid": "24b99897-26f3-49e1-b065-d21f231d704f", "value": 175420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263746, "uuid": "0b7af8ee-9179-49fd-9dbc-92d5ed39a850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263746, "uuid": "ac74163f-01ed-44b4-b190-ab0658bdebdf", "value": "9896c8c6e9baf0bd74d3c1041c5d66cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2403e964-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260978, "uuid": "51227c02-0e13-4733-b344-0ac7a904ad3e", "comment": "Malware payload (Mirai)", "value": "ae067648dd659e85e347778e5a4fbae5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260978, "uuid": "c4fb478e-f5d5-45c2-8ab6-d6bfde76513e", "comment": "Malware payload (Mirai)", "value": "d87f4e53a4462b6a7af30db107206247fd6a06a687481b4c437ad8169245ebbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260978, "uuid": "5e9ff0f4-5587-48ef-9332-535df6644e72", "comment": "Malware payload (Mirai)", "value": "8af37aaa54b6e85bbfe39692121d8551453ffaf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260978, "uuid": "4fd9cb5c-aaeb-4cce-80c2-2a489b1c0ded", "comment": "Malware payload (Mirai)", "value": "678a4dadaaed6fc082711666074aab1651ab7355f3acdf64af2e407fe2f4c62dce5770305371e1dbf79e7aaa7c4b35c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260978, "uuid": "08c11b6c-c83f-46c3-9901-9fcce8fda5d4", "value": "T180B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260978, "uuid": "e54cd285-446d-43d5-a2b2-6462adbbe018", "value": "3072:pC/4rdZHsXsZwwR9nNk5mm/QcuLmHniPNb:pCwrvHwsZwY9nOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260978, "uuid": "60e60504-1d40-4e32-a5cb-cf99060ae304", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260978, "uuid": "05b75f63-a15d-41cd-8a24-cdd015390d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260978, "uuid": "6c3d5183-5062-402e-ae29-d701875d07cc", "value": "ae067648dd659e85e347778e5a4fbae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b59d46-e1b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682242278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242278, "uuid": "b44d574e-06ff-49a2-a16c-3db7a20d1e30", "comment": "Malware payload", "value": "fa24733f5a6a6f44d0e65d7d98b84aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242278, "uuid": "349ce867-300a-4c78-84a3-1aa76d88260f", "comment": "Malware payload", "value": "da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242278, "uuid": "56049135-331f-45b1-8f46-b232d4065dde", "comment": "Malware payload", "value": "51a62beab55096e17f2e17f042f7bd7dedabf1ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242278, "uuid": "bd50a6be-f12a-48a8-b9da-f24122ef0004", "comment": "Malware payload", "value": "62d5ce966c1fa2020bc9afce264537b85021dbe13c08a588c87a71a644710ffd02d019dc517f06f7547d9dc8f2e14b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242278, "uuid": "2182cc59-6a47-4f88-aeb5-af0b107d50c7", "value": "T1F7269D30364AC52BCA7715B11A6C8AAF91197F750BB254C7B3CC2D6E1BB49C34632E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242278, "uuid": "c186afd1-c0fe-4308-bdab-d503f94c2c35", "value": "7c194251e86188363a60c4bd78b0d506", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242278, "uuid": "935f7f55-c572-414d-bcc5-ab71dd724eda", "value": "98304:5YoIz3Q2HM5Qp4WzMIaX8/BG6v/gIV0sba5mFkDzLb:5i3QDCpQaJGkDegFwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682242278, "uuid": "a64b4ecc-748c-414e-8179-238b08bba809", "value": 4724720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682242278, "uuid": "4064a0ab-46a7-4da0-90d8-28fe8e96888f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242278, "uuid": "1bbdba8d-d98a-4858-b1c5-32ffb69b9c8a", "value": "SecuriteInfo.com.Trojan.GenericKD.65705581.16120.15146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24e09e1-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682264653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264653, "uuid": "a60ad49b-4c5f-4402-9a5f-193e665228a0", "comment": "Malware payload", "value": "5fc6a78bd47dc8666e0885fc37650e78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264653, "uuid": "b6420ed6-bef2-4ad4-85e0-7876ad37be7a", "comment": "Malware payload", "value": "dafa6e4c79309d263ffff40f6e67a0da6259b885f4d1c8422787d9e130401c0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264653, "uuid": "14c4a178-3672-4f85-99fc-624efc932dc3", "comment": "Malware payload", "value": "0b02e62d6cf9a1b984165202df6d092894b48fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264653, "uuid": "c93b9c47-47b5-4826-b9f4-3a561f3c728a", "comment": "Malware payload", "value": "26439362c104975287905702bf92aa05d9fd2b9d1c7cece77a545f61809fb9d0fa4568a9a30b1a7b231209c7e734887b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264653, "uuid": "b937bd12-cbae-4984-9f6f-a07b11b7dbec", "value": "T119D3A6AF7F280397C48785B0396B73F00FEA9DA11391A1C2A15ABE406F725747D277A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264653, "uuid": "161abdca-3cb9-4bcf-a1cc-1dc6b76d92bf", "value": "3072:AY470V0Pk+9IidqSLEj9Yg1sYQyi60c0IZrRgeQs:AY470WPkCIidqyEjRJi60c0IZrRgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264653, "uuid": "540fc24a-37a2-46fc-9a05-612b2895303f", "value": 141079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264653, "uuid": "8676a27c-3602-4034-9876-6d29a389ffc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264653, "uuid": "facb5184-e5f5-45ad-8f38-2a31347de169", "value": "5fc6a78bd47dc8666e0885fc37650e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2911ce26-e174-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682212453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212453, "uuid": "738b7fc2-5973-412f-941e-143cd9282c4c", "comment": "Malware payload (CoinMiner)", "value": "41ab08c1955fce44bfd0c76a64d1945a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212453, "uuid": "152547db-2092-40a5-9f78-edc9c2844b92", "comment": "Malware payload (CoinMiner)", "value": "dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212453, "uuid": "9c4579fe-ed8a-4f35-aa14-43fe0547aa61", "comment": "Malware payload (CoinMiner)", "value": "2b9cb05f4de5d98c541d15175d7f0199cbdd0eea", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212453, "uuid": "996e96c4-c8f3-47d8-a888-3c29ba6d328d", "comment": "Malware payload (CoinMiner)", "value": "098acb197fb2f7e43ed829cf7600b0bea879f78527cb76311bc8228544bcd356fda08608ab08da222eda31c0c8675c20", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212453, "uuid": "4018bd94-49b4-448c-9dc0-ffd58772b7c0", "value": "T13846E1B689F7112AFAAA4538157A0DF4157F69A717CC1DB62B04982E027E90C33EDDF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212453, "uuid": "2ea03c55-488e-43b0-a84b-aacda16850ab", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212453, "uuid": "686a342c-9dd5-4495-afef-f9cd746a27d5", "value": "98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgIT3:vIlQIN33nVKboT7MAwtCYzQQjn46yQls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212453, "uuid": "de0d0a83-dcc1-449a-b22e-4ddbbfc25e7e", "value": 5689344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212453, "uuid": "ce4677f5-884d-4661-85e2-b796b22dbb18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212453, "uuid": "6b49b337-67e7-49de-9c7a-88e76b6592f3", "value": "tmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1679f32a-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682258378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258378, "uuid": "d9047778-f1cc-4f8e-b55c-f7856bc93483", "comment": "Malware payload (Mirai)", "value": "e42500edf4ebe1a355c4b05741309afb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258378, "uuid": "ad1f18b1-441c-4f6a-86a0-473902ade718", "comment": "Malware payload (Mirai)", "value": "dd9e52e4c6330015145403c4ea48ad5276a8eb4f39f34bc91e2de0b7f0c2a119", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258378, "uuid": "c83dbcb1-abca-4dc5-b483-1693ae25e79c", "comment": "Malware payload (Mirai)", "value": "42f5701eba15edfc8fe800425ccc82c93162f162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258378, "uuid": "d37e1851-83c0-4b22-8a68-f9296b2bb3b7", "comment": "Malware payload (Mirai)", "value": "696ee8fa7b67cd6d6ae4d23772fead3a40572d5665ebd9c97200ee651e033993c774f203c70cbca23d72bfd818de58cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258378, "uuid": "2eb55fa3-955f-4a62-bfa2-c1d66b9eb492", "value": "T13B430981F44F81F2C44B497050A6F63FDF31D9AE42B1D62EEF99AF32DA675429101A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258378, "uuid": "d373f6f9-7004-4b76-8b76-17baa53ac4d6", "value": "768:SfYcj17BglTIJ/sITKUEPgK+4CaS7HA691CO1zBAx3/9S2BxKVhcTqmq16US0sP:6DgIJ/sITaoECaCzuOhYqmG6R5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258378, "uuid": "94c606c6-640b-4500-be03-a88ef78440d4", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258378, "uuid": "7fb81314-523b-40ab-b61b-0a92dd462f5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258378, "uuid": "37b0246f-f8ba-46b7-8350-98eb154483d3", "value": "e42500edf4ebe1a355c4b05741309afb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67829ac-e170-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682211026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211026, "uuid": "fbb4028e-0bb6-4ab5-b3db-58c1a3da1d91", "comment": "Malware payload (Amadey)", "value": "1dabc51ccfcdaf6f4624ea26c4e069ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211026, "uuid": "dc549e9c-fb7c-4ff5-aa6d-8f719509299f", "comment": "Malware payload (Amadey)", "value": "de14dd0da373f690f2e016c9e1cec34c07cea13160a605d49aa44c9ac26bc7ba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211026, "uuid": "83f201bd-e83d-4e9a-a0f1-2921a5e8826e", "comment": "Malware payload (Amadey)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682211026, "uuid": "d251b869-ef0e-409c-a91e-a0758d19bbf1", "comment": "Malware payload (Amadey)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682211026, "uuid": "b875469d-c8c3-4266-8bf3-c4da00c67470", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682211026, "uuid": "00c3ebfd-31ca-42a3-be64-e7a81dfec77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682211026, "uuid": "7498872f-c497-4c53-8c0c-94c09549d04c", "value": "de14dd0da373f690f2e016c9e1cec34c07cea13160a60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f7fa68-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260929, "uuid": "6300d590-127f-48a8-9fd8-7ae47d222063", "comment": "Malware payload (Mirai)", "value": "6031d626e54701f9fd56d9642047c541", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260929, "uuid": "f4f7a254-d9a6-4ef6-a34f-beb314481023", "comment": "Malware payload (Mirai)", "value": "de1da0cc66059320835d36f474b203a21cb1dfa4ce93461b20942ce55236ef37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260929, "uuid": "481077b4-36c7-497c-ba55-1edb6c563150", "comment": "Malware payload (Mirai)", "value": "245a3700e34e5b5131ae4363cbc4e4be5ded8e99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260929, "uuid": "c81fb8d7-e270-482d-a537-0f79f5abb769", "comment": "Malware payload (Mirai)", "value": "a3af8cbb681a00ea3e30fa0a3af4875d93ff39d3236db307260d70805aa40cc7e99cc6781779257979b4e7512c21e05d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260929, "uuid": "13e466bb-608a-40ac-82dc-a40fab3592f6", "value": "T1C6E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260929, "uuid": "bd438114-5732-44e2-90a0-a0df815fb154", "value": "3072:Cv/WwsLgaq353qHiCOvhOppqkDQHbeskmhxQwoVSUNu:KPLaq351hOppqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260929, "uuid": "cd8c6223-f401-4735-ba8b-46802a417e52", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260929, "uuid": "c85e667e-f05c-41ce-b40a-5fbc64f62af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260929, "uuid": "bce5ca85-d67b-4329-bfbc-64cb8c96c248", "value": "6031d626e54701f9fd56d9642047c541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6cfe9e-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682264646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264646, "uuid": "28af846d-db09-49d1-9d37-b0bef2c9e8bb", "comment": "Malware payload", "value": "4ccf1c3b1dd9a3e50daca464e6f9ba34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264646, "uuid": "f0ddb1f6-bc17-499a-a403-20bb3838cd27", "comment": "Malware payload", "value": "de22254b96a8d3749411954c71fd6975a93c11139c028571832090054e8431a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264646, "uuid": "60030d35-548f-4ca4-86f3-2100d1bd2a8b", "comment": "Malware payload", "value": "f2fe05f4d1c519d450f4d50b713783712f0cea1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264646, "uuid": "5c3d8e97-14b2-4423-a15d-e19c13dde1de", "comment": "Malware payload", "value": "2c0f80dc1bc93d9832c41b6f3ee589f8523e30dd14b2215b7c5e0fc4716891bea180640d5ef3312699a0f96401067517", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264646, "uuid": "4f41675a-cb71-4970-a67c-b662b1f06913", "value": "T1F1C3E8834A20DEF7C053AA7137B55528B795BF690B1E0A867E1DB6A00F3F4CE741E660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264646, "uuid": "28a06847-caf0-4c0f-82a7-312b55c0787c", "value": "1536:LqpBfwh06oMuexoKGShgsUIgs4MCJYGCY3kVP5vXECFHUhGK2zZwFRRT0IAf1Bgh:mPmo56GuUIgoG5go6wFLT0IA9BgeJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264646, "uuid": "913179a0-65a6-48ea-8d76-4c780d6167a9", "value": 126555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264646, "uuid": "9aec3f70-219f-4063-b319-839e53014303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264646, "uuid": "47cbacb3-549a-4643-993c-a25e2217de8e", "value": "4ccf1c3b1dd9a3e50daca464e6f9ba34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd06d56e-e202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682273798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273798, "uuid": "e2ee1032-96a7-487e-8daa-15453670debc", "comment": "Malware payload (Mirai)", "value": "1dbd4fcf4b0db6225aa3a08ee6864c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273798, "uuid": "d62666ac-1939-4b8a-ab32-8cddd8fe323b", "comment": "Malware payload (Mirai)", "value": "e28befe222225334cf254580bb0e8e2889d146378e275cf47f971269aa650eaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273798, "uuid": "1f366e54-5cfe-4cdd-99e3-b1ade4bebe78", "comment": "Malware payload (Mirai)", "value": "a2b4ff969037a605f7eeff14adf0ad8a70366651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682273798, "uuid": "4a6572c8-9069-4435-b165-3441f3fb7bce", "comment": "Malware payload (Mirai)", "value": "3013e6f6b4bb415047ed5535402cb56e49541f4827d1f4ef0263e9456228d9a43ff38c1f06ff444e6d40d730b0de42a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682273798, "uuid": "a672f469-4229-4b89-b8c2-cb3d0cd47aaa", "value": "T19F436BC4F643D8F5EC8715702077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682273798, "uuid": "f1ab7bfa-4a56-4b4d-92bb-383129423a30", "value": "1536:JeESt/basV2rcZhG6ySN7na7lSR9zWOIaEjrqMOs:JeESt/basVTgS7na7QRVtXES9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682273798, "uuid": "f73b0cb3-dac7-4aef-99fe-f57e52cd7b6d", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682273798, "uuid": "1defad19-7de0-4d96-85e2-8021ba64feb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682273798, "uuid": "703c9487-f03a-4600-841f-2aece96927b5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e876998-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682212892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212892, "uuid": "a34a2b38-a93b-47af-87d2-6d87b88c10c0", "comment": "Malware payload (Amadey)", "value": "2616f7d3c8029ec798fde578205ec947", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212892, "uuid": "bb92cb82-cb9b-44c8-ac2f-4ac627f70ad3", "comment": "Malware payload (Amadey)", "value": "e34a9ec8b3e23586878ed2423cedf00a472b5ca128a48799f47fcb0270e12e32", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212892, "uuid": "44094898-222c-4b1a-9573-38e9eb9e7a29", "comment": "Malware payload (Amadey)", "value": "0d79912e293e9fc8ae658a2b203026aa1276d8ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212892, "uuid": "45fe5e14-03f5-4388-93b0-9944fcafe7a5", "comment": "Malware payload (Amadey)", "value": "560e21f0b08c4f0794be73df0c0a2f65028a79ee47748be7b8a3dcb93b98aa953dafb9c5721a567415fbe6e0de658aba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212892, "uuid": "f79bc41e-a1be-4335-ae73-7b85e1cbfd95", "value": "T1713523529AF4D471CDB40BB499FE12C30C35BC6657B94B977249DA8AAC233C4E630367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212892, "uuid": "2e983968-3429-4b7b-acd0-9b51de1cefba", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212892, "uuid": "f7b39c4b-fbc0-4bef-be18-6264e0b018b2", "value": "24576:7y8daGwAIWJMbfi9rZuhGDdM7mJ+oAoXifJ:u0aGea4Twiq1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212892, "uuid": "e49b0e88-39f0-41e5-9296-d314ca48ae52", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212892, "uuid": "eb31ee8f-48a2-482e-82a2-27f61d278e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212892, "uuid": "386f9f08-b2e1-4a6f-963a-8934c5035964", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b69d73-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682264635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264635, "uuid": "b4c0f4ed-ac7c-49dd-a4db-70d1318761de", "comment": "Malware payload (Mirai)", "value": "748e43153c64a792e49589e52bbaa73d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264635, "uuid": "f6e7edd8-2c78-46a9-af2f-8cf4e9748bbb", "comment": "Malware payload (Mirai)", "value": "e38ef6f77b8678dae48fb610936d5010fe754b762b413828eeaaac315b3b96d9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264635, "uuid": "2cac2e27-e642-4171-94de-e52db2f0fae7", "comment": "Malware payload (Mirai)", "value": "7dcc2fb4836f426ef06de412f54aac035d52e2b1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264635, "uuid": "127c935a-1733-4403-b739-ce69389fa39c", "comment": "Malware payload (Mirai)", "value": "a3259817b62849c29ddb47b5d13bf20bd567bd4841951a06207258e5e4adab5861cbe01c0f3d5433f670500472371788", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264635, "uuid": "310fbbf4-8dc6-42e6-804e-7371a102294e", "value": "T1E6D2E1E3511BEDFFD026A17B894F5690AA837C7F69120B4B15091CFB9B326BC9B019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264635, "uuid": "793f5e71-8b34-4923-acb5-01be2b36cfd2", "value": "768:8LS+No0K5UcwRSXUwoOsycBzM6/B/v/KuAGi2mAQx0J6:j5FwMlsycBz9J/vQ2mxy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264635, "uuid": "bdec0ee9-ee0e-435f-b110-2e95439b8075", "value": 28584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264635, "uuid": "402af3c4-3bd6-4ab9-95c5-1bdd8835420e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264635, "uuid": "8f0f4710-f092-4faa-bf42-612bb159a5bc", "value": "748e43153c64a792e49589e52bbaa73d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6a91e1-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259221, "uuid": "909c9ed5-c19d-40a7-b661-247b4912a026", "comment": "Malware payload (Mirai)", "value": "74e0a8de91f6222c0ab1134a1f4a3db8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259221, "uuid": "91b09d51-c9f1-443b-97d8-4293afaa1018", "comment": "Malware payload (Mirai)", "value": "e5486132753862372eff554c30bbb8446b4afd632a1a0c5f5bb9ac3ce9ac7212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259221, "uuid": "3a19a0a7-c52d-4851-94de-3cc53452864f", "comment": "Malware payload (Mirai)", "value": "f1442c42ccc27d97f02cb769b6643e4853fa70df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259221, "uuid": "8598ebb2-ab4c-446b-82c4-7148ba6eea84", "comment": "Malware payload (Mirai)", "value": "33b5d0184cb98553cc2bb44709d99d8958c95974407ab5995eea87389985c23ffb960d5b4dad7f7373d3a9170d4e6545", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259221, "uuid": "168b4e3e-f190-4f35-893d-4bd75d31104a", "value": "T1F1C2D0DEB5107C52CA9898F8149C47F3158A26C6629E8F1D37621BC4A0D754FF9CE8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259221, "uuid": "d1156fd5-8fc7-4305-8b50-78ef593c2b30", "value": "768:MLCUFskb2JgIs/E2+hHUY4sKq2B1ul/We:oCrJgHiiYYqw12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259221, "uuid": "22c9a7db-f579-49be-9142-a8c5d47e2085", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259221, "uuid": "5ab36b6e-6e22-4cf8-b9fe-abf4f54dcd24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259221, "uuid": "a0ecf7aa-75da-4625-87e1-ef7a9df13403", "value": "74e0a8de91f6222c0ab1134a1f4a3db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d81fc89-e1d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682254632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254632, "uuid": "997ca674-9bf9-4fba-a638-676c5300b77f", "comment": "Malware payload (Mirai)", "value": "6f8a7e38eaf81b0fd759ac3d135f602b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254632, "uuid": "deb60db5-0b78-4d67-b8c1-003ffc768e03", "comment": "Malware payload (Mirai)", "value": "e65749d4af9c055b823ebc5cba3aff8b83dff1d4245b682ada8f7025741de59c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254632, "uuid": "f490d758-9d31-4d56-8ea5-48bc0e4c0143", "comment": "Malware payload (Mirai)", "value": "b1a0a8d9e76766a5ca5bdf0b8e13a00cac5263fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682254632, "uuid": "f30af51a-f486-4d08-a644-904dca895c48", "comment": "Malware payload (Mirai)", "value": "0204cfc70644a2a9d47e6717212ea9180a902b1047468f4da4e151e48f992fbdb010a6830cb17a6026241f8eba4424c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254632, "uuid": "abd81416-1dd6-4407-948d-85ff09f724e4", "value": "T15CC2E1FDBDBB6E4BEE03123BA56C693381B4E094E359B2822385511264032FA9739DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254632, "uuid": "d44c2257-9d33-4262-a45d-1edc4386dfd0", "value": "384:M21DMwk8JPyGktDZVEXVZVBy6gIuFm4lSm4nnLZd1ZTTqX7n06/d5e5lypNy0Nd:vMwaDZqFbBy6g4021ZTTq1l5eT/0Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682254632, "uuid": "3d273d82-5607-4d0b-bc3a-6e663f73b048", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682254632, "uuid": "f20b8581-67b8-4a19-b093-31f06286fed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682254632, "uuid": "5a5f244c-4950-4c39-aac8-0bbf34c02d71", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee34456f-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257881, "uuid": "2ce6d75f-a99e-4c07-8d2f-5e4c305e0624", "comment": "Malware payload (Mirai)", "value": "cfbe5d562684f087e4f748e2e4b509b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257881, "uuid": "37ea4640-d23b-4457-b22c-7f59e6fefcd5", "comment": "Malware payload (Mirai)", "value": "e6ac09a3e1be72a4a5eaae19254c99be4f0b7325d0a12870043634d3b4a890e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257881, "uuid": "8b2d60f5-e0c8-42f8-bb79-561c7f0e8261", "comment": "Malware payload (Mirai)", "value": "0e53848759e6f3de44c847612b87678f9862d498", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257881, "uuid": "7190398e-cc2a-496f-a4cb-93d21ab0ec60", "comment": "Malware payload (Mirai)", "value": "9633fe71006165a948f4900bbb5e3765619cf2d7046bb285440c2679356078d34419053e5f4ae5c56cb27fa6495d84e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257881, "uuid": "9d3a3662-5ce2-468f-a166-081f188007e6", "value": "T163333BD6B902AD7CF98BEABE80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257881, "uuid": "3d34fbd1-733a-4157-a450-8786672bbc4d", "value": "768:8CeKEfhe5XdrbenXI1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380DS:dsfIBZeCl5nKFx+imvppqmUJQ6Lc8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257881, "uuid": "92bc599d-47dd-4a08-83d2-1f00d03329da", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257881, "uuid": "5885ead7-1f78-48ed-a873-7ee7326a6bc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257881, "uuid": "a83368ae-151f-4197-8194-a29a24551b61", "value": "cfbe5d562684f087e4f748e2e4b509b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d64513-e18b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682222568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222568, "uuid": "db2ea3fb-99e1-4617-b9c0-8919602a37f9", "comment": "Malware payload", "value": "b2c832a13bd4b9de206da110a6bc48c7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222568, "uuid": "a86a4d7e-e42f-479f-b50f-1dd56534bd08", "comment": "Malware payload", "value": "e7ea11cd354d132a7d1dd120d907687724ad9132cb0951b879ed02cdf06ba72f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222568, "uuid": "31d2f254-4622-4e73-80ea-6475eca542b0", "comment": "Malware payload", "value": "7433e1796756188f3b6cc59644c84915715ebd0f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682222568, "uuid": "230e69d2-4a6f-4196-81f6-535e0f498d4c", "comment": "Malware payload", "value": "51b29eaedfacd3f9e607a995e48cb1d13676a6a5a21f7f585c650363b347e4ff71f6248615d913dd028e7e7085f52ffe", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222568, "uuid": "67959783-4305-4ed3-bc75-2364af7f6069", "value": "T18755F1017AC79732D1BA0230257FA7B06B7DAC305EA5861BA3D47A1D3D71390A325FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222568, "uuid": "02e77a67-970d-4c90-8073-a158383ba847", "value": "24576:kEmOxtwYXIBTwrZLiqqHUitwwEyDCejj6Y:kEmEt/IBErJiNHUrwP+iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682222568, "uuid": "8659b155-e446-4959-bfa6-2465e5d125ee", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682222568, "uuid": "b7a77f67-0af2-4dc9-8003-568094b809dc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682222568, "uuid": "8c23b855-86da-46cd-8832-fa8b8fb93671", "value": "GPT4 1.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ac840a-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682257887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257887, "uuid": "19e8e4bf-2c02-492d-bdc3-a322e1f9f63c", "comment": "Malware payload (Gafgyt)", "value": "715ea8d8ce6c392eb7982e2f899873be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257887, "uuid": "094030b6-8449-4714-9e75-42a0480c8c92", "comment": "Malware payload (Gafgyt)", "value": "e875ebbe6a6fcc0b34acc211eed24bded6b3c180a1150695e9cad7d17dfc92f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257887, "uuid": "6784502b-be4b-4429-add5-c24ec0162621", "comment": "Malware payload (Gafgyt)", "value": "7c1ee2b8809aea40e82c167fb74a6d4d7e6ed46c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257887, "uuid": "4f352847-90b1-4272-9a55-e3978bcf1359", "comment": "Malware payload (Gafgyt)", "value": "b54406e3d05135b3cb2caffd02918beec7eb9ba67ffddb3c40127df6e21b44e5a2d34bd46eb954a302e49689d7d91fc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257887, "uuid": "064eb86a-45fb-4745-8c59-36bd7a90eb51", "value": "T16FC31944FC45832BC2D267FAE74E02DC37359BB8539B33256A389D742BC57A86D391A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257887, "uuid": "4edf7d45-0226-486d-b829-51cb2251f579", "value": "3072:PftTwu3bd8orWxT7b43nZZkm72MhQLvWlg9vN0:Wurqo6l/43Dkm72MhQLvWlg9vN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257887, "uuid": "a9ffc3a9-964c-4de6-9c7a-29295cb9c836", "value": 129514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257887, "uuid": "6c322037-93b7-4c53-9362-24c6ddd7f496", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257887, "uuid": "4174a735-1bd6-4eda-8327-0ed65fc68617", "value": "715ea8d8ce6c392eb7982e2f899873be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a502a8e-e1a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682231541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231541, "uuid": "a39862ac-266f-4b48-88da-c065e97ff1a0", "comment": "Malware payload (Smoke Loader)", "value": "89d0fbb5d7a66fc63480882424bea654", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231541, "uuid": "715ea0fa-8a42-466f-82c1-47c7a6014af4", "comment": "Malware payload (Smoke Loader)", "value": "e8995f4e77d8b6e7da1173d0439e9844ae5c3307ad7184253a71940d130a4a05", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231541, "uuid": "f0cb950b-ab7f-406d-8420-6966bbd62285", "comment": "Malware payload (Smoke Loader)", "value": "8c7aaecf5e50ab46c890015c91e18f757d90b612", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682231541, "uuid": "0f6d9848-5976-49c9-accd-ea43a82beefa", "comment": "Malware payload (Smoke Loader)", "value": "7865c661880e36e91949af231267c247076062ed6ca6ee653c23a00f1fc5d0cfc9bc12692b8861e4d06cea21d2ad84e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231541, "uuid": "3c4bd535-4912-4018-9edb-54dd654f22ba", "value": "T19434C011BEE2C072D9BF85344470D6A46E7FBCA35765829F27182BAF2E302D19766313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231541, "uuid": "46636e8c-cb1d-4fa5-a3fb-5288183c221e", "value": "c36577d8970592a39f985677fb550958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231541, "uuid": "d32f98d4-019e-4606-ae06-c7ca8a225b32", "value": "3072:4fdJm2cOkZ9Dq8GkA6FUndY61xlWfXLrm514w8ZF:4fw9ztJFUndDDlOfC4dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682231541, "uuid": "292ab0fb-e841-4984-bee5-056f8fc84927", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682231541, "uuid": "05f54973-4b0e-49ef-ad78-b36e85238469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682231541, "uuid": "f8ea6e8b-8dd6-4219-8e06-0616f59c3eae", "value": "89d0fbb5d7a66fc63480882424bea654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1594267-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682263765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263765, "uuid": "0970130c-d2d4-4b9d-9c9e-ef20d565bdbd", "comment": "Malware payload", "value": "a44d327febbd2a46a4889207e2b756d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263765, "uuid": "56f8fa35-f554-4490-9cca-1a46ce7a3226", "comment": "Malware payload", "value": "e8b9660054356da6a23a61794a8118a76afe7f7f41c20443a35ce63402dbce6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263765, "uuid": "178cc957-d9ca-4353-98b6-8c70fd140720", "comment": "Malware payload", "value": "7530fd2444914b143ddf5e471e671fb3af767693", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263765, "uuid": "b4cdd771-ef40-434f-bf5a-96ea9e926cde", "comment": "Malware payload", "value": "822a665c67935590c39076756801c298d40c4719b4b3762771d4ffdc01a74815ad4c2be3b8a21accef41b0dc84bb5104", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263765, "uuid": "cf4901ff-8bf3-4580-8a25-d22fe71a2c3a", "value": "T1070495AA3A206B7DE199877147F7AF70C2A438972A92E742D22CE6049F7034D1D5F770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263765, "uuid": "91e99dff-a0da-4fde-bd5d-f6a6eb5a5561", "value": "1536:BVNi7K/U8FfEZKTebZgKDaHr/kVZpW1nW3M1Ong5GHgelsjSJ8/SdkvW9EbypxWe:cOiThgNnvICwFS0DfYyf+lsqDpyi88s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263765, "uuid": "a1526176-893c-414c-b939-7c0f7895cfe3", "value": 181713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263765, "uuid": "f11e91df-3d1d-4c3b-bec7-384e0e364703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263765, "uuid": "8622fdd2-c0b2-4d1f-9707-8ecd25fb8ee6", "value": "a44d327febbd2a46a4889207e2b756d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9acd63a-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261712, "uuid": "29061fc8-fcec-4af4-a99d-ab9cd28dd675", "comment": "Malware payload (Mirai)", "value": "ffc42d60bccd71822d4459d365ff7839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261712, "uuid": "211994d6-f663-4c60-93dd-812a8d7c7281", "comment": "Malware payload (Mirai)", "value": "e95f16302b50255b84111a293c545efbefc79df31f80a1752547c95dbf8f126d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261712, "uuid": "71d88df0-0372-45fe-ae15-41f71efb0e51", "comment": "Malware payload (Mirai)", "value": "41c4624b69898c84dce5c6c1b3cf94efdb09f458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261712, "uuid": "89015d16-703a-42ec-a9db-9adb256786e9", "comment": "Malware payload (Mirai)", "value": "f115776892985bca34c7666132af857dbf767acea5864ce6f08e73a6dc3bed6e02d002b36afbbad79c71c993d95cd25c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261712, "uuid": "1a832b4c-198f-4c02-b694-7e4647c6df4a", "value": "T1163301A1230B74B6EEB0B5B2D9CCE3523222BBBC1D93769B6B200C944C66D5F30F5244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261712, "uuid": "b6766364-2cc7-4f2b-900d-1bdfb9901ff3", "value": "1536:yccBmtoarv2/y0kqFnDzn0JLV9A2lZxiQN5BRwc:yfgh6eJLV9A2jNbec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261712, "uuid": "853391e6-f102-44d3-9d99-c7ecabbd9e06", "value": 51448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261712, "uuid": "0e6cef3d-fd19-4420-80d4-04fb3925d2c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261712, "uuid": "0c1e87e5-37de-4f65-8bc7-49a3bbdbfa4b", "value": "ffc42d60bccd71822d4459d365ff7839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c1b3de-e1b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682239741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682239741, "uuid": "314c3f44-844c-43f3-8ee7-cf2a7b5f73b2", "comment": "Malware payload (Formbook)", "value": "40d691175e44e9bd31cbf51eae61e0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682239741, "uuid": "4edd032e-c0a2-4c6a-b342-a664005dbffc", "comment": "Malware payload (Formbook)", "value": "ea4c1099821bfea9d28b73a80720f2fcc7d6e20765c731294391f535ee853396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682239741, "uuid": "a25de7d5-3a44-4015-be7a-f628134728c0", "comment": "Malware payload (Formbook)", "value": "caab1547b5eac7b895206765e1286b0124859e9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682239741, "uuid": "692e3bbe-bf9c-4404-b7e6-ab807f01f943", "comment": "Malware payload (Formbook)", "value": "97873d76f09395cf163763e5fe2e630382baf8bcecca0621eda9523215fecf7a641ac5997e0da22f30a98673691d9c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682239741, "uuid": "5dba7c0a-af60-49c5-a6a7-704fb5f9e82f", "value": "T1916639F1390AA2CFD18A3574EC07CD078E5C53F546145502CCADB87AAEA2C562DC7EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682239741, "uuid": "535c32ff-f63b-408b-9ff7-5d8f75e53d02", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682239741, "uuid": "a75b27e0-6334-4708-b338-a65b4ed07512", "value": "98304:K6cAZzRenRRZSJJL2f5vdyghaL2vn1MOHjVVC/b8gqKdn:UdUlehxVEzr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682239741, "uuid": "4a222f8b-f7b0-4b5a-beed-f69d6521a8c0", "value": 6783488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682239741, "uuid": "7c56b57a-d105-4af7-a62b-c53fda40d7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682239741, "uuid": "82291a14-0723-4c35-9836-c450ffb63521", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04ba369-e1e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260891, "uuid": "c0b8144d-3367-4209-a595-8bc54e151f01", "comment": "Malware payload (Mirai)", "value": "1013b762782f75dbf06acc3dd06efa59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260891, "uuid": "5f31b703-19e3-4dfc-b323-bc14ccb223f8", "comment": "Malware payload (Mirai)", "value": "eabc5cff266163a84a1cf8f91ec155efba5c2aa1a78d6b8e2cd7aae9cc5c17f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260891, "uuid": "69d3525e-ec69-4c5b-973d-a273f01bd43d", "comment": "Malware payload (Mirai)", "value": "e778ad857797bb51dde8efa460e9fd385af77222", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260891, "uuid": "35e5971b-fac1-436d-b92b-436701d002bd", "comment": "Malware payload (Mirai)", "value": "51d08495be65250bcbb3938c29472c5ce060203859812b87bc41f4696bcfdd6a9e34996e486c9b0455da2f94b8f493be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260891, "uuid": "b2ecdeaf-1966-4414-bdc1-19c2dfb76d69", "value": "T130C2D021D9104A84EEAFDFB9B8B5D6E625C04F4EC200CAF23253F7036762C6A5F155C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260891, "uuid": "c5f2530f-78cf-453f-81ba-a3291443c0a4", "value": "384:jpFcojRL7XKxJ2Vd4ybV0oly5arzRhibHXhpF2E9QNa+bqseM4uVcqgw05VxJy:jUopXKQWCV0d8R02ta+j4uVcqgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260891, "uuid": "a175ae23-d423-4ef0-ad2f-254b836d0822", "value": 26172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260891, "uuid": "72f20965-bcfe-4580-9b09-e03de601c091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260891, "uuid": "4a3ef88d-815a-4247-8779-7ff1d02fbe5d", "value": "1013b762782f75dbf06acc3dd06efa59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de8af37-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682259277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259277, "uuid": "8ff9040d-2788-41f7-8843-0338f5e72b2b", "comment": "Malware payload", "value": "1796db53697a925c637742201d1d8d6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259277, "uuid": "b2dd25d4-8776-4849-8016-321333849206", "comment": "Malware payload", "value": "eb195d22bac7a2093977f4bfc79b3466eed0a9bad7ffe5dc7845f24fbb564ffa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259277, "uuid": "7a2b91af-477c-41a7-986a-9f1684b44807", "comment": "Malware payload", "value": "834f130eed37b93302273514f304d68d8cce7474", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259277, "uuid": "b190475a-02ec-469c-a379-160a4a90f90a", "comment": "Malware payload", "value": "2caeffcece67dbbb631679d4d8149484f7dc152cdb10c6ed9f45855649a118f2b3c8f11a58acef5c49217332b414d881", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259277, "uuid": "a2e6184e-1cb0-4de7-a19b-49c4a12e500e", "value": "T1C8F3957E3E21AB7EE26887320BF76F74C39521D626A18343E16CE7585E7124C189F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259277, "uuid": "bbd3bec0-10e8-4d7f-9c67-087d69344cd3", "value": "3072:LSReYfnXnQc24qD0mPr1r8PxaDGdhqHXmrTcWGsOT3CsN0:+RewXQcOYPo4EXmrTcWGsOT3CsN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259277, "uuid": "0ef9deb1-302c-410c-93ec-ebe86efeae48", "value": 166010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259277, "uuid": "24e07446-18f3-433c-897a-23f23bd2452a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259277, "uuid": "face9e6b-b5b9-4449-b142-f4b6714e1876", "value": "1796db53697a925c637742201d1d8d6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9639b6ed-e181-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682218220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218220, "uuid": "26a5fe8f-257c-4d24-9029-702e272942eb", "comment": "Malware payload (RedLineStealer)", "value": "dbaf9a9454f6ec81cfb910d1a2a38e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218220, "uuid": "ec147529-62c6-4a7c-b44f-1eeb4177b286", "comment": "Malware payload (RedLineStealer)", "value": "ec2bad11a9aa677657484e1d0d4033f6cec7db242b9ac691666404d51d95497f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218220, "uuid": "593d19b5-5e4c-4e3b-a561-34b282e78a8f", "comment": "Malware payload (RedLineStealer)", "value": "4f4798619a16980e3e9291b46db2418d1eb51acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682218220, "uuid": "49f1f211-1c0c-4c29-81ab-03abce8bcdea", "comment": "Malware payload (RedLineStealer)", "value": "8e28bc0b3de4888c524d2edf42c0f6e29037bad10e5128a9d48755dd795d80556620c13a2240656aafc70e0417f76feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218220, "uuid": "fdb28e5c-a74b-4e5f-bf3e-d000c4318bdc", "value": "T131E41343F6DC5076D8F4177408FA13830B3ABCE26B38D69B6640998B5CF25D4A8357BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218220, "uuid": "a0c041d3-176c-43ca-b753-f8ecfa7b8523", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218220, "uuid": "041be0de-9834-49d7-988b-b792740e79cf", "value": "12288:ay90V8vWpCgB78XJ9SxjITwqvBzGxRph8FtFfn1B1udsJMeFO+Qr6QXra:ayI1ptuZ9Sx8bZSxJA9r+aNQXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682218220, "uuid": "14ed4ee9-01f0-4094-b47e-59ac6638fb2a", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682218220, "uuid": "2a163b08-fbea-43cd-b2c2-58aeaa37ce1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682218220, "uuid": "f5b8ef05-f60c-46f4-b4d2-758ad617c5bd", "value": "dbaf9a9454f6ec81cfb910d1a2a38e40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92defe7-e17e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682217017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217017, "uuid": "31d16b90-9d05-4566-8b81-bc7e814ba25e", "comment": "Malware payload (RedLineStealer)", "value": "daacf5932d62ae9879e8d98e8d391727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217017, "uuid": "2eb495c0-3509-48d3-9fb2-483b6faa651a", "comment": "Malware payload (RedLineStealer)", "value": "ee3420104dd6e2eb1e067d837aa5ba5bbe2a0ae789d7760600c3fec106c34750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217017, "uuid": "73b087d0-1669-4e56-b1e1-fbd1425cc7ab", "comment": "Malware payload (RedLineStealer)", "value": "f550be1873819a15e9fe643c8a2ca1f912f2c83a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682217017, "uuid": "c88b5c27-6eca-43f2-a2c7-4a37de3d51f2", "comment": "Malware payload (RedLineStealer)", "value": "b311da53b44c0ba9f881f076f03d941d604f907b8a6213629899cfafb27b9d9e8a1e9d661a45e83af08d1bb05e2b4335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217017, "uuid": "0bc77dcb-e6c7-4d92-b9c8-a41ba4fbdc58", "value": "T164C41203E6DD4076DDF9237058FA63430E35BCA2AF3C93DB2655959A4CB22D0A93532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217017, "uuid": "cf070f3b-f5c6-42b2-b6f2-9572963d5ded", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217017, "uuid": "bc493565-4bd2-4022-81bb-2db59af33a30", "value": "12288:Vy902QXMxsmufnzc1yjubR9Aephj5TFT81B1udVJGMQu0fyu:VyJkRfzc1gubRm2TSzbu0fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682217017, "uuid": "e7484f26-52bd-4807-9d3b-51967dca1469", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682217017, "uuid": "c1e99f5c-99f9-43ac-9b1e-827b2f377fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682217017, "uuid": "07b37efa-d234-47e2-96a4-b83041b0a75a", "value": "daacf5932d62ae9879e8d98e8d391727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e3c708-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259231, "uuid": "2a09ad91-06f2-4868-8ca3-c537f115e10e", "comment": "Malware payload (Mirai)", "value": "cc9cf4026b51d35c381348729654d276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259231, "uuid": "a973ce04-f785-48a5-89c6-734184ccf74d", "comment": "Malware payload (Mirai)", "value": "ef982a1303264f89977811c659fd617ef440428c74b5998009c4fe34de1a9e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259231, "uuid": "65d6f671-c516-4362-988b-ad9df84be872", "comment": "Malware payload (Mirai)", "value": "a4e5cfdedcecff14b2c8628a2d6acc493415fb1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259231, "uuid": "16f87f40-f4cb-4394-b24b-c57679310f72", "comment": "Malware payload (Mirai)", "value": "135549a8c94f86c82626f1766cc83cf95c6cfee366af68c9b376f49dc8c372bfc22ab3cca63cddc947853b124a204b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259231, "uuid": "079b58a1-0d76-4a31-b010-32d95a56496a", "value": "T138C2E0842162BE25D4790D71CEB48D821E769AB6A3A032F13BC903D7DA6434EC9B434F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259231, "uuid": "329b7d76-5a57-4738-af1e-bf04008771d9", "value": "768:9ZqbD9poewFRgjRm6O7NxKnSXQnc5Ps3UozF:9s/9KgV+jDXQyCzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259231, "uuid": "d6ed4341-f98e-4656-91af-32c1850f93f8", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259231, "uuid": "765a636d-727b-4bc8-b9ce-080706fb1db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259231, "uuid": "9b075bbf-140c-4cf0-978a-3fb5de262c94", "value": "cc9cf4026b51d35c381348729654d276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ea04f2-e1f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682266345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266345, "uuid": "cd6070cd-4879-4477-9cae-c39f95df6408", "comment": "Malware payload (Mirai)", "value": "519dd0e14916589adcb3ff9717e7d409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266345, "uuid": "8afb427a-2f28-45e6-8b06-1cbcc8c58e95", "comment": "Malware payload (Mirai)", "value": "f07c0361ed32d4fc5ce98b66d434ce6923d8bec3b8f39f28b089c62891c8b55a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266345, "uuid": "dddc5b20-258e-4f5c-bc00-b13c8f00de06", "comment": "Malware payload (Mirai)", "value": "a86a910591444a5215ec7391d2e33b2cf82c3e39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682266345, "uuid": "fb86ed54-d5a6-4eb8-bba0-9594922ef586", "comment": "Malware payload (Mirai)", "value": "77e1bf88183972e14b3043b55a766574f608f5c14b29789a5ecd29e64f3de6aaf65b41add75fa9661c6e0e8d9d306c4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266345, "uuid": "ad292bb0-e7b2-42c5-bbdf-22c3c636008c", "value": "T18913F1D4224C3A27A47458B2A779D080BBFECB7EEB8C61E14516501BF3DA8119BDD327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266345, "uuid": "2558a0ce-3960-461e-aaf7-abb6965d8a89", "value": "768:TcjA4Lfj1/d4CkELWe+xwFTzKpC05vG+NV5EBFoXyeuxBB/s3UozG:TF4N/yCkkWem8HKVhl5MFkykzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682266345, "uuid": "9c40e878-05ef-48dd-aa38-aa06df83a05c", "value": 44024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682266345, "uuid": "7aa491c4-fc89-4c8a-96cb-c703d2e8cd10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682266345, "uuid": "e5fc0d60-b245-4494-885e-28c23bd5e5e6", "value": "519dd0e14916589adcb3ff9717e7d409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ae6c24-e1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682264627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264627, "uuid": "6ddef16b-db5d-4614-bc9e-0bec588b1851", "comment": "Malware payload (Gafgyt)", "value": "f708dc98cbd91e68b62bce3ade876ec0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264627, "uuid": "fb6fe5d9-95ed-4703-b8b2-9b119ee4fa30", "comment": "Malware payload (Gafgyt)", "value": "f0bd2873f110331aaa2a59e65386a374c16bcdbc47794c047ae5db19e1674aa1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264627, "uuid": "a18a6067-39c4-455d-95d0-5392d5f2e6fd", "comment": "Malware payload (Gafgyt)", "value": "0c292e33a4e619713441a9ad8b975248acf43eaa", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264627, "uuid": "12223a8b-324a-4b9e-95dc-33cbfea32f7d", "comment": "Malware payload (Gafgyt)", "value": "8f278c206ac17512a5415495356ba9605c70982a1d038deff0002a5568e44e608142da910a9a205f8da3e9794eb7c0b0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264627, "uuid": "71afd3bf-f06a-4a8d-b58e-e037ddd9e9ff", "value": "T1ECD3081B2693CDB9C0438B795B8EE01378B2FD3F073A51066785FE682F35AA4598B351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264627, "uuid": "545a73e0-404e-41a6-9c4c-29894e9cde9a", "value": "3072:ZGcFT0/O495ARjJZ9RC2oXY0FDa/p9hrpMQ0eRlVUncRSdws:A8jvzCro4D0bjYeRlVUncRSdws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264627, "uuid": "144ae1ba-f094-4b06-bebf-321683daa6b1", "value": 130089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264627, "uuid": "1659ccf5-74e1-463d-98f0-f66541c1f860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264627, "uuid": "0903ed90-37c9-460e-b54b-6d5d6c1a467b", "value": "f708dc98cbd91e68b62bce3ade876ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e0d731-e1e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682260924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260924, "uuid": "4f0722c6-3cd7-4c40-853a-9612bc113458", "comment": "Malware payload (Mirai)", "value": "a861b34ed522e46fcf9eeed111f0bc63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260924, "uuid": "b59a007f-02ed-4d84-a88b-6ea5eac9d340", "comment": "Malware payload (Mirai)", "value": "f0fdd28b8775bc8d4de817735ea314afbecba3da5730f4040843217c55e2e6eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260924, "uuid": "9fe97089-793f-4035-b456-277bbe229668", "comment": "Malware payload (Mirai)", "value": "d989ec27fb4e3ad61a002a10f91a9da205b4887d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682260924, "uuid": "62c533c6-1f20-41ca-9ad2-573f81d29e85", "comment": "Malware payload (Mirai)", "value": "d150be43a45d751286d3f378c9af9761bbc996d6e9975a07829493e431d424b086a408aa93e4092ca2d8f81781691386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260924, "uuid": "9668f417-a07f-41d0-ae73-94041a4e93c3", "value": "T18EB2E0A19E0A9420C8F00572DEABC087275F233DC2BF74B260A952B4FF55A0386F8703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260924, "uuid": "4c1adc6d-56d1-4637-8418-115bc5c6674e", "value": "384:wyRjLx0PH65uGF+FXGEuYchjw3PISZBIAuDMviX/xNowH3hymdGUop5hIq3:tH8FXENjEzZGBxNBXs3UozaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682260924, "uuid": "f86097f3-99dd-451f-bbd6-a8346b6f460d", "value": 24388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682260924, "uuid": "c479e2ff-204e-4050-ad7a-4ba9d21f5ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682260924, "uuid": "bcdca7fb-484b-4336-abcf-ed05369356b9", "value": "a861b34ed522e46fcf9eeed111f0bc63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d87ea1-e1e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259238, "uuid": "a16d9aeb-c242-4a32-9371-770b46d664e4", "comment": "Malware payload (Mirai)", "value": "552721f8a43f042c3fcbbfe7560e2a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259238, "uuid": "e3b5d55c-b6da-4994-a7c8-d2ab6eadab1c", "comment": "Malware payload (Mirai)", "value": "f1d6a62080c290b8e82339de90a2f89fa18d6846569e30a194bb34e5446fee94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259238, "uuid": "81d3087d-c495-41a1-a3a1-8a12c2cf870f", "comment": "Malware payload (Mirai)", "value": "723ebb1a8d458bc914962f4451f88e4ced8af323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259238, "uuid": "8a5678fe-29cc-4a95-ba09-9b518c370501", "comment": "Malware payload (Mirai)", "value": "8f6630186ad2a8955c1f58edc2e60c02a56286b4627c4f3f26650102648553f4c8f709c0d5783a36f980635a8a913be5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259238, "uuid": "2a885ba4-3d76-42dd-b9fd-dd0344181bec", "value": "T15F63EA1AAE298FFCFB88863447F78E215A5833D626D1D6C1E15CDA011E6034E345FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259238, "uuid": "62c40d79-9db0-4bf9-bb6c-3cdcc45eb06b", "value": "1536:mzInv9e0m/vBznZnCdAmgqFfUic/spqqNwvS8PnW:2IoH/5BC6mgqSic/9qNwq8PnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259238, "uuid": "4914c536-2efd-42de-8462-1a2290655ae2", "value": 72856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259238, "uuid": "0d434715-bfbb-4319-9352-3877b38f510e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259238, "uuid": "38c6023b-928b-49c9-b57c-858f7ffa6d37", "value": "552721f8a43f042c3fcbbfe7560e2a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f0fd03-e19a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1682228982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228982, "uuid": "7601d30d-cee5-4597-a9ea-d275813a3b26", "comment": "Malware payload (LaplasClipper)", "value": "595c641e1e7d089bba4704da751d8ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228982, "uuid": "2b5f0d8b-7618-48c3-b102-e6bf8cc57689", "comment": "Malware payload (LaplasClipper)", "value": "f2d67d7c5e9bf1f4b093ba63a7c4fddf26571b0d083e675646504da0e5a390c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228982, "uuid": "750a83ca-ebaa-457b-81be-5b94b47896df", "comment": "Malware payload (LaplasClipper)", "value": "0978659af6c1fd8e1e68cb01efca462e79c371cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682228982, "uuid": "39d2ea33-7019-415d-a4a5-563e6e2606b6", "comment": "Malware payload (LaplasClipper)", "value": "f87a4e028da357a64f922e6ea63d488f9b4e3046f1a83e8b7254b6ce0de3ad968ae72d52a3ae62778a2c7445628138d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228982, "uuid": "666cd6cd-f66a-4049-9391-ef96a0ef59ae", "value": "T1AAC5230276D284B3E8332C7255759712B43DBE600B55CECFE3A4696ECA70291DB317BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228982, "uuid": "95f01749-c314-4a49-89ac-bdaefcaa9145", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228982, "uuid": "7b830c57-7e72-4b35-a092-6c7e11eae6bb", "value": "49152:IBJ1VMeFLH5Or9d+9QjaAPC70V1ev4iFu+krSd0PAZQZCQJLNAcEap:y/VMQDQ9KuvC7O1ev4iUW06/aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682228982, "uuid": "dd2e4e72-a9b4-468b-b3dd-9c1e1514d8fc", "value": 2704213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682228982, "uuid": "7b927438-0038-4fd5-8e5b-efd538984365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682228982, "uuid": "22d65e8a-3a8b-4364-b726-927b67b3512b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df7aa5d-e1df-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682258418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258418, "uuid": "4c618749-fa70-4b8a-820a-91ca99924dc1", "comment": "Malware payload", "value": "cbd0f8f8e7f995e436d5729f15e90998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258418, "uuid": "06b94c33-193f-4b39-b2ca-214b370d2bc9", "comment": "Malware payload", "value": "f312286491bc85a4b2c4c7047458c755b217e282d05765d92b66db0321a74ec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258418, "uuid": "23d5a066-9928-4906-9902-e64ab137edba", "comment": "Malware payload", "value": "e4bd353f0ec7ecd2a111f4a03add85f19a89a868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682258418, "uuid": "4e36ea9f-8912-4214-aa6e-fe3f53be150e", "comment": "Malware payload", "value": "8eb4cb295e388417c3f21ec16a22bcee8fdddb33aa1baf6729864be541090d3d661e45d6c5ad3a1fe9d3da07ac178da1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258418, "uuid": "19f524ce-5bf5-4b8e-9ccd-e9219057bc2f", "value": "T178A33BCB6680D573C04305F212979B520532FB3E191FEA1AF7993CF9DB25488B632B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258418, "uuid": "0d5270da-3d72-4cef-9b62-9b9acd62d0ac", "value": "3072:FN2kopN9NQjXJvUzUQ8IvtXSc0GGVwvnnmRmmqi05m0iswEc:FuN9NQjXJvCJ8WQ9VamRmmqi05m0isw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682258418, "uuid": "01dd9b8e-ca8e-4cd0-9a22-ea0e219dd5c2", "value": 100786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682258418, "uuid": "04d81c57-31b8-4cea-9593-8ffc2bc1dd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682258418, "uuid": "014caf4f-86f2-438c-92a6-1ac7b0aed5bf", "value": "cbd0f8f8e7f995e436d5729f15e90998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985a738a-e1b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682242275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242275, "uuid": "a84eed40-8976-42c9-ac51-cfabb4861059", "comment": "Malware payload (Formbook)", "value": "d45bc7f5317766ac78d045779f63ccec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242275, "uuid": "c5aa7691-802c-4719-883e-f8c8e1ee6a9d", "comment": "Malware payload (Formbook)", "value": "f508b66b3b6398f2a4d73ecfd057ab0804320d523e09feefbe59ee33b1124508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242275, "uuid": "84bc9334-b428-49fc-b885-dfe43727d1f1", "comment": "Malware payload (Formbook)", "value": "93226e6b5d30791551a78ef15f163e5e60841ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682242275, "uuid": "b7e1c545-5ace-4e25-ba3c-fafd330ffdb3", "comment": "Malware payload (Formbook)", "value": "dd9a1a555adf65abc28c794dd8b006d16282dd11994db5455e7d677ba0b3d91a267b09fc3903e041539491a6a19d68e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242275, "uuid": "ed430fca-5a73-4e17-be8c-f5f04a2f508a", "value": "T1C6D4F124711E79B7E69AA5F3524A37933B6C32CA3D3EB2646F5D84D4274738E0F80846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242275, "uuid": "b8fa6b65-1e16-4920-8d5c-081050447f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242275, "uuid": "45f746bb-3bf3-4f36-b764-e024b56bb67c", "value": "12288:zCg5Btce5eYr9FKHZaLjwc3csngNa9G2paip:rBtFUCFKHZ+ssng0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682242275, "uuid": "3da5c0f8-4b9d-4ba3-92ba-5259e1dd5b5d", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682242275, "uuid": "22f7299f-3de1-4167-97f0-e36b71d98133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682242275, "uuid": "d6aa4fb2-1b56-47ab-b9b6-1093c2992ab0", "value": "SecuriteInfo.com.Heur.22835.17503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab86af88-e1e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682262923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262923, "uuid": "ae336568-748a-4cad-b918-ab9067458b24", "comment": "Malware payload (RedLineStealer)", "value": "0031ac3c2233beafdd21fd12980f7baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262923, "uuid": "d95364f7-411f-401d-89cd-6a9032f4a991", "comment": "Malware payload (RedLineStealer)", "value": "f5c3a58326366577dab5c242766f27ef109484b04f927a378d16730960e4ad09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262923, "uuid": "cbff91c9-db0e-4852-bfa3-d4ad8db40fa4", "comment": "Malware payload (RedLineStealer)", "value": "3bb1c4fd8310567292cd45bf55719ab1ea86ecb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682262923, "uuid": "ae984206-3ccd-4329-a59f-205a603cf47e", "comment": "Malware payload (RedLineStealer)", "value": "76d927a53d7b68e2eec79c25200fd1bc479cdb23aa2aaddd86acf1cacfb69e2600c6113bb8a9a0f741d464ed64cc8ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262923, "uuid": "f8a4d721-15cf-4e57-8d9c-1db120401739", "value": "T1DB45222031B2C536F59BC6B40870B698AA7FBC73466080CB3F5C27BA1C716E1DA6575E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262923, "uuid": "82000353-1693-4158-b959-a1285ef46dad", "value": "e4f8cf00c234eb20415b669f060aea52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262923, "uuid": "ecda83c9-150e-41b0-b6db-3d86a0d74162", "value": "24576:OYfpUXN4pJObch6IIj4y/J7eiLQoHn1zB/hN37JQjXfsTedQ4hF:dfwNsjhHITR7emQ+n1z1DlQjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682262923, "uuid": "63e73222-7eb4-4433-9c9b-f0dcb546eeb4", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682262923, "uuid": "ce9848c8-6c7e-4dd0-a3d0-21e26bc8397a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682262923, "uuid": "91a3b920-7552-4187-9fec-de71b5a61c22", "value": "0031ac3c2233beafdd21fd12980f7baa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3888713-e1cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682251018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682251018, "uuid": "6e7fd2a1-46de-4262-9f59-11c4863b06a3", "comment": "Malware payload (RedLineStealer)", "value": "6587ed81204bcd7cdd659606c0f6ad2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682251018, "uuid": "531b4798-6f10-456b-b5e9-d221d055e7b7", "comment": "Malware payload (RedLineStealer)", "value": "f655eaf300b967dacc739c85acdde4bcc7f0b1e054224b4dcd673e71342bf16f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682251018, "uuid": "dd2d3f44-f4e3-47fd-b426-c22f632b98fa", "comment": "Malware payload (RedLineStealer)", "value": "45e95a6dc97667af5f572db6988552215b6f114c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682251018, "uuid": "fb463604-af01-44b7-8aa1-5fb17b60d802", "comment": "Malware payload (RedLineStealer)", "value": "25ac9dc215def3984ac3b2370aaaf5ff3fe70dc63a7dcae45a5e04e96eb7aa926d7cf71f5f9a2daa669f4c83c389cdad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682251018, "uuid": "3d5102d3-b095-4034-94dc-e6724b1eb02e", "value": "T12C648E023288D57ED42AECFF5DA09FB8423C6A3A179F848367941B5E4D916F0F972349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682251018, "uuid": "41cb7731-2158-4909-a8d9-7dca35e288d7", "value": "700f5813efd204f7328cfcc176187f03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682251018, "uuid": "9ac019a4-d5ca-4c70-afcf-afe5545c0fd5", "value": "6144:xLYI5eRGdjkJgs4nGhIycUN8N2Qq5cwdm9Wdu6:NYI4RGKKs4GhB2Nwdm04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682251018, "uuid": "cf3752e7-6c8b-4562-8479-9b4d5a6f8151", "value": 327840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682251018, "uuid": "7d0759b5-9553-4ded-92d7-6f7577af091e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682251018, "uuid": "0c4e82d3-bb00-4ec3-a1b0-d25d32e8333c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc6ce6b-e1ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682264132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264132, "uuid": "05b9bd30-ea42-4f87-83f4-2aeeba6f147e", "comment": "Malware payload (Amadey)", "value": "d0b4e8607fd2dd6b2aa944ce71a2fdd6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264132, "uuid": "b867b29e-7d75-4912-9fc9-2a1cae6ebc01", "comment": "Malware payload (Amadey)", "value": "f699dcd4609c09f42027e9803c58f62a371d3806eeb6d9b16a15671c7df20476", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264132, "uuid": "635cec43-5bd8-4f7a-b416-0c2b1457cef8", "comment": "Malware payload (Amadey)", "value": "2fe1e6d04f30435a44e88f490d7aef7ce822a732", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682264132, "uuid": "9602b6dc-f5f1-452e-b5e1-6df8e22fae74", "comment": "Malware payload (Amadey)", "value": "19453488c1bc051813078a06b9f38fc97a746d90d62f224d37583cf01d38b3e81721d49b081ad8fd4102ab58892a7225", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264132, "uuid": "72249c55-c2bd-4b1d-9517-ef442e09fdde", "value": "T17D352352E7F4A4B3D8B0277818F112835A37BCA19FA483E727C1AD6B4D71AC45530B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264132, "uuid": "1657bfb6-6484-47c0-8bff-fd0fb575b86e", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264132, "uuid": "fd39e43c-ae67-46b6-8c49-f8e9fd8138bb", "value": "24576:kymGYjKfim1ly1nWFvn/FHlodN2jzNQ+hM5RS8UgsExt:zmGYmficlCav88hkRSkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682264132, "uuid": "845a5bce-85e8-4c92-88f4-c7d2cb78a270", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682264132, "uuid": "5f1bee43-2ae0-4a1d-a3b8-4f07d8f2f6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682264132, "uuid": "37954b67-45b7-45da-86d6-c0582f8d3188", "value": "d0b4e8607fd2dd6b2aa944ce71a2fdd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ae4c64-e1d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682253435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253435, "uuid": "c2faf510-440b-4f6e-be0a-41cabcc378c7", "comment": "Malware payload (AgentTesla)", "value": "9ee8c452ce49b91a58ba80f16cf343ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253435, "uuid": "423f0619-8019-4eb5-b770-09915813a9a3", "comment": "Malware payload (AgentTesla)", "value": "f83c84324c1b9923224035632acd7fda42cf6d0d9f1f01750b7fe3abb97693b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253435, "uuid": "0eeebb1c-95b4-4206-94d6-195fc3eae708", "comment": "Malware payload (AgentTesla)", "value": "72ef28bf30af5f21a1034811cc0eaa9ed1780dc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682253435, "uuid": "404474a5-342e-4695-a58c-4eba14c2b808", "comment": "Malware payload (AgentTesla)", "value": "9eaab74bd9354c3edda613a7af25a828b6a687f739b02bda81d3d11aa6fcac711d95cd760a6d6f1cd014a6c4b48356dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253435, "uuid": "5b9a46f2-8f3d-4ea0-a3b8-99b41e6fe761", "value": "T128059CAB6BBBFF51C1743CB9135112209EF04E96ED2AE1A4FEE8304529137D4DA24787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253435, "uuid": "74710608-ff7d-4710-8fb8-e0d0458bf955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253435, "uuid": "f4166e56-174d-4942-8f70-f231e27766b6", "value": "24576:ypI6DHMd1DtOIIQ70Vi87765OHPcyUP3xeZ:yJMd1xl/877k4IP3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682253435, "uuid": "3682ad30-5c9c-409e-9538-4c0220df77fa", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682253435, "uuid": "ad8e90a0-8fdd-48ee-bb20-91d42de2eafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682253435, "uuid": "b3fd9443-ccc7-4744-b78a-0f914701d002", "value": "SHIPMENT-INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff4f0aa-e1e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682259200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259200, "uuid": "71580848-543c-44ce-881f-60691b0e9745", "comment": "Malware payload (Mirai)", "value": "1a04886542005c63c3b0f830d840adf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259200, "uuid": "9623186f-42d5-4fdf-a604-e121f744fff4", "comment": "Malware payload (Mirai)", "value": "f9b7e1aba2c49deaec2998bbf8eaa619ad946033fa2dcddc6c4bb94929ebf632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259200, "uuid": "1948c280-a1b1-4c5d-99b4-9f5bb18cb690", "comment": "Malware payload (Mirai)", "value": "5e7fd8bde55212250d494905b5946be58377437d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682259200, "uuid": "aac2d004-f1d3-4781-92bd-4f7a75b9544d", "comment": "Malware payload (Mirai)", "value": "1cbefe37d84359712cfd6c8b9fcb5f8a6ce9b5a3e1eb0df663341b5236d0e8b0e2648164a1e360cda065871a50cc2c41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259200, "uuid": "0c2af5b1-f689-4d16-a16f-d802ff919c04", "value": "T1C5D2F1AC79D6B5EBCCC98B79B60F4169304E74AEA2F193337346C9434A17241D822D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259200, "uuid": "f45634d2-20b5-476e-89d3-63059347f47a", "value": "384:MYd/PxEDLd2TwcMzP6lowYcEaqsY9WC4t0LomNw2XYyXhUEd9rh5qrNyv:blxKd2NMWxEnsY9OQNwqrdJ3Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682259200, "uuid": "6f5ef0c7-d65b-4fa0-b846-6ef45ad8aa9b", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682259200, "uuid": "a613c170-e459-45ad-9ccf-934f877f3c48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682259200, "uuid": "074f3bce-b81a-4b90-b909-a2bd1a2801c0", "value": "1a04886542005c63c3b0f830d840adf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82041efa-e1eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682263713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263713, "uuid": "140a66df-3d89-4b38-b02f-d4e13f8b97ef", "comment": "Malware payload (Mirai)", "value": "6f8d05fc1e654de81c341d8268e172a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263713, "uuid": "70ec7b04-8624-4cf7-8a0a-2b222eea82e7", "comment": "Malware payload (Mirai)", "value": "fa82b126af24857eabd6e19838ae56de9bdb63dcb146c8d1f1a345a4a83b39a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263713, "uuid": "ac5a1454-6c2b-4cd4-8a5b-c68cc51e942b", "comment": "Malware payload (Mirai)", "value": "a8923b2b6b3b84c50fe79984ca4ffb1c0bc81fc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682263713, "uuid": "341a1c8b-f905-436d-a8f7-7391e8dd307d", "comment": "Malware payload (Mirai)", "value": "d082b23e709d9d8df01425c8d037db07fcd676e65d9350850a2f2fc1f8e843b700bc652596590c88134d01be24d3f0fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263713, "uuid": "36656a8a-fd7a-4f22-8ca4-f659b1565bbb", "value": "T1ADE3E801E9104B6BD7D3ABBEF74562CE77719D982F873306C71A79B027D06A96E39200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263713, "uuid": "ae068e36-1443-4544-9da7-d1319bf358fc", "value": "3072:0LbUEGtcG7jLq+rO6I3VG3ci0QWBapR0ywzvTR5F7IN4fRztu6D0S1XA+QXfEPQT:0LbUaTR5Ns4fVtujOXA+QXfEPQA5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682263713, "uuid": "215af808-5483-44e4-9be5-162fe3b73ec1", "value": 149171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682263713, "uuid": "d9f2286d-f674-4002-823d-d91588947ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682263713, "uuid": "d683261f-56c5-4b2a-aba8-12de4cbcbc08", "value": "6f8d05fc1e654de81c341d8268e172a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfc04d6-e1e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682261664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261664, "uuid": "6605bb69-7260-4175-878f-89789ff3d31b", "comment": "Malware payload (Mirai)", "value": "27eeae7e9e0afe21120b12116136dcbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261664, "uuid": "ad10b11f-a3a4-4186-855e-d7ab80352698", "comment": "Malware payload (Mirai)", "value": "fae6c6a2747bc07428c206c6ca056cdd811563b5e8a7e25762f4334d415d2e79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261664, "uuid": "b5a4af82-27c2-48c1-98d8-55f1c63056c5", "comment": "Malware payload (Mirai)", "value": "801987d4b94dd00f3fb21f81ccab28d4c252c820", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682261664, "uuid": "badbe412-1265-45d5-a7d2-b70c6c9a14b7", "comment": "Malware payload (Mirai)", "value": "c6075d9f757d1a8e4427116f98ab5baea2956e6b395dbc01cf4bc26c24251f60e2d46903e78df76e8be2a73acf9e4949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261664, "uuid": "4f9ab5de-c74c-477c-8d9a-9266cbf05c2b", "value": "T1FDC3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261664, "uuid": "ae7e4628-3d6e-40ad-ba47-ac39174d9a42", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP8L7ymm/QMurB1nKGNb:SMQplV8amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682261664, "uuid": "45ae8b1c-3191-43c7-985b-92aa85b0ffb8", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682261664, "uuid": "c1ea39b4-201e-44dd-83f7-83d8ec0d77dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682261664, "uuid": "7503e4a3-22b3-4d37-acbe-1db759ac96bf", "value": "27eeae7e9e0afe21120b12116136dcbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b77980-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257860, "uuid": "f9743894-9742-4359-9396-fb701758e1dd", "comment": "Malware payload (Mirai)", "value": "dfe795882d761f7f84f099596a1aac44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257860, "uuid": "caa5e745-57df-4a41-9f76-40a8c92b94b6", "comment": "Malware payload (Mirai)", "value": "fb56f298ece64303eb697627c353296230a308d743d056a5bcc27357cf3546f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257860, "uuid": "e64c57da-e621-4255-8082-73ffde1ae5ad", "comment": "Malware payload (Mirai)", "value": "dbb663e956497daeac9f30a2d3d84f0ef86fcadd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257860, "uuid": "d2039da6-122d-4042-b146-cf8b39ee9312", "comment": "Malware payload (Mirai)", "value": "abb317d245d39928a64d20a229f54cb16dbb249b2298785e4cde90fd8e25541eff23b09289790f955b41421d703b0555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257860, "uuid": "1c75bd92-3c9a-4167-bd0c-d4676605f513", "value": "T1F7631956B8818F22C5D512BAF92E118D371223E8E3DFB2139D205F647BCA92F0E27D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257860, "uuid": "cef14f66-1af4-4a31-9531-5531502b5f81", "value": "1536:sunbDRY3fE0JaqV5Q94WzgaBQqE3w1o2hbDXzfIOiTOWM7d9yg7CnDk:fkfEgaS5rW0aQqOwW2hzWM7d9ygeDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257860, "uuid": "78f377e5-e959-4563-8e77-3bcacb1c3450", "value": 68732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257860, "uuid": "e0b43e20-8304-4fc3-84a2-dfd7cfc06c37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257860, "uuid": "f1eb9488-2a84-4853-b78c-8753b9534f7c", "value": "dfe795882d761f7f84f099596a1aac44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c66c82f-e175-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682212969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212969, "uuid": "80dfdd60-95f8-4e06-ab05-0e0ebad6dfbe", "comment": "Malware payload (Amadey)", "value": "526e69d85255531694f5b9c300170eec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212969, "uuid": "7e3f7ebd-72cb-4d62-9d1f-95f20217f335", "comment": "Malware payload (Amadey)", "value": "fc56ef08cdfbb38e987142b46f22be959d88b0b770fc1e9da77823d87d562e61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212969, "uuid": "ee3e5fa7-0177-4b31-a3ea-9724e7486ddf", "comment": "Malware payload (Amadey)", "value": "7f5f03d01a0a8fbf330aa0c1df3688c806dec5c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682212969, "uuid": "6aef64b5-e120-41c1-b685-19ce6fb8cbde", "comment": "Malware payload (Amadey)", "value": "65312f4e04f60f421b5b63396ef0f1b931b3f3fdae785e0dcad61ecff49e02cf35ca5abe742de1381583b45717fc16ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212969, "uuid": "89abdf83-40e8-4d58-a93a-5d5ea974f8ae", "value": "T1A234C011B6E2D0B2D8AB86385030D7A46F3FBC629B5581CB27383FAF5D702D16766316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212969, "uuid": "8ba8367d-2e55-47c3-8577-67c334ca93d6", "value": "c36577d8970592a39f985677fb550958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212969, "uuid": "4d738f76-cb5a-4ac6-9d66-65ec2e687808", "value": "3072:TlPTF92pCkZ1TzlVY7gxeSQGIwpgNAGbE1cJc9Ph75V4af12F:TZZS1Tzj5sSrcaGE9Jfz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682212969, "uuid": "5fc78fe2-a8c4-4c5c-9fb7-13d2a3fc22e8", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682212969, "uuid": "9387aab3-1c19-4748-b177-1300c4fec664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682212969, "uuid": "db638dab-922c-4d74-9084-d6e325ad64e5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60953116-e16d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682209540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682209540, "uuid": "d7bb0837-d3f5-47c0-9fa6-ee039793db73", "comment": "Malware payload (njrat)", "value": "d823370abdcb9b6c8e4f38d9ddc7c812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682209540, "uuid": "3e5db34a-0d40-4f41-8546-2a4e2189a16e", "comment": "Malware payload (njrat)", "value": "fc792007a1d83104cada094e4a250450cf67daa9c5b6692db77c7cdfb1f6e5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682209540, "uuid": "04b5a6bf-6b01-45cc-b7a6-d0b53d6f4abb", "comment": "Malware payload (njrat)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682209540, "uuid": "1ee5323b-2b8c-4b43-9df8-c925f44b576d", "comment": "Malware payload (njrat)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682209540, "uuid": "514553b5-27cf-4424-a110-f81322278ffe", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682209540, "uuid": "771ad733-a81a-4be0-bfe7-8b77b3c6b932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682209540, "uuid": "8ccfa4e0-1f82-449e-86b6-ef45b474552f", "value": "FC792007A1D83104CADA094E4A250450CF67DAA9C5B66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bcf75d-e1c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682248759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248759, "uuid": "9aa109e3-a0f3-4b5a-98e2-74e4fb283a04", "comment": "Malware payload", "value": "e3af7d1d0cf8fdb64fd1325c5bdee3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248759, "uuid": "82b220f4-b46a-497d-a95a-5fb34ab580b9", "comment": "Malware payload", "value": "fd5e477a5ef24773b8ed6e2acce77583e557a7def1eaf3ac6e51b71e4d599a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248759, "uuid": "e75989f6-351b-4631-98a6-2ca5b7137fed", "comment": "Malware payload", "value": "9992ef93cf63ca7b2dbf4f53e6e7d3da523c0607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682248759, "uuid": "ae6de4d1-a82a-47cd-af62-4b3fc62d7919", "comment": "Malware payload", "value": "8b46ed52dd7242f4b2dbe4cee1cb63283a75f902e3c9af75982fe073c681b86e5f6460a9607d096fca64b830ddfd3ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248759, "uuid": "de20ddd8-d8d9-4c66-8ee7-ecd1f4b93f04", "value": "T112A55C2439FA502AF173EFB99EE474E6DAAFB7633706641D109103460B23A81EDD153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248759, "uuid": "55c5a1d5-2315-496e-ae04-471ba9cadcfa", "value": "24576:m36P4vcvVN9gMWsvvS3OcZkQVj2hpyMkyj7NHlKaOKdlsBT5Q6S:m3d0tN6GS3bkQOMvynKaIe6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682248759, "uuid": "3cdeec53-ce06-41d7-97ae-bed8713f5057", "value": 2265088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682248759, "uuid": "2b33ed21-fac0-4d45-ac0b-f0813e11b874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682248759, "uuid": "688e85fd-bdfd-454e-ba46-5082ba44070a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c71b94-e1dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682257871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257871, "uuid": "332a80d8-fb6b-44b1-aea8-ad7c5e8b0467", "comment": "Malware payload (Mirai)", "value": "2c9b70406d540b56e8699bdf13ac168b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257871, "uuid": "1e32c62b-b318-4532-a4c3-c5051ada7fc6", "comment": "Malware payload (Mirai)", "value": "fe3e867ba60a63677f88d323546ce533317f5464ed92af6025f1595a083d1cc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257871, "uuid": "71196b65-b4e7-421f-9554-fd63873d7c0d", "comment": "Malware payload (Mirai)", "value": "f94d230085ca6b717f9ce9fa08a89d43c0ef17f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682257871, "uuid": "c1b22c59-5f1a-437f-a0b6-1044885f1c8c", "comment": "Malware payload (Mirai)", "value": "624ae5eecf370ef206e9140c659e55e4a36b1ef67180b33b710e74694e9f396c25a9f4aa19204f74a0e7ba2f74966142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257871, "uuid": "af0e704d-503b-43b4-9889-48b9a3ac4890", "value": "T1A6B2C025E59A25B0FFFB2C249E8AE2F837A1C54C3BD38AC111C59F021A1247D5765AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257871, "uuid": "adaab8ad-4cec-43f5-b9ad-1dcb4d86caff", "value": "384:EA0AeimAzNCdvw1PwIWWH0Swp1LWNzEZJdqRTPdtIy+CyM4uVcqgw05VxJ2:KApCdvwJQLmw7dqRTnp4uVcqgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682257871, "uuid": "f7e5c0e4-2a52-41a0-a345-a81f3abfaa0e", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682257871, "uuid": "e0f49f5c-c696-43d7-b2fe-a4d9af3456c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682257871, "uuid": "2933db91-1ca2-4fc4-a7ae-5c7418e81e4f", "value": "2c9b70406d540b56e8699bdf13ac168b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }