{ "Event": { "published": true, "date": "2026-01-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-04", "timestamp": 1767571381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "215d150c-6705-49ce-a225-c083e4691125", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367ed775-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512674, "uuid": "272a74c1-227c-40a9-9179-baff75bae338", "comment": "Malware payload (WannaCry)", "value": "0f6f80f157e527c5a9e20f70f0e7d544", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512674, "uuid": "7e4d1c13-4982-4ad3-b825-3dc8537b62cd", "comment": "Malware payload (WannaCry)", "value": "0166cf88bfbcc0f65276682d52364ae3dc822278126c411747666e61c6ab864c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512674, "uuid": "651d6b93-e992-4455-b720-96a15cf4932d", "comment": "Malware payload (WannaCry)", "value": "e34924908c91b2281d44a8f684853d6986024c63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512674, "uuid": "944892a8-18d9-47ac-bac6-298d92bb7c16", "comment": "Malware payload (WannaCry)", "value": "bf12d88bf810c3f6bec7581630d1b30c30eccc356c5853f777d3143b71585bcbfcf6c1e8b8d58d24c2a84954fd8c37cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512674, "uuid": "642329a1-3c48-4736-ba04-4f2a0b81ad1c", "value": "T1B636F01377EC0259F6F71B38D47664629937BDCA283AD20D11A4169E0EB3F218CA177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512674, "uuid": "5552aa91-c453-4f94-b675-1fda90acdf10", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512674, "uuid": "b93177b7-c640-4ab2-9192-185cd26c1002", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEa:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512674, "uuid": "1f006aa7-1230-4ecd-9752-53b659936dd1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512674, "uuid": "06a5a18f-01ca-47b9-bf4c-140908b93222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512674, "uuid": "e51e07e2-bd35-4a46-a670-747ba54daa5f", "value": "0166cf88bfbcc0f65276682d52364ae3dc822278126c411747666e61c6ab864c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429b3eb3-e97b-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1767537605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537605, "uuid": "993ee44d-fa9e-4298-a083-488209e537e9", "comment": "Malware payload (Loki)", "value": "09dbef12d48816c9a750b7d2b1a7ba55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537605, "uuid": "62fffe98-a7c6-41a7-9564-e80800823a86", "comment": "Malware payload (Loki)", "value": "0178df6a04b3743e242f1680e26eb071791fb999a3d36f080f5dfec4ece1bc24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537605, "uuid": "82300edb-9ee2-41aa-b7e3-a0efbf96c7a1", "comment": "Malware payload (Loki)", "value": "2650f5ba65738e1b899e7bca186d3c0b23d4d421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537605, "uuid": "b0e351b4-b0db-4fa7-a226-036ff9cbc4b2", "comment": "Malware payload (Loki)", "value": "87de862fb1fa5ea79175e3179926dc5137164ff5f2af67d3edae1b7c9114880cf0b08b44f7f051a7cff85a61bc49ba1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537605, "uuid": "ee2aba43-6e2e-4971-81c7-e5e7741610a3", "value": "T190A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537605, "uuid": "3d351309-c39c-4f7f-8975-58fddb1d111a", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537605, "uuid": "a9d0f2b2-6734-4054-99d3-79bd04ce24a4", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767537605, "uuid": "2cb2843d-7455-4ca0-a700-9f5698b4b68a", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767537605, "uuid": "9477a55f-e4c4-43c3-a975-0a3960427699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537605, "uuid": "d8a6e70f-f6cd-4a9e-a205-b33e939a13e2", "value": "09dbef12d48816c9a750b7d2b1a7ba55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209aec7e-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767511349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511349, "uuid": "ff0411a2-bb5d-4a23-9988-ec9bf2b6b8eb", "comment": "Malware payload (Mirai)", "value": "76967ae237e049914ddf302f6937ae06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511349, "uuid": "0d78c8dc-ed42-4ae5-837f-1f5d783a3efe", "comment": "Malware payload (Mirai)", "value": "0180d406358098bff1ee477759f2ffdf0bfac4b29f243116b40d9a2502f8ca43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511349, "uuid": "8f30e83c-5c4e-499a-b5b3-82ed4a30c868", "comment": "Malware payload (Mirai)", "value": "21d26e8410f0a76183e886188c83f30964b11612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511349, "uuid": "2c50a95d-7fba-458a-bfc1-48b709e696f0", "comment": "Malware payload (Mirai)", "value": "357f93499c7c5b92219851fa8fa28d171a6761ed6c013b2121f588e31965b524cf8304de48cac6640f5738651033023b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511349, "uuid": "ef1f9bef-913f-4533-bb52-118e6b2a1c67", "value": "T16D63023E571977A599B460328183C6DBF29BB2BDE1BFB89C0041C0DE2D9C06B075E597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511349, "uuid": "0a900f7b-90d3-49c2-a305-be9ad04b9350", "value": "1536:EZlqTVq40QhRrsw0qakCyaL7zgCHtVnjJ7aazPyJGd+zl:olR4Fvow0rkSgUtFcEPyJGIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511349, "uuid": "292396d3-ed29-4b79-bfc0-edfa210e24f7", "value": 68872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511349, "uuid": "dcb11b5a-1ec8-4f4e-9be0-3decbbbd47f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511349, "uuid": "56626507-5928-4142-a4c7-42546b3de18f", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f90273-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513262, "uuid": "7c03eafe-db30-44d3-9f53-47cdfe99060c", "comment": "Malware payload (WannaCry)", "value": "6d2543c53d9e316af0806f8a853160b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513262, "uuid": "06a1bec7-7980-4437-b446-a6c7ebad6b26", "comment": "Malware payload (WannaCry)", "value": "023cde4f84ca76a5e85bfdee5b2a8af5ba722a180551c52d1676b0142431b4af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513262, "uuid": "1984d332-6d68-4aad-af7f-ae5b0d310223", "comment": "Malware payload (WannaCry)", "value": "56ad055e8632ef9fd5829beabc3d682ca33d6223", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513262, "uuid": "1823d76b-4737-4c1c-b8cc-ff97bb4884b1", "comment": "Malware payload (WannaCry)", "value": "7b37cae6bd0deca3cae1f61a6eab5a4d03a047716c7d76594fad1b43ab4b5c4a7c4c6e8570d986c184737d3157d2cec1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513262, "uuid": "72e7b77c-6a33-45d8-b337-83fa77798b34", "value": "T16D363394622CB2FCF0440EB44463896BB7B73C6967BA5E1F8BC086670D53B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513262, "uuid": "ac62a5ae-3de6-40d0-85bc-c6b7f5bb59ed", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513262, "uuid": "b679dd8d-5a4c-45be-9a26-80717a04f354", "value": "98304:MWCPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:MWCPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513262, "uuid": "884b2965-a04b-49c3-8043-d6e0a2d9de61", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513262, "uuid": "bc32f35b-c213-4568-9009-bc0974baea51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513262, "uuid": "7f93a735-a970-4f45-8023-a5378b3d3128", "value": "023cde4f84ca76a5e85bfdee5b2a8af5ba722a180551c52d1676b0142431b4af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa9467e-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511965, "uuid": "0e7faa2d-a40e-4087-bc18-a5757e56af96", "comment": "Malware payload (WannaCry)", "value": "c1045e165824a769408792e176290035", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511965, "uuid": "11f1a2c8-ff9b-4cf2-a9bc-a873cbc2f38c", "comment": "Malware payload (WannaCry)", "value": "02c9c7f3139c3542ad06c79be3dc067f168f688af4dfb4b10015c941c5bb78da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511965, "uuid": "77205601-55a1-4627-8c2f-a1208b7a9006", "comment": "Malware payload (WannaCry)", "value": "cd37aaca1baef380dce5b7762c833cb7bffe4ecb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511965, "uuid": "6603c122-6c17-4516-ac8a-5bdaffda79f8", "comment": "Malware payload (WannaCry)", "value": "d03030289559e0876bf17e5f45527a1e8688ffcedda874c0a85bd8bac1190dbe63c9d0e40c93a7bccfb9c4fcd09f117d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511965, "uuid": "1d440729-45d8-4c61-aa56-521f3ba067e0", "value": "T163363394626CA2FCF0440EB40473896AB7B73C6967BE5F1F9BC086660C53B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511965, "uuid": "fae150ab-69f1-43db-903a-2011d39eb557", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511965, "uuid": "8faceb92-87f2-4506-a899-b2a74484f620", "value": "98304:d8cPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:d8cPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511965, "uuid": "99a313ae-8d87-4c29-91b6-8e5b46daaf29", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511965, "uuid": "6048efd9-7815-4f16-8df2-c2a91cb27ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511965, "uuid": "20ea6803-f609-4f08-9227-1476ae3667bf", "value": "02c9c7f3139c3542ad06c79be3dc067f168f688af4dfb4b10015c941c5bb78da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f2825e-e98b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767544731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544731, "uuid": "a2a6e97b-db8e-4260-b2f0-d008fda3d69c", "comment": "Malware payload (Vidar)", "value": "626eff030b7c364f188c8aff23eca7a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544731, "uuid": "2c6cf509-9800-4aae-9088-c253a7eceb09", "comment": "Malware payload (Vidar)", "value": "0371de87e229a75b8ccd2cf5b69bbbd5bc0f4ca61857ab5847fd592e92b48fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544731, "uuid": "5669acc6-1271-49bc-b3f6-4113bff408f5", "comment": "Malware payload (Vidar)", "value": "0f56d3199bf23f45ddf79e4752016a3b3c59f0fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544731, "uuid": "cf270ed4-ae44-4610-b832-c374872291ac", "comment": "Malware payload (Vidar)", "value": "c19e5d6423c12d39c67b95d4cb66e19a035562d35a1421023dc016d19b07026093da7c3fecc6cb44968b6a7c332243bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544731, "uuid": "b23ae4ea-66dc-419e-8ad5-2b619e73eb12", "value": "T174B61883EE944229C69BE239EDB552567230F045037112C77F671BA48DCBBC4673BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544731, "uuid": "14c54dfb-f93e-4f27-bf56-978870ff4325", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544731, "uuid": "77e57f50-0240-4b86-aaa0-aea7e517f9b9", "value": "98304:6OmvWiuxa8pzsvv1nSffOBAkpSygfvaU2ZQDP:6T8pz6WOBAkpSygfvaU2ZQDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767544731, "uuid": "ef567202-c97c-4594-91eb-1304b406bdcb", "value": 11149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767544731, "uuid": "3ad15527-9ef2-40b5-bc3a-abc2b53ccdc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544731, "uuid": "aea0843f-8d7f-4963-93cb-ca0114ed1ae1", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff73b6a-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555801, "uuid": "fbc98695-e2ec-48ac-8a96-4926844f8cb9", "comment": "Malware payload (Mirai)", "value": "a75ccfd5f6f3b3bc499ac07a4d0ea2ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555801, "uuid": "a2759ea1-f405-4aa2-9061-16304175aeb3", "comment": "Malware payload (Mirai)", "value": "0373b097052c0b25f252e18e8c77c764be3f761129531abe22ba6b45c8e33d2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555801, "uuid": "928c785b-760b-4cbb-a615-335f8e376c5b", "comment": "Malware payload (Mirai)", "value": "2a81bfc12616a51de5d2d5cb7f8eb95c672c9429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555801, "uuid": "b8dc0e1f-e025-4973-99d3-a954c1600523", "comment": "Malware payload (Mirai)", "value": "6da5cc579cea260c16d6ef28e9cf17931980e53d9b9bc423bbcd39049b60b806d9ae814a946133ab104bc25d0a180254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555801, "uuid": "15b27d69-f97b-4e39-a210-ee743d2bd685", "value": "T1AA557C2AB2B2E66CD007C0349BDBC6A14521F0756A313D7F3384DB352EBADE55359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555801, "uuid": "98fa2385-f9be-4d6a-919f-ea350dc7b1eb", "value": "24576:A9sNE/DGxNgURbhJ1wqbIHnR5uOUI1nGZ+nfrQBY6R6/J:iGErGxNg6fIR5u+MSrQBYNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555801, "uuid": "83342e59-0b8e-4607-924c-a6dc7ce9d292", "value": 1292664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555801, "uuid": "0650916d-77d7-41cb-9a9f-6c172fbd9c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555801, "uuid": "b3a3caea-46f5-403d-8d44-90e426619c85", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5270a67d-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513150, "uuid": "c8cd532b-647d-4f34-bb25-275ea0609535", "comment": "Malware payload (WannaCry)", "value": "d515790cd325a6fa10107f09f7848812", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513150, "uuid": "46f447d6-7f32-4b6a-86ee-67d18f90a410", "comment": "Malware payload (WannaCry)", "value": "03b5d9fdca57de8871f35c9a8803b5ab5a80df47ec5ab5837d591242d8dd60d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513150, "uuid": "38112e07-06dc-421c-83f6-64ac6f80c951", "comment": "Malware payload (WannaCry)", "value": "3bd0e0f0b0756d69a5dd0b0dc62f5f04711f5ed5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513150, "uuid": "42ae3d2e-9ca7-4760-b4bc-edea567639f1", "comment": "Malware payload (WannaCry)", "value": "cb489edc3fe6046bf89feb7e054c148ea434863a46bf0d434b6d63090bc79787f93e96904187b6e3cf367168fd5515f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513150, "uuid": "6ff03ebd-c414-4480-bbc1-4e39a6068ff0", "value": "T16736236A762C91FCC11A6234A0634936E6B37C6A22BD970F8F948B520D13750BF78F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513150, "uuid": "062fc763-e8d3-4304-bbd9-f3300098dfc6", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513150, "uuid": "94681a31-a3ac-43cd-b177-cb6f4600381e", "value": "12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2gmTcbckPU82900Ve7zw+K+D:SbLgddQhfdmMSeYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513150, "uuid": "7502b24d-a32f-42ad-8635-adcfab9fc889", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513150, "uuid": "4387e0ad-d7b4-415e-91a5-c1103bfa9ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513150, "uuid": "6d0cea75-659e-4b71-aa6d-ba0e693554c3", "value": "03b5d9fdca57de8871f35c9a8803b5ab5a80df47ec5ab5837d591242d8dd60d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f68e978-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567155, "uuid": "a1016219-6c94-4b34-99dd-3d9f5b8cd1a1", "comment": "Malware payload (Mirai)", "value": "962c75d59107a39ce177c9e90003dc85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567155, "uuid": "d269e1f1-d636-4125-9bc2-b52160856b2e", "comment": "Malware payload (Mirai)", "value": "03ec21ddd8b3fed4ffe77eebd7fdef674d299f111cb90dccae9317e299cce847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567155, "uuid": "4226b9d1-84f4-42ee-84f1-53578a6c7800", "comment": "Malware payload (Mirai)", "value": "f86ec40da8353bca2a59d4a1f25a97ff71d0a0bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567155, "uuid": "9888cc41-d523-4d54-b303-4d5eb7c230ac", "comment": "Malware payload (Mirai)", "value": "b49ddfb88d7b5ca1441d3895ca9000c08af46782fc1441e1d46d78973c009bc8dda1e17f50cce835b72966fe56a6b765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567155, "uuid": "800557a8-d4bb-41b2-aa95-124fbc37fa48", "value": "T12E831995B9418752CAC256BBFB1E028D772B036CD3FE320799269F61378B85B0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567155, "uuid": "02277591-b094-4af2-bd89-8a0c523acfbb", "value": "1536:LkPyTRqewCgeP3IyW+OcpMg0O7H5FBnBiVvv3CZ:wP2RqewCgEYyRiMfO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567155, "uuid": "47a9624e-1dde-4a36-a363-74580236f46f", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567155, "uuid": "9be77c8f-71cb-4b43-a3d3-8b27b361082d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567155, "uuid": "08751345-3bbe-46b9-ba35-0efb6aaadeba", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f021f7d-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567234, "uuid": "c3284ef9-8711-42d8-92b8-bc226932e4d4", "comment": "Malware payload (Mirai)", "value": "8168e4c63f66f05e3bd441cecde8f9d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567234, "uuid": "bd013943-062d-46cd-961c-64bdcb3fbab1", "comment": "Malware payload (Mirai)", "value": "0466c64f5da8a18de1d8637bf2a8b6481853f274a6864c98809613e8ae2c6e69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567234, "uuid": "e65d3458-03b3-4004-aa39-845304de775a", "comment": "Malware payload (Mirai)", "value": "e2af6cc9c239652e2c7c9684a4aed0d7b2c59f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567234, "uuid": "b64a1a33-0c9e-4949-ba39-448af44cb277", "comment": "Malware payload (Mirai)", "value": "60d0b022b1ac5d9b17d7a7306701651ba2e493d3307c6cc5fcf90e72cc4bfc49f07235ca35667fdd5f586a0a404d659f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567234, "uuid": "5e5d3b5d-746a-4baf-9f8d-dab1a1e52628", "value": "T19D334A42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567234, "uuid": "0225307e-e822-42e4-a2b7-da909aa2de52", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwW:ivW3jdQGqt7Y+Z+zN9cGgI6bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567234, "uuid": "d9f70861-fe58-4454-add2-677a6bfd8687", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567234, "uuid": "3cea6cff-9d8d-41a7-9833-897571868a4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567234, "uuid": "3a92ccb0-96c0-43c0-97c6-595c0e81611e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eb6cc3-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509459, "uuid": "47a540e5-79a4-421b-b111-00a6b7bd32fa", "comment": "Malware payload (CoinMiner)", "value": "c3ac0b2c939faef10928827fe35e5257", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509459, "uuid": "ef779cef-79cf-4b79-84aa-1a04e35c45c7", "comment": "Malware payload (CoinMiner)", "value": "047947ff622a5d91f2f071162b478a4d01aca93a11d33b7ef4ae132908aff966", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509459, "uuid": "bdd6ef80-1b14-434c-85d4-d3a4322cd249", "comment": "Malware payload (CoinMiner)", "value": "41de19de35f78907a83c2b96a2b7cc86509db318", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509459, "uuid": "061505b2-d373-4fdc-ae18-57686b16888c", "comment": "Malware payload (CoinMiner)", "value": "e7bf7fbd6bc62712af6a49344b50d4fbca4362e20f34f3c88836b06a85227f81da5d285b7bfd17a83b07e91daf4a2a16", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509459, "uuid": "a76436d2-fb4d-4a9e-8a07-99339b4bcd65", "value": "T19DE5335100C7FDBF6985D49458ECBF360EAB52F09A188215FE790429BC26EF341BB21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509459, "uuid": "5d58d194-5cb1-44f2-8327-00f70013c206", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vHv:G3LG658+S8YrCpHy2dUu4KrCfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509459, "uuid": "94d0bd66-0fed-47fb-8089-d0f07325a5dc", "value": 3301376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509459, "uuid": "ed09841c-700c-458b-a06f-ae44672097b8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509459, "uuid": "e8e5e326-4208-4729-8435-29140d8a7b46", "value": "047947ff622a5d91f2f071162b478a4d01aca93a11d33b7ef4ae132908aff966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309694db-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767513094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513094, "uuid": "a61cb1bc-a8dd-4cb9-9fe0-17a01ef46338", "comment": "Malware payload (Mirai)", "value": "b88539f610b0494b7ffe18d9108d6a03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513094, "uuid": "e8863608-0468-4b14-b5f3-05519ea156d4", "comment": "Malware payload (Mirai)", "value": "04dde278c32a184daba04b612694752e21f35328d11816a23df46fb605e2e2df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513094, "uuid": "f2de4d79-56c3-4942-96f3-eb80eef0a3b7", "comment": "Malware payload (Mirai)", "value": "207be2f20fec96bf982a9f7367dd3785caf3e767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513094, "uuid": "a3ffb981-f09a-420b-a213-64a5add94eca", "comment": "Malware payload (Mirai)", "value": "299765ad05e49b6daafd1e212c7bc7b6bf667e3d7158a3fc8e9e9d4c94cacf80b17c2f9944d46fa772b7d668628a06e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513094, "uuid": "ee130676-93b0-4823-b300-6e2ba2ab7a6e", "value": "T10DC44B55F8809F62CAC52976F79D829C33174B79C3EB720699144B343BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513094, "uuid": "1198f73a-9a92-4cd7-9968-6a7f33db91ef", "value": "12288:pGk5akPS0X4X0O4g5vqi6woce2gpZ6msdP2ff:bkkab5KIPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513094, "uuid": "29eb10b4-0d93-4451-bf5e-dbf3feb22f3d", "value": 566104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513094, "uuid": "bea04e59-deae-4af7-8c4e-e1ed66e31f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513094, "uuid": "57a8ec70-3515-4949-8ff7-5f1b18b4d118", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef34f147-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509118, "uuid": "497a6b44-bfb1-4087-aadc-789a21eeb601", "comment": "Malware payload (CoinMiner)", "value": "60bf8e0e1b1b92850c0f38edb7a4cbfe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509118, "uuid": "b02d211e-683a-4b79-8aab-36e97d4868d7", "comment": "Malware payload (CoinMiner)", "value": "0514ef6ebc42fe74dd3e55387cf97ce6943815edacf8626def06e61fe4d0d180", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509118, "uuid": "6bdf0bfd-8248-4f52-8d2b-53bc18e49e86", "comment": "Malware payload (CoinMiner)", "value": "ac52e94a5105bc4b6c475cce5afdc65a0c295103", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509118, "uuid": "88c50544-c9a0-4303-a8cb-868e75b09844", "comment": "Malware payload (CoinMiner)", "value": "28238f8c8b69381e1de3796157c78fd994317a9415e91bc27b0a181aaa82b27d0c615c6783d203db3c63eeb77628951b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509118, "uuid": "de754560-eaa7-4d39-a4f0-ea4ba2ceb52e", "value": "T1AD16336511CBFDFE6485C8689CF8FB374E9960E29E784120F92908187C62DE7407B72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509118, "uuid": "2ca56656-29b3-43a3-856c-90c4f33724ee", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgP:CC65sr3KrCfsYiZQgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509118, "uuid": "0728f737-ff86-4928-a675-0c97fe738d6e", "value": 4104192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509118, "uuid": "3b21c2b1-833a-44ac-91c5-ac50be7ba722", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509118, "uuid": "0e9eb1aa-3f47-45f2-9145-2a5708b7034f", "value": "0514ef6ebc42fe74dd3e55387cf97ce6943815edacf8626def06e61fe4d0d180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01d0b74-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511670, "uuid": "cc4412f2-1781-4865-8ce1-8fc7d5a95d2b", "comment": "Malware payload (WannaCry)", "value": "5574508c8668f2ad14ef576d75e1187c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511670, "uuid": "da5ab020-1603-4828-bb50-3352c6c461da", "comment": "Malware payload (WannaCry)", "value": "05aafe02cafac6e06e973328b8e74d7477728f5b240237f0eab9deec079770d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511670, "uuid": "ffbffbb0-578e-4586-9e5b-cd0bd81a3a77", "comment": "Malware payload (WannaCry)", "value": "a8f9056d68ccca4d2850b298f00b9dad94525a37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511670, "uuid": "3e1de0b3-99f2-44aa-ad99-084c5d2e1970", "comment": "Malware payload (WannaCry)", "value": "ec32adad0e753a341cfe1f9116350e06a7d8394a72d3f69f410cc90fd4d6cc701f2cd0a1409916156e719fd8f3726a40", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511670, "uuid": "74522664-b363-41f6-b59a-b91900df4aa7", "value": "T12F36335971BC91FCC10929B494678927B2B33C6A26FE6A0F9F4089652D03F56FB90F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511670, "uuid": "0edd9ec5-e04a-43ae-a703-a6f7be9c4f2e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511670, "uuid": "ac060712-d8ea-4bce-86c5-f923bae889a6", "value": "49152:RnHqMSPbcBVQej/1Ux+TSqTdX1HkQo6SAARdhnv:1HqPoBhz1UxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511670, "uuid": "c47fa354-8fc6-4013-b5af-fed73c087603", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511670, "uuid": "7b9d0ca7-25c4-4e7c-b5f6-f6954e196dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511670, "uuid": "f1847c72-1550-4da5-8953-c88277bb230d", "value": "05aafe02cafac6e06e973328b8e74d7477728f5b240237f0eab9deec079770d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443f29a3-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511838, "uuid": "bfee831e-7702-4871-81f6-027d6836daa7", "comment": "Malware payload (WannaCry)", "value": "49161c63d7c992011bd2936c3aba0e94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511838, "uuid": "bf5b1f54-70c0-4c69-ac38-813e0e27e5a7", "comment": "Malware payload (WannaCry)", "value": "05ea8f66294003b7b2138ee784d08c262920cea050f09002530a4707a7c8ee9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511838, "uuid": "deeded6a-040f-4ad4-858e-6d946f9fb2ca", "comment": "Malware payload (WannaCry)", "value": "36b07c2a3a2d02dd86062557b435c143ad954be7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511838, "uuid": "2f81657e-9cbc-4252-91da-8d134a70392d", "comment": "Malware payload (WannaCry)", "value": "9a1c77b64a0020b260faf9b2df444eee52343e525d6098ba6d0423ac8c84abec149c1cfe450e02bb418c0792b0cf886b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511838, "uuid": "d9fe2734-229c-49a1-b179-cfe077ae033e", "value": "T150362346CBF59B29F6F7747D91AB23301C7DFC06AAA4021D00B85721E13B66BE02D98D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511838, "uuid": "cb3cdc29-79e2-4e15-b89e-4bb35bafde48", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511838, "uuid": "10ca075a-81a3-449b-91ef-080cc48cc406", "value": "98304:+DqPa15G2jzBvXyxepiU1LB+ZHCH3kPFcA469cubRQ6145UJL5UVjhgl4usYp:+DqPa15G2jzBvXyxepP1LB+ZHCH3kPFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511838, "uuid": "263f0340-ea2a-4ed4-8b28-2231b5a69089", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511838, "uuid": "d11bcc9b-aaa9-4521-9ca2-4e30fbc7206b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511838, "uuid": "4670074f-79d6-4a81-94e9-494d40d38e41", "value": "05ea8f66294003b7b2138ee784d08c262920cea050f09002530a4707a7c8ee9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b31f68-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767512075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512075, "uuid": "c7bf2e02-6372-40a6-b220-1397cc96292b", "comment": "Malware payload", "value": "0ec9892a1f1c50fa016839d747164cd5", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512075, "uuid": "008530b9-32bd-471d-843e-88034bae1b9c", "comment": "Malware payload", "value": "063365f34675cf176275324cabc91cc758ef1322562bf9bb6ff6624fac945f24", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512075, "uuid": "1d40eb93-eb94-4ce1-b974-47a812a756be", "comment": "Malware payload", "value": "2aa246bf3d32a813c87dedcd4213aa916d9776f5", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512075, "uuid": "a361a44a-75df-4bc9-a1ce-e0135afba59b", "comment": "Malware payload", "value": "6c496218b489493b998eb799e61a8e494f540cb44a7dd5cfd1ea4ae7219654e7c2ff3f0c93225445999d19afe4a34571", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512075, "uuid": "1ef41007-50f8-422c-b685-222f5a69d958", "value": "T169C7BE1663A116AAD977C1388AAB6503EA73B8071330C7DF329C43752F63AE45D7B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512075, "uuid": "994404ad-7af5-497e-9b78-01e828d29b23", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512075, "uuid": "e5f38a3b-9e28-4d33-a408-4f6cd1d79a7a", "value": "393216:a/jdQ/wilbpfLWPIv1eiHg9aVLB5EVsnHxyataUTKgkggx20+t/VxVDF/xgca9BO:a5EosxTUU8XOkBKgPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512075, "uuid": "04e1f77c-ca10-4306-b06b-9ead6e292e46", "value": 54475776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512075, "uuid": "096e2cbc-f546-469d-9273-cf79da01021e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512075, "uuid": "1f88224d-f043-4e01-b71a-84db634a8cd9", "value": "NyxoraV22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f9823b-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511311, "uuid": "c6357db9-985f-4b7d-b10a-50f1cb7ddb65", "comment": "Malware payload (WannaCry)", "value": "47e337bededfd434cada3deae9f17584", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511311, "uuid": "d028eef0-79b6-4fd0-ada4-a38db556e9f2", "comment": "Malware payload (WannaCry)", "value": "06867ecdcfb797b6c7c507125cd1c9508e972cf30b2175e0f530262d45d78e15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511311, "uuid": "4e7ed274-0ea6-4928-b6be-30bccce15161", "comment": "Malware payload (WannaCry)", "value": "cc1fe2f5136c8d80ee90abe22fdccda22f908f4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511311, "uuid": "9bafd3db-17cb-413a-ae92-67978687b2d7", "comment": "Malware payload (WannaCry)", "value": "cef4fa9a40e3b437b2e8ab3eb3efa8da5c9dd263a8682473fc196dc2ce8cdb47b5d8bbc4827f81bece3385a1ac904d5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511311, "uuid": "03b0c3e9-356a-470c-a418-0d8b29e7c51c", "value": "T1A73623A670ACC0B4D206287444AB8A62F6B67C3925FA6D4FAF804D352E63F57E714743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511311, "uuid": "4a185ec4-eaf4-4cff-a62e-d1dd6738c459", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511311, "uuid": "cd441a97-2838-4d28-a1c6-d78c4deea6e4", "value": "49152:Rnp9MSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1p9PoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511311, "uuid": "73b6a11d-28d3-4370-b7b5-dac5deb811c1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511311, "uuid": "46b7525a-0a2c-4509-807b-94116ee5dd6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511311, "uuid": "a36b3135-7405-41f4-96b7-2a97bc503104", "value": "06867ecdcfb797b6c7c507125cd1c9508e972cf30b2175e0f530262d45d78e15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ef7f3c-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509044, "uuid": "efa8a402-1c37-471a-82c9-11659ab89cbf", "comment": "Malware payload (CoinMiner)", "value": "ae87f86f98a9428c6a48c02627243105", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509044, "uuid": "6054f083-a141-4717-80c2-dfc0e1ec7433", "comment": "Malware payload (CoinMiner)", "value": "075faf9127b5a494390353f4bbf4eb1fac61a5dad7edfb721e498201202444d4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509044, "uuid": "278d61aa-d2db-4dbe-a821-717684ef5503", "comment": "Malware payload (CoinMiner)", "value": "9cb2bfd6b78db887e2636dd18f26736457cc76bb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509044, "uuid": "26eee1f5-eb35-4df9-98fc-8c1f75e075b1", "comment": "Malware payload (CoinMiner)", "value": "4fe585c46d09439fdabb6c7b429d5d8cca2ec594c02534a1c664f3547e167921c4ff7479b51fbac48fa80354ce9ead7a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509044, "uuid": "dd7dc8da-d6c6-4739-a762-666cde1ef2fd", "value": "T1F516333511CBBDBE7589C864ADF8FB324E9925E29D784111F8390828BC65DE2407B72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509044, "uuid": "695dee9c-05e4-48a0-97eb-ba2f7c619610", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhY:CC65sr3KrCfsYiZQgzJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509044, "uuid": "7cbe3893-bf64-4be6-8608-5adde1a79c17", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509044, "uuid": "72200d29-1643-4b65-a7e8-53bcef61c052", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509044, "uuid": "3b4d76fc-f2dd-456f-93d1-b5523dda4aee", "value": "075faf9127b5a494390353f4bbf4eb1fac61a5dad7edfb721e498201202444d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45612402-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1767512699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512699, "uuid": "e58ad636-60f4-41fa-9d99-4a71e4bb536c", "comment": "Malware payload (Expiro)", "value": "2d612826a839f565207cede6aad737dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512699, "uuid": "32eca95c-6788-48d5-bd65-cd873437a498", "comment": "Malware payload (Expiro)", "value": "078f601863e74d8213c98e7224f2a01eefef23ee06c5fff3550b1a570bc0b5eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512699, "uuid": "c33dd5f7-912d-47b9-b82c-9ee0f00c2302", "comment": "Malware payload (Expiro)", "value": "d28ba316ab36b915a3d814489b68103f940a36a2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512699, "uuid": "2f71d4ad-d353-410f-8994-589df718eff4", "comment": "Malware payload (Expiro)", "value": "09d2eab02d7e1a3079228fcfa783c6809c39897e0a63ae232f8e043debbaf6caf2c941a13b81b6c172faa9a30784487d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512699, "uuid": "ee042919-cb56-4c39-96b8-3f298a600c21", "value": "T17B363398611CD6BCE1050EB544678A2B77773CA9A3BA5F0F87C086360DA3FA7DBC0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512699, "uuid": "76614a17-24f0-4fce-9eda-ae7919d4fdb3", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512699, "uuid": "840b4490-7c19-45b6-9e35-6afee7548fe7", "value": "98304:8DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H9NEex+u5Ck9:8DqPe1Cxcxk3ZAEUadzR8yc4H9NX+uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512699, "uuid": "eae4d63e-4454-45b9-9e8c-d3a9ecb125f0", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512699, "uuid": "c54cb2ee-c0d2-4b70-878a-6e39a960ee13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512699, "uuid": "8d698d59-937f-4029-8a70-92e83f4cde6e", "value": "078f601863e74d8213c98e7224f2a01eefef23ee06c5fff3550b1a570bc0b5eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449338ee-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512268, "uuid": "f406f77d-5807-4b0a-a24e-7048ddf742c8", "comment": "Malware payload (WannaCry)", "value": "365cd93486bd22362789faff770ba332", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512268, "uuid": "9ca7e46a-257c-456f-9c6b-fd6c75e088ff", "comment": "Malware payload (WannaCry)", "value": "08156221a2e4964fb56c0abf2302f11f315dc82ad1ca7c183a1cf370da6a8fed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512268, "uuid": "988c13fd-b6c1-4928-bf22-19d2e3c65acc", "comment": "Malware payload (WannaCry)", "value": "2cba25d9c4715cedf4002abf6ad4e76ab88ba152", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512268, "uuid": "95a4080b-31ec-4eae-8da2-ca83859a0561", "comment": "Malware payload (WannaCry)", "value": "cecfeddb3eba633552696169822dc12a418b81c5395edda42eb2d7e8cc41dc3a6510fb6bd9e9987facf64f7a18f12538", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512268, "uuid": "e21fdea2-9c25-4df0-9f2d-01d2151d16f4", "value": "T14936122634ACC071C113623058A7CB62E5BA7D252779A54F7F904F7E2E237A1EB19B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512268, "uuid": "ff453a74-f73a-41ce-8e4a-ac2cb8f02e9d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512268, "uuid": "ea4d9c70-4cea-46ed-9355-5ac46d9a68ba", "value": "24576:SbLgddofEcQdIvrYbcMNgef0QeQjG/D8kIqRYoAd:SnAsEjbcBVQej/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512268, "uuid": "b7d8e7a1-94f9-4307-960e-8c37d9808dfa", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512268, "uuid": "20d9bab9-cea8-4bcc-877b-4edc1dfc6c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512268, "uuid": "d8d606a5-d799-4dae-9670-7099c66f97d2", "value": "08156221a2e4964fb56c0abf2302f11f315dc82ad1ca7c183a1cf370da6a8fed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd7c7b9-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509811, "uuid": "3628e52b-741b-4a48-9e08-54ff13feee38", "comment": "Malware payload (CoinMiner)", "value": "a79eab24a31d09e4f4365d0fd7e15fc1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509811, "uuid": "eaf3d27f-7cb7-4608-b242-e66b27623756", "comment": "Malware payload (CoinMiner)", "value": "082d9d105120cb969039898848da7a654a74d7173c8e325250872ddd1a495312", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509811, "uuid": "e3e221e3-98f8-4091-9dd8-b15dbe76ce61", "comment": "Malware payload (CoinMiner)", "value": "0e8a2be15eaa83fb7374ee564a1d4416b4d406d1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509811, "uuid": "d128651c-5f34-4571-8d37-b38e2f31e5c3", "comment": "Malware payload (CoinMiner)", "value": "8bb4f07a029c19e8d321ae82bd82df3b9b82445071480eff8784e88b763e68533bfb957a6210660d433a1f7c7f528d64", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509811, "uuid": "d329e8cc-3643-4ff4-ab4a-0343d5645af6", "value": "T17995336101C3FB3F959DA9C458FCB6311E2555F12B2956A6F80F0C9BBC32FE901A790A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509811, "uuid": "8fca35b6-e4dd-4e25-9f2b-65fa2f769858", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd9:G3LG658+S8YrCpHy2dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509811, "uuid": "8529cd49-24d1-4d6d-bb50-4d9fd824a2db", "value": 2048000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509811, "uuid": "810b68aa-8a29-4567-8590-6ace49d76ce0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509811, "uuid": "56b725ff-5870-4bd0-8e2d-87faf63b84dd", "value": "082d9d105120cb969039898848da7a654a74d7173c8e325250872ddd1a495312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5ae540-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512551, "uuid": "a95c7fee-9099-4d91-8d14-f402a6904510", "comment": "Malware payload (WannaCry)", "value": "684e5f7cc70501e444e47d65bfb7638a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512551, "uuid": "e2d79689-107f-44b0-a19f-e3c5d23abc58", "comment": "Malware payload (WannaCry)", "value": "083d04c3c56143b3b9171e0f0e07a0c91d5ffa5d8c3e96b43c4f7ec890352512", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512551, "uuid": "f9e036d8-773f-42f3-8dac-af7c03aaaaf5", "comment": "Malware payload (WannaCry)", "value": "5f2355884799e3596839d230c530229f04f05818", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512551, "uuid": "e9eca14d-16a8-42e4-89f0-6952ad854ca0", "comment": "Malware payload (WannaCry)", "value": "8d14633005ac5a9dd08aafdf75e16ba2ef6bbecaa5d1453dd5681fa8268682269180f37fa39152cb693364600c756838", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512551, "uuid": "4daacbcc-54bf-4066-b0c4-8ee8eb158905", "value": "T121367101D1E51AA0DAF24BF7266ADB10933E6F45995BA66E1222500F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512551, "uuid": "82c811fa-3c64-4906-a01c-5c06a4cd687c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512551, "uuid": "3de0c689-2e45-4785-965a-ab5bcf798667", "value": "12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DH3BSfiKZqMu:SbLgddQhfdmMSirYbcMNgef0Q0q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512551, "uuid": "f97b84f1-169c-452d-90f2-1873f03e3d5b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512551, "uuid": "a0752004-d79e-4abe-8134-6f2755d63454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512551, "uuid": "743ade0d-82d4-4e9a-8f09-82b762bed6ae", "value": "083d04c3c56143b3b9171e0f0e07a0c91d5ffa5d8c3e96b43c4f7ec890352512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59acb7d8-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513163, "uuid": "38037259-4f40-46bd-a179-f1d147712e14", "comment": "Malware payload (WannaCry)", "value": "916c6b6f0815ee470905df7b8a9868cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513163, "uuid": "94b15601-d3aa-4636-a352-7050d891c7d0", "comment": "Malware payload (WannaCry)", "value": "0858f55fbf04bd949ed49dca205f721525438a4fce70125770457dc89e4465a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513163, "uuid": "0daad771-0921-480d-8b61-abf536b91d6e", "comment": "Malware payload (WannaCry)", "value": "67417a736b57e22f3c38217d1508969762ccb204", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513163, "uuid": "bb7e3ccd-f376-48ea-9bf3-06012210fe98", "comment": "Malware payload (WannaCry)", "value": "58e2efb47010fcc93a714d8f9fed8a85424711f948795bb317ec76263c0042da3d3c9c5dc53a93d4c9c4ae97681f5d80", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513163, "uuid": "b8150cea-7f13-4b96-832d-62bef04da67a", "value": "T191362355726C91FCC11A1274A063593AEAB73DAA62BD970F8B948B630D03750BF78F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513163, "uuid": "7e9d4682-6fbe-479f-9619-f524f12dcd62", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513163, "uuid": "16d2d706-5a9b-43c4-8135-bc6d1b8bac29", "value": "24576:SbLgddQhfdmMSirYbcMNgef0q1LJMfcH9:SnAQqMSPbcBVqxJM0H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513163, "uuid": "4291cc65-3795-454b-8881-499e41713d0f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513163, "uuid": "d505c3c1-e90f-4615-8164-b3db89c3599f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513163, "uuid": "6e276b89-3de7-4ed0-892f-5d7fe559353d", "value": "0858f55fbf04bd949ed49dca205f721525438a4fce70125770457dc89e4465a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75fcdfc-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512085, "uuid": "411b2e89-37cb-4908-90e6-8160e5994210", "comment": "Malware payload (WannaCry)", "value": "0841a44223f86a6d566ef30b16da096a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512085, "uuid": "16346801-42f1-4fd8-a3f2-55711a847b55", "comment": "Malware payload (WannaCry)", "value": "086334f4bd742732be1e51432299ed1499318895272040c7b096ea42377bd4e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512085, "uuid": "dcd27989-908f-4f4a-9f67-f588aeaaebf0", "comment": "Malware payload (WannaCry)", "value": "fb2eb8750ab33adad73e84bf33e24736d7b5b741", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512085, "uuid": "8fb84c9c-11e2-46cc-9de6-4e536b244802", "comment": "Malware payload (WannaCry)", "value": "0644116c5c603bc7b94047c2a3fa1189d8686b88d38f657b41953474b9a23a3c7ca34fe0608a38c3ae9d448248a66851", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512085, "uuid": "6ed2a136-094c-436b-99c6-98089d76f4a0", "value": "T145369D01E6E51BA0D6F25FF6226B9700537A6E45C99BA25E1621A04F0C77F0CDDE2F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512085, "uuid": "7b93fb21-fccc-4941-8241-5e9f07e6b2de", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512085, "uuid": "68c12b94-2ba2-41c9-9803-c22629debace", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512085, "uuid": "7c3826e0-97bc-4723-8e68-b9265b0277c0", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512085, "uuid": "96479cff-4c53-4275-b7a0-f7536ae97429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512085, "uuid": "8863cfea-f947-45de-9338-fb7efbea108b", "value": "086334f4bd742732be1e51432299ed1499318895272040c7b096ea42377bd4e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8006cd1f-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555747, "uuid": "52323f4b-7efe-464c-8ecf-8de740bed9b0", "comment": "Malware payload (Mirai)", "value": "b449a2b279dd661a07a81055596a51de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555747, "uuid": "573a8ef6-ddd0-44ab-8c0f-1a78e08324d2", "comment": "Malware payload (Mirai)", "value": "087d174985a562cc21c3a06200365b995d07afd07a6f95235a5b897dff54d2d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555747, "uuid": "7f2630bb-4512-4486-bb7b-e15d41b3d7ee", "comment": "Malware payload (Mirai)", "value": "8cfa14aad54168bceaaecdb5cca6d77dd4d2d628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555747, "uuid": "f0ef9813-53c9-4846-b598-e2311c2af2e4", "comment": "Malware payload (Mirai)", "value": "776842fbc5a959939d8439f4a31e02ecae777218ea67938d707704f8600d51d56293987f7c42ec8dc1bac32adf5e541a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555747, "uuid": "75b17dbf-3e2b-409b-abfc-3c93d7120e19", "value": "T1F2B423B2019791A3706AA77B9CE98AC43E7E55F698DC48F2EE518567F0783133CC6630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555747, "uuid": "d3c55a8d-dada-42df-9973-2a48100249f9", "value": "12288:HthwEkp7c1R1r1Li8wGUHA0sYtoodDyYZ+NBZK7IEyfuwM+9:HbwM1R9JrUH9sYtoQyYMNBZEkuwM+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555747, "uuid": "efbde6ba-77fb-4783-9db4-3bd2b0b01e28", "value": 537660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555747, "uuid": "f8c3c1f4-595e-45f5-8603-9858a073e766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555747, "uuid": "da9538e2-992b-454a-a12f-52aca27ed231", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b205636-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509729, "uuid": "fb30d2f4-2c86-44ca-af2f-6c569acd5485", "comment": "Malware payload (CoinMiner)", "value": "f815139d844e39279d3a6f85e4028242", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509729, "uuid": "cafc144f-b8e3-4901-9b1f-708997ad67f7", "comment": "Malware payload (CoinMiner)", "value": "09d42daf108f795bd1718e55dbda50e2bbb2cc794ac0182c33c2c9588d3ebe6f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509729, "uuid": "585b1e75-9092-46f4-b36f-75bd6181602f", "comment": "Malware payload (CoinMiner)", "value": "d92060002562eaf940db91be77155e21199c505b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509729, "uuid": "612535ac-6ce0-4b01-b717-9e8f19431955", "comment": "Malware payload (CoinMiner)", "value": "4aba594a7f9f3978b2efc0e4f3d4c59604b6de47aad48dcc08b8dff33536073b8b060613ed9fbaba4dd60d741827fb94", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509729, "uuid": "5f391bcd-b257-4e6a-b190-8de84a79667c", "value": "T11FA5335101C3FB3F909EDAC4A8F87B310D6655F16B281A52785F0C5ABC72FF901A791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509729, "uuid": "da306952-6271-4b3c-bc55-684fa57ca36e", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuM:G3LG658+S8YrCpHy2dUuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509729, "uuid": "0dd6e031-0500-4da0-b48b-0347397bd79e", "value": 2236416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509729, "uuid": "1435a333-cd67-4fdc-9966-6c1abed3b4f5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509729, "uuid": "b5ba49fc-01b0-468a-ac50-3e7fd4166253", "value": "09d42daf108f795bd1718e55dbda50e2bbb2cc794ac0182c33c2c9588d3ebe6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8492c510-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513234, "uuid": "7704249e-eaff-4eab-990e-e1c1f4d069cd", "comment": "Malware payload (WannaCry)", "value": "bda33995e71a10dc88fd490b6623ede9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513234, "uuid": "ad66a37c-43bd-45b1-bea2-7ba048a762ef", "comment": "Malware payload (WannaCry)", "value": "09e353d412014f6125df6e1baef1fa6b8ae04c4e1185bcd284641a0946a580bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513234, "uuid": "d2f2ac7d-1306-43d6-9efe-278b9f31787f", "comment": "Malware payload (WannaCry)", "value": "f78f0207cdcd4081c9ff9ad4e2c703fea7378371", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513234, "uuid": "e6305ab0-d492-4d3d-b25a-39178521acd4", "comment": "Malware payload (WannaCry)", "value": "15cee3eeeed14b0541391ee827193ffcc33e6769534936442ff45331ae095c86a888543b43b0a4e6db1988fa5a3d1ea3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513234, "uuid": "0ef643a0-2321-4e5e-8a60-929b9fa57c63", "value": "T12336236630E8C0B4C103557444ABCA62F6B57C3A27BA694FBFD04E7E2E23765E711B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513234, "uuid": "fdbfc279-46a5-4ae4-94fb-f7b5d6e6714f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513234, "uuid": "f9a43c84-1ae4-4fad-8e9a-2cd43f80a2e4", "value": "49152:RnpEjbcBVQej/1INRx+TSqTdX1HkQo6SA:1pUoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513234, "uuid": "524f6c37-4078-496c-8899-05fe814d6f60", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513234, "uuid": "e91e826d-7fc4-41f5-97cd-3826f80e115f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513234, "uuid": "80df16e2-ecbc-4a50-99b5-61a2ffe38db1", "value": "09e353d412014f6125df6e1baef1fa6b8ae04c4e1185bcd284641a0946a580bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a6d599-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767512060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "75814667-19ad-4747-aac7-487cd5227f94", "comment": "Malware payload (Mirai)", "value": "122dcd4563bf1ee62a680e9c076009b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "99955e3c-5506-49db-9d5d-67fcf33a423c", "comment": "Malware payload (Mirai)", "value": "0a0648e2081f155798afee424e4a02dbc7d49f58543e1c17df20ce1fe1be4b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "edb9f542-ea73-41d9-a418-add739815977", "comment": "Malware payload (Mirai)", "value": "476c0e1aa7d40d0e4070e9dd6bc06064f82e12b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "0205d017-b1c7-4954-abaf-edd5d2b467a1", "comment": "Malware payload (Mirai)", "value": "060721ee0b4dcb65ff9f4b1ab499ec52771165ad7ef1c578ffbf228b296fa76fd0d38ffbcadf85787e002d7b2fab1086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "c34b927f-a17c-40d7-b166-bc92f959890b", "value": "T101C44B55F8809FA1C6C5257AF75E829833134B79C3EBB20699145B343BDB86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "5067e61f-215a-4ff3-96ec-8ad2411393d3", "value": "12288:urDJWg0XUdMtB9fmliON2BGgGISxgpZ6mGa:It3yBdmliw2BG1ISvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512060, "uuid": "a5671b55-334d-47c8-b155-508f317a3a44", "value": 549724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512060, "uuid": "eaff09cd-aa0f-4cae-afc3-57eedced504a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "cdf5219d-439c-48d6-8df3-5521137e555a", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d4ad6e-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555191, "uuid": "7631663a-0bb2-43fd-a290-426b3a990664", "comment": "Malware payload (Mirai)", "value": "6510baa740b83728b0bbff0a9e0b902b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555191, "uuid": "b82155a3-3ca3-4056-a28a-b7bddbc3ffc5", "comment": "Malware payload (Mirai)", "value": "0b096e65e79c39ea927f18c51f8996262c4811979c5038d1caf2dc742b6c9c32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555191, "uuid": "e835ddbb-3785-48dc-938e-fc7a7e1a03b3", "comment": "Malware payload (Mirai)", "value": "eefcffb738e5109e83d2ab64849feb0eb5b8e1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555191, "uuid": "96523a03-6caa-43e0-9168-a1ab6a4916a3", "comment": "Malware payload (Mirai)", "value": "7163a3301383de600f3b190a12bee82c4e5fc4857d12454eee42d7e5a1176912662ebff78326f41e2ef911638c2c7a71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555191, "uuid": "be28ba78-5f01-4d77-945c-d176135ef15a", "value": "T1A4345DC7F901CE7FF84BA7B644670A05B430FB6608630737B267BC96AD260D65913E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555191, "uuid": "3bd8e9b3-f220-40d8-8b4d-5bbaec069568", "value": "6144:KN/TS4+nAqxH3OHUywH+w4odAsBiPLhUq:xI5Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555191, "uuid": "5ef8db8e-98cc-41e9-9e24-6150d66734ab", "value": 237760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555191, "uuid": "f79437b1-f499-4aa2-a0e6-62558f105f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555191, "uuid": "2890b8d6-5943-46f0-ade0-96b179259749", "value": ".k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1c802b-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567152, "uuid": "ead392e5-be4e-4841-805d-b421b7c90922", "comment": "Malware payload (Mirai)", "value": "81746973e8735b32327d905eff2fd9c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567152, "uuid": "d75df8bb-ac02-4221-9b48-3ee2861d0c0f", "comment": "Malware payload (Mirai)", "value": "0bc1ad27603f66677501cc828a9593f21e01ffe5633367bd515ded91785c1c10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567152, "uuid": "4631b0fa-3fad-47ec-90d3-cd5998814dd8", "comment": "Malware payload (Mirai)", "value": "5a88231e5b8ddf65e4e1860e2b2a60b42776e208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567152, "uuid": "b1a39c0a-a6ff-48b9-8a58-bda5c7dc0829", "comment": "Malware payload (Mirai)", "value": "d91639604a7c2dd1735c98a00babfb4882e65bb7c78fec228d76c3534a1cb5f7177c7beac1af87b96ff40ae6ccb75a37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567152, "uuid": "dd8d2dc4-daa9-4149-8020-262fc0758cbb", "value": "T1BAB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567152, "uuid": "ef6d5944-efc3-43f8-b85f-8349d0fa4fe7", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1g/LWy:c9sSyzz36YaWWgg1gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567152, "uuid": "5bfcec20-6bea-44a0-9f40-9a0f6be14dba", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567152, "uuid": "695830a0-ec83-4ba0-9268-5aa6829d1dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567152, "uuid": "82b1e77f-3dc2-40ac-8bf9-d78756c42fbc", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174e7d2b-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512622, "uuid": "b97b0280-81b6-46a4-be8e-f8a009e5e04b", "comment": "Malware payload (WannaCry)", "value": "0644c067fee2dd9c9e4983baca8fa63f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512622, "uuid": "79d7e09d-ce2e-4e10-9fde-c8f91bd32463", "comment": "Malware payload (WannaCry)", "value": "0bc399b04f1be33f682a0c027a2533cbef5e92553092f75f5daebb21b4b48044", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512622, "uuid": "5529e1e4-a00e-4b71-a40f-c547428d9bb6", "comment": "Malware payload (WannaCry)", "value": "f2f09cfad9249f087bc078519560bd0958cfd67f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512622, "uuid": "a296c576-f9fc-42da-83a4-9d3eef99e30e", "comment": "Malware payload (WannaCry)", "value": "6c5c98c9136b6f476048b47d2c33cdc359fa89305fc969422629b4d59a33a5df15559f40f2a08fd8601a66edd7629886", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512622, "uuid": "18a2faf0-3734-495f-9e9d-5ae394db1586", "value": "T188363358A2BC62BCE1A10EF404B38A56B7B33C5667BA8E1F4780425A0D53F5B9FD0F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512622, "uuid": "cbaa38ab-97c8-4cc0-a1fe-74066a4ed873", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512622, "uuid": "b591dc55-32eb-41fe-89c5-950610f4c7bb", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593RyyAVp2H:+DqPe1Cxcxk3ZAEUadzRyyc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512622, "uuid": "8c42f3fa-b42d-489d-9504-7ac0d6228ede", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512622, "uuid": "2ac73f96-cd58-48bf-a188-8b1f9a432926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512622, "uuid": "6c7acf08-3bbe-452b-b522-0594ed7a0d55", "value": "0bc399b04f1be33f682a0c027a2533cbef5e92553092f75f5daebb21b4b48044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a09c733-e9ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767559227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767559227, "uuid": "96f81278-0a22-4365-a37e-f1e499f685b3", "comment": "Malware payload", "value": "48052ec31699381c478547a9af122c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767559227, "uuid": "5d9a044e-dedf-42ad-aa06-5f07ca043f77", "comment": "Malware payload", "value": "0cbe2b8f54aa033af50031deee7229d9c7be72ba667e834e4f1e7e58167327a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767559227, "uuid": "7a723fd3-48f0-43a6-8229-848646d31fd9", "comment": "Malware payload", "value": "3cf49e7b1829db9762a5ac3ad30a7b989833c2b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767559227, "uuid": "4b670e3a-af78-4193-af65-26abc48a0a2c", "comment": "Malware payload", "value": "2f45e7a6f117657f6c6cc573719a20a56fd1ab9ecb3de1e609115b577870b60fd1a384a6a5e986a2623a89cd243086b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767559227, "uuid": "bb4f3514-a17e-4969-8ef2-66e2b30dfb4e", "value": "T1B6A533F944F7EAA7962FF72FB80B87EA7698611CC7D81FB0523461414D228131E44DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767559227, "uuid": "3765a7da-0301-455f-b587-51463a8be8b6", "value": "49152:HK6lvnErLKzPahZEye3U1/60nZOLbcKl1Fkxp2FH9eqS/o0lD3hEcKbrAaN:5lu6PKdeuDnZOMMiIB9nSZb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767559227, "uuid": "102319f5-b397-4897-a8a8-3e8acada9f02", "value": 2134397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767559227, "uuid": "cfa4f84b-334d-4084-93b9-b2c9913aaa02", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767559227, "uuid": "dfe2ce33-28ce-4a57-a721-451a80c1888c", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2c784b-e94d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517812, "uuid": "aeefd2de-3ddd-40fe-bfe7-27afb726a5be", "comment": "Malware payload (Mirai)", "value": "21877b459c38ac4935bfd3840c2008d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517812, "uuid": "1bb6a164-2bd3-473a-b24b-3bd736c41321", "comment": "Malware payload (Mirai)", "value": "0d069485705e30cbc7cb994f813f38e49cbd49b10c571943f25365ca7738dbd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517812, "uuid": "2c541be8-afef-4ef9-95ac-ca0f7ca9db27", "comment": "Malware payload (Mirai)", "value": "e79fe82a0cc928466ad57b419bdc5341359c12e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517812, "uuid": "62aacc78-804c-49dd-b3e8-ed39749e7b1e", "comment": "Malware payload (Mirai)", "value": "02d116bfbecd5e196a2c343efa3a2f9e22ab23b8b31f41558becc252b2793e16a50575618d81a8f21f65dcb23d9237b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517812, "uuid": "757806dc-e089-49bb-bf14-aa40e1cdb811", "value": "T1BED3F846BD418F13C5C321FBFB9E429C3A267F6DD6FA71029D25BFA0278A4D60A36111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517812, "uuid": "5835edac-ea1d-4d2f-8ede-92053dfdc69c", "value": "1536:qwXdztT9lP/kGLwQR2k5c4VhGtcXT0DJWTgcM/O8VFz8GIzbSilhywywc0Z/s5CH:n1P8ZQRs4et8IlWvtrfkmJK+h6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517812, "uuid": "c679b641-f3ee-425b-a2aa-ff0aa0dfae75", "value": 140356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517812, "uuid": "14b1c756-a367-4930-b9c6-12c1ee602f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517812, "uuid": "81254d86-63d6-487d-97c5-4e745798a9c9", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc95858-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567150, "uuid": "cf7e24db-8be4-472d-88bc-85f2c113f263", "comment": "Malware payload (Mirai)", "value": "258564af1e0dc01ccac9e0b3f8bd4ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567150, "uuid": "ab8c52d9-5934-4c63-8a84-05627b10cab5", "comment": "Malware payload (Mirai)", "value": "0d0a431735b0d6e6bbac0a736bcbf91e527370a5aff8a75db3e80a91a88f0a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567150, "uuid": "de2c4bc2-a4db-4281-800e-aa516e0525bf", "comment": "Malware payload (Mirai)", "value": "860f00e6a1ca8b107be2634da8146433eb32e5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567150, "uuid": "2449c8cb-5f61-4936-85b9-9d7ba697ba53", "comment": "Malware payload (Mirai)", "value": "6b6b889111464902a9ecc109c54e2d6568e55acd31ce3a331dd38590e7fc4656eaa2dffa7d3be9155720969bbeff3c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567150, "uuid": "5dcc1495-097a-4343-a0c4-9708b2f5a763", "value": "T11DF33B46EA408B53C0D22BB9FB9F424533239B24D7A763059928BFF43F4679E4E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567150, "uuid": "875aa163-a465-488b-ab50-a851e95626a8", "value": "3072:YfX/q8SagF3EvtaS1OSTuVBww9ygIOF+VvdS/U2KWAM/9d5mqS7YStQ6:b8SagNEvtaXSTPw9/IOUVvd6U2KdM/9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567150, "uuid": "37da867c-1f09-477d-868e-a9f0b99ec355", "value": 172121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567150, "uuid": "eb827800-0141-4bd6-a3c2-53f19c227f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567150, "uuid": "7dfbf422-2a78-4dfe-a8a9-3e3ef2ae5988", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeda456f-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767554967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554967, "uuid": "38023110-63cc-44e9-8aac-e3453aa42d8a", "comment": "Malware payload (CoinMiner)", "value": "d00111fc3df4e3fa3ec2bed19bf4972f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554967, "uuid": "d0cb048c-a352-4bc9-89f8-42c979f4294b", "comment": "Malware payload (CoinMiner)", "value": "0d1ffcadc3b75c99807be361c95c9742377ec7aec19e25d2e88225e75dfbd082", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554967, "uuid": "a7a96008-8790-4672-9cfe-4a0c98365315", "comment": "Malware payload (CoinMiner)", "value": "376b0978c54a018719196049d647a2f59322a803", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554967, "uuid": "d094c403-2630-4249-8700-b1a8735d5fc2", "comment": "Malware payload (CoinMiner)", "value": "f80f8d19651dac459c29b3452901beb2e8ecac9998d45b5009e885e3329b0c40de01a426c9c25b2696ccff9c527eeed2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554967, "uuid": "db5fb86d-5542-4d7c-8918-2c8a766ac554", "value": "T1DBD62317E2B356F9C16FC03887929673B97074AA42346E6D1EA5C7321F20E605F6EB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554967, "uuid": "41b48037-5a70-44d4-82e2-a54b166ba3e6", "value": "1755cbdf5b672e9d7b715e15506ab0c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554967, "uuid": "525c02af-fbcc-42de-b57d-a9b76bcaf92f", "value": "393216:DyF7ozZ6FbAjSXzbiv30/pptrUem/8I77Z:Dy5oNzuj+E3SeY5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554967, "uuid": "b1b41eb1-1092-40af-9270-b2273554513c", "value": 12979136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554967, "uuid": "8180056f-20f2-404e-9cea-fc65f523eb89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554967, "uuid": "d40df849-c24a-478a-bea8-766f3b68094f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac378eac-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516737, "uuid": "5fffc364-ae3d-4725-906f-d4bc6260e67b", "comment": "Malware payload (Mirai)", "value": "2a1831c5a9d6ff46ab8e8505c1edb574", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516737, "uuid": "fa69defd-1b36-471d-9250-85f86d457c98", "comment": "Malware payload (Mirai)", "value": "0d6a754f8ff4f53dc5049fc7968f5eff15ebeab418162751653ee1472ad463f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516737, "uuid": "07be0804-e0d0-4815-9ca4-4186e8f8164e", "comment": "Malware payload (Mirai)", "value": "b35467b08352ddcd859104422c5258d9144c5586", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516737, "uuid": "258aeeb1-e4f7-482e-b7d1-177220f9383b", "comment": "Malware payload (Mirai)", "value": "e6f1ee36c41aad2d320d50db0abdb840e165611707e759a099d6b2c38fb4d9863a4a02dad81d3a487c818df7dc5522e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516737, "uuid": "c6cc1b2c-ac7e-4de6-b0c4-df4a10221d89", "value": "T1BB243B56BD91DF15C5C221BAFAAF808D33131BB8D3FA7112DD106F61638A99B0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516737, "uuid": "600d5b47-4442-4186-8f15-ea2e98eee477", "value": "6144:IAHpJFL9Y1XHX+6b/ztOzuS6arBtMhz0uEIoHB7mopv:zHpJFLIXHfCuS6aVtMhz0uEVao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516737, "uuid": "c5656b89-4e64-4f78-8086-2a50be82e3bc", "value": 214144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516737, "uuid": "4824ca42-afee-4f40-b8f4-c36216b20fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516737, "uuid": "08f31106-1e88-4ed7-8e63-058eff1a0980", "value": "0d6a754f8ff4f53dc5049fc7968f5eff15ebeab418162751653ee1472ad463f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15847012-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509612, "uuid": "e1dfdd72-86eb-4377-94ff-035d3ebb56a0", "comment": "Malware payload (CoinMiner)", "value": "06eac5c33e0510406ee13ed48022a64b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509612, "uuid": "b9171ebe-81b5-4a76-93f0-62802fd7a639", "comment": "Malware payload (CoinMiner)", "value": "0d97f2d7941e44cfe2cece9b77aa25a86c4261bcac2de10362d3fca29339efc9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509612, "uuid": "960c20b2-87a7-41b5-90f4-1e2f97521c1c", "comment": "Malware payload (CoinMiner)", "value": "9e51293202d9bd3fb69bdb288b8b1051d4ce153d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509612, "uuid": "2273f7f7-6fd0-43ef-83d1-9347516bf6c2", "comment": "Malware payload (CoinMiner)", "value": "5d7f3c4d7b0c7de45a57fe81744679b5cfa7af73014e7999939a82c6edacbfe70a757cfa0e4f359a708032716e34bc84", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509612, "uuid": "ddd9d710-7300-49cc-9add-2e5d1ea125d3", "value": "T1DAB533844195D7DF7EEE641301BA86252752638DB067310AB5FB0A3BEAF0D47D7A8B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509612, "uuid": "4ec45ee1-e59d-4379-87a3-d7d1cfd9aa6e", "value": "49152:QzDFRL1HbBAdk+qhKKcHDECnXKAoSw4m7pLWws3LPuII5utWBz0Cg7rUQP:QHJ+3jE8XKA89zsj1t5PP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509612, "uuid": "93d60bcc-95d7-46b4-bef6-513cdc5e8c89", "value": 2457600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509612, "uuid": "d74ce0ae-5ef2-45f6-99c2-035b766c5605", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509612, "uuid": "4c44ddad-7c26-4f8d-9622-c996f9799c41", "value": "0d97f2d7941e44cfe2cece9b77aa25a86c4261bcac2de10362d3fca29339efc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7dcf57-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567176, "uuid": "73b0e585-356c-4f12-b9ce-3e2d111e480a", "comment": "Malware payload (Mirai)", "value": "0dd0af21d0567f127fcb0fdf02f42fc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567176, "uuid": "751474ce-36dd-45f2-a139-9ff8d0751b9b", "comment": "Malware payload (Mirai)", "value": "0e5e99a7bf22cccbfaaec404c304c78d52129412d6278b42e2c9360ab1336713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567176, "uuid": "445a352b-4262-43fc-a8c8-c175e2ff0c54", "comment": "Malware payload (Mirai)", "value": "4f8b26f9c407fcd1330bf03f5dc8e4d14b38b4d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567176, "uuid": "854618fb-894e-49fd-ada9-74c8c4799ab5", "comment": "Malware payload (Mirai)", "value": "54fba20a1d6c91fe8a767e39d963ea2b7f595941c4b7ab1a9f8f075020112294eb31270af9f6a7c6643de67a8ae95c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567176, "uuid": "a1311c07-d089-47eb-bc45-453bd9101b3d", "value": "T1579319D7F840FEBDF809D7774593081AB230ABB149835AB63617296AEC361D44837F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567176, "uuid": "1d02e433-8433-42e0-8ce9-c6cdbf385153", "value": "1536:O5KxIwWb1Exo482gvwxE/yK28G4iUvji9+hDeLEofC5Sgaux6VHxgT:OgxIwg1ExwwS/yK28GWjc+ZV5Sgrx6Bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567176, "uuid": "0994b459-7bc9-4434-beba-4bfccb4f999f", "value": 97580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567176, "uuid": "e134b572-09b2-4e66-b8ce-e0661095ad0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567176, "uuid": "1f2ce226-772e-409d-aeef-e912c4722564", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f151970-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767512662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512662, "uuid": "ee0f025a-7be6-4cf6-b53f-e46ed738f39a", "comment": "Malware payload (Mirai)", "value": "762ef22840a768874c52007a44cfb639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512662, "uuid": "1de73e37-5a82-4253-bff6-eeec3f9182bc", "comment": "Malware payload (Mirai)", "value": "0e7afdb665068564e218babb1b6433b677a381f2d89672afdd9f5b7f0dd10018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512662, "uuid": "65031458-a87b-4017-bedb-7b2ebdfbdf7b", "comment": "Malware payload (Mirai)", "value": "c23563ba9d9c0b636753d08a12f320569c3afaa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512662, "uuid": "7d30e1db-7ea4-4d86-a0f5-2e8a9008e8e7", "comment": "Malware payload (Mirai)", "value": "34afc9aea0160524ac7a193447e0c53f362217015c9642a14188f1d786e36a0d8d61e03ed1eba1ee4796cca034c5e88f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512662, "uuid": "8c7593f1-c1b8-4a92-b049-5c58e65f8d27", "value": "T11B7312F0B54E243381F224A5B9A3FE973DDC6EBCF49FB90704A8D429F51284364E5246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512662, "uuid": "71ecff31-9228-4fb4-90f6-9a1693af0dec", "value": "1536:+guWOMb9QllElTTTg4GbhbbvxnhITUewquxIf5ZuHT7je7MKnPBvIEFO/E2pL0:+gGMbKi4hF7tHewquafuH61BfEpL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512662, "uuid": "808e799f-d4fa-48a2-90f7-d3f8db78e4c1", "value": 73656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512662, "uuid": "2fce971c-6468-4b2f-8e25-21516f572b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512662, "uuid": "fe042faa-75bb-417e-9a20-2077b9911717", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4c36b2-e949-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767516093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516093, "uuid": "d1f920c0-4351-4128-ae6f-a4d764b0e2f5", "comment": "Malware payload (CoinMiner)", "value": "016e6dd9224033c986022d1676f21c64", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516093, "uuid": "046c4de0-5d52-41e4-9177-020b1ba58c08", "comment": "Malware payload (CoinMiner)", "value": "0f298edc575a169d06d9f92c672602648e8ce78820588c22019954d5b892d476", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516093, "uuid": "2cb53c6f-4ab2-4d30-8817-7b0af910bf88", "comment": "Malware payload (CoinMiner)", "value": "d9689dedc79bbbbe32b67f6b70bd31e41d342fc6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516093, "uuid": "a5f3044e-6c7e-4f05-a425-2d32188e543b", "comment": "Malware payload (CoinMiner)", "value": "9711a778ce5d8ce562e27a526dad64a3f7aa88d0a43c25fae642911751128fc5f8ab70a3f18ec9660f763f8762194c9e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516093, "uuid": "ad95e162-66e2-49c7-a5dd-9a691bbe7aac", "value": "T1EED2028234E0BD665048C3CC16F046BE194E99E863742B913E3717AF6E71650AFCBE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516093, "uuid": "1c6839ee-32cf-457a-86a6-18a9d030e115", "value": "768:fYfWJHy4aVFHhRVrMd2lZI8UspB0WOpSSYPOWYMek3drsjH5j:3zAleu0FpSSYPOdRIhs75j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516093, "uuid": "a75614e4-b6d4-4786-809d-6dad628d6c0f", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516093, "uuid": "216acf74-9a73-4063-b07a-aa6616a80afa", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516093, "uuid": "8d82cd2f-c7b8-4f0f-8d3f-dd3505fbd768", "value": "0f298edc575a169d06d9f92c672602648e8ce78820588c22019954d5b892d476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f20acb-e99f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767553037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553037, "uuid": "d4d22a75-499b-4c28-9212-3225b7862c1c", "comment": "Malware payload (Mirai)", "value": "ccbc48ac7a8b3a243d37f5a61a4747a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553037, "uuid": "0ba10d36-2626-4b2a-8ebd-0287643d762e", "comment": "Malware payload (Mirai)", "value": "0f51ee7651e6ac578bbf28e5d5d44edd0dc92cad145ede8f772991aa4c377503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553037, "uuid": "67df77b3-907b-4509-8a49-fa8f36043b26", "comment": "Malware payload (Mirai)", "value": "c11a7f55d0c337aec18051c26cb2d8ba8e515556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553037, "uuid": "fc1a5b6f-58e9-40a5-a2a0-a459b7e72a61", "comment": "Malware payload (Mirai)", "value": "6cca46081a6dd4ad81ea386e9a416de81999f11911da508d13fe7e7b0184f6c8fca17effcfc3761fd12775bd56aca4f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553037, "uuid": "012ec2e0-81a2-4fe8-8214-e6cd53ed9941", "value": "T1E7647D8CBB4DEF02C19087BBED6B0623A33934517B8B87637D15212DEDE37989C56186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553037, "uuid": "ac3ea354-c7f2-4556-9cf7-4649b77ea7c8", "value": "6144:YuUodS3yEP/NHPufTsHJCWKLSOoQWkjLohjE0ZNMjyG6:ZqtWXDaQWk3ohhMjN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553037, "uuid": "4e34c121-add5-4213-9f68-6b2b3c5ca962", "value": 310512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553037, "uuid": "545e9e01-e87d-4191-8a6c-5e5fc3744edb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553037, "uuid": "9eb48c17-0534-4b5e-91cf-0699aaba06dc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce848a5b-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511641, "uuid": "c0fbc889-ff98-4034-819a-506d4b330ef5", "comment": "Malware payload (WannaCry)", "value": "7df7d02f32df940c941035e2a8346b8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511641, "uuid": "c74c0c49-6559-4bd6-8c3a-98c53ccf2c57", "comment": "Malware payload (WannaCry)", "value": "11ca820497e0518e06e32645eff0362ef3e89c8720293b329bb28fa7291dbd91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511641, "uuid": "532f5c6b-710e-4e42-b219-ed02538addaf", "comment": "Malware payload (WannaCry)", "value": "d94c5826cdfaca78684ef088be250171c87c9409", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511641, "uuid": "59b48a3a-31be-4deb-bee8-0029addf13c8", "comment": "Malware payload (WannaCry)", "value": "f8b69089b53d4a54010772103f6b821e56324a649aae756f9dc3cbbf9f7ba36f9212d6c0f781f8246a6ecb30ba1b0e31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511641, "uuid": "e05d36f4-3ffb-4a8a-bf32-d0dabbc49d1d", "value": "T10336C01062F82625E7F35EF226768B3447367E52896B921E2668704F0C73F1CDDA2F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511641, "uuid": "a9cbe24b-2623-4c28-aaf0-a6df8f676b12", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511641, "uuid": "e4d83cc5-d75e-4568-bb48-454d953cc073", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P58M:+DqPe1Cxcxk3ZAEUadx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511641, "uuid": "d4bfd14d-a6dc-436c-ae60-a144cb2231d7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511641, "uuid": "f38bc588-4c3e-4d6f-8e89-55d016f4aab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511641, "uuid": "e008ed3a-42ec-4256-b008-8c88b146e4d8", "value": "11ca820497e0518e06e32645eff0362ef3e89c8720293b329bb28fa7291dbd91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542411a6-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509717, "uuid": "dec5db54-9071-4519-9ba4-9abac52aaaac", "comment": "Malware payload (CoinMiner)", "value": "21af12b1eb80d6382d2362b832581e53", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509717, "uuid": "a76f38ef-b128-409e-813e-2e72be1bd535", "comment": "Malware payload (CoinMiner)", "value": "11cb5775d4ad7051a32369f48c596962c7a6015efba1c5a5bda9ee1f346ec216", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509717, "uuid": "a2c09659-a372-4ad5-960e-f3caf36c950c", "comment": "Malware payload (CoinMiner)", "value": "9c34f5848811ba88944046329787cf3947a081b0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509717, "uuid": "8998ee59-5983-4810-9d55-90821e6d15ff", "comment": "Malware payload (CoinMiner)", "value": "792165bdfe886367c4d803ee5c5b8a75cbb6f8f270e9ee07dfaf45362a6970e9540526c28494f15dab55a89fbf081662", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509717, "uuid": "60a6738f-e3f3-4a82-acf4-929546d2fd60", "value": "T120B5335201C3FB3FA09DE9C4A8FC7B351E6650F167281A52785E0C5ABC71FF901AB91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509717, "uuid": "23dada7b-e885-45b1-8fed-0ec2033270f6", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuwv:G3LG658+S8YrCpHy2dUus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509717, "uuid": "49b37a27-a1f2-4fcf-a51a-ffcf53927dce", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509717, "uuid": "eb3c37cf-d8be-4e1c-860d-94089a2676e4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509717, "uuid": "1a0c28dd-cdf3-432c-bafb-aadafc87f65a", "value": "11cb5775d4ad7051a32369f48c596962c7a6015efba1c5a5bda9ee1f346ec216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f994d8fb-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509565, "uuid": "9312f3c0-abc1-4c9d-a5de-374b292f29a0", "comment": "Malware payload (CoinMiner)", "value": "626da3b82eb32cf2f18e7da750e39434", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509565, "uuid": "317d1a9c-052a-46ce-9e24-42b321985058", "comment": "Malware payload (CoinMiner)", "value": "12e814156ef6bbb499dc59aae99b9a175daead52c94bcc22444b0a959dc1e07c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509565, "uuid": "109e88c3-f40e-41fb-a39b-c465a4c40c47", "comment": "Malware payload (CoinMiner)", "value": "4f5b5e8ce7f3880ab2ad054cf88ff1c2667b0fcb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509565, "uuid": "6367960d-055a-424d-99f4-6ffa09895614", "comment": "Malware payload (CoinMiner)", "value": "6162c86d98aff7de3b72a6ec358b1b970120dee8aea8ccf991492ad90f0c5fb8656a4fac3524caf7b15ad2be9f19a0c1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509565, "uuid": "8eab7859-c145-4481-8879-c9f74e4aab86", "value": "T1A9D5331200C3F97F95DAD9D458FC7B310D6B51F0A7681622BE6A0425BC32EF641EBA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509565, "uuid": "6dd8cc4c-d65b-4276-9582-9cd30ae1edeb", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jC:G3LG658+S8YrCpHy2dUu4KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509565, "uuid": "b23cb227-c5e1-4f9e-bd2d-96eb519249d0", "value": 2920448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509565, "uuid": "007930a1-1237-4a8a-a612-287f3283afd4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509565, "uuid": "73d68cec-50b7-4b82-8d34-a52a7f067e04", "value": "12e814156ef6bbb499dc59aae99b9a175daead52c94bcc22444b0a959dc1e07c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129ef361-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767508748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508748, "uuid": "c7d4ec62-9335-416f-88e3-77713efccc19", "comment": "Malware payload (Mirai)", "value": "d5b5379387145df9fd603244043db4a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508748, "uuid": "688a14f2-a2c2-4882-a293-33ff2a7ee44c", "comment": "Malware payload (Mirai)", "value": "12eed24008138b02388e12ba2c9e01244ef66d7a993d2ce8cf906990474dce80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508748, "uuid": "7fd6eca9-741b-4996-97a3-37d3b934e59c", "comment": "Malware payload (Mirai)", "value": "b83510026913c08dee9cf1b485d804de57ea7d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508748, "uuid": "cac692aa-947e-4a24-bdc3-f8462edb521d", "comment": "Malware payload (Mirai)", "value": "7b300427b0a72203856bb18801244bb69313f92d042800ac7ad5612713c6c64ba82008419e794d95a7bdefadcb2146e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508748, "uuid": "ad4f7bf0-6968-47c8-8784-56d7750e6376", "value": "T112936C02B7180E43E1636DB47E3F27C1D3EADD9112F4E648250EBB49D072A326697E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508748, "uuid": "2e395d48-2d55-42f8-9248-77db26db9161", "value": "1536:GszBf5GiNk+bvD7knVnf5s0PSSJBL2AyaRleyHZIq2KouK12:PjGiNlvPkn5f5s06SLRcyRC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508748, "uuid": "974e71c3-486f-49fe-95a7-2548650a20d0", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508748, "uuid": "d3d9fc1d-0fba-4c57-a3a2-bb4e3823018c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508748, "uuid": "3556bc0a-2ec1-480a-880b-fb88923d5fa6", "value": "powerpc.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca700ba-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511745, "uuid": "2b0b6df2-1866-41c9-87c1-0a600db28b6d", "comment": "Malware payload (WannaCry)", "value": "d5837f8f7e4b41c02604dc85f3d0ac46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511745, "uuid": "a83d8f07-37f1-4bc3-9ead-ab0eaada31de", "comment": "Malware payload (WannaCry)", "value": "12faf0ade4c7ccd9fcb17a32258bc386f078134f940f56f584fc48580029ef9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511745, "uuid": "0a15457d-3c4e-4152-8577-594f6054258a", "comment": "Malware payload (WannaCry)", "value": "16e12c3beb4c6dcdc386e86ba35d27717ba083bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511745, "uuid": "185d673a-85df-41d1-a29c-790c2f0890ca", "comment": "Malware payload (WannaCry)", "value": "94aa1099d0203237f1379b2f7d71c81aa99722996818ba36fe085dc5fa9588209d093fca4f0dc666aa51f599119dbcc8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511745, "uuid": "a411edf2-ef8d-4905-a812-07e08b6cd2cf", "value": "T11636339A71BC91FCD205197084B7CE26B2B77C6A21FE5F0F9B4089251C43B5ABB90B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511745, "uuid": "445b7a18-7553-49b0-8b3e-fee2c6a93fcd", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511745, "uuid": "694047c3-d0c3-4a6e-9dcd-ae3e1466132b", "value": "49152:RnnMSPbcBVQej/1INx+TSqTdXP6SAARdhnv:1nPoBhz1axcSU96SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511745, "uuid": "f8c645f7-1853-49ec-9777-4e141b8b4f98", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511745, "uuid": "8e64ab72-003d-4e91-a48a-c42d3cf2bd8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511745, "uuid": "9702cfef-1803-479f-b4de-f3b1025573b0", "value": "12faf0ade4c7ccd9fcb17a32258bc386f078134f940f56f584fc48580029ef9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a750e87a-e9af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767560108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767560108, "uuid": "2e3efd38-5c5b-4019-8607-a085160170c6", "comment": "Malware payload", "value": "709f40889270c68811dbd7dd45b90f37", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767560108, "uuid": "07d717b4-65e1-4d34-b944-b5f99c4ae615", "comment": "Malware payload", "value": "1365b90bae53129fdd75373cf05e212455f9e32cea45e8b178eb7d09f0461cd3", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767560108, "uuid": "9f7f77ff-df62-4c8d-a6d0-4aeca65c82a5", "comment": "Malware payload", "value": "69588507be1d10329982e160a9d32beecea63b0a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767560108, "uuid": "c933b697-df44-470d-9731-fcf33cbeb336", "comment": "Malware payload", "value": "3f3a2e4dd33d4ce3f52c091d0fc62b17f049ec47ff711cb1fdfaf763d4c2dfd811967d1c83f5fb0fffaa682670289549", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767560108, "uuid": "f64bfe58-a7ae-432d-98e5-d7703f5d3804", "value": "T141651256E7E8C023E9BA5B7099F9AAC31A76BCA11830876F6A45955F4833704DC3133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767560108, "uuid": "f879a2aa-627b-4baf-996a-cdc6e59522aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767560108, "uuid": "2d2b6e58-428d-4c02-b6ee-7fa045dd2953", "value": "24576:VuqOcfbNMJ8THLKSrbabRCijLAme7mcPlt/fqMSKhp5c347w/:lSuTHHA8ijLY7m4/fqluk47s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767560108, "uuid": "28dd3b0e-378b-485b-938d-10fd4c4494cf", "value": 1519144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767560108, "uuid": "b705f2fc-abdf-475c-b5be-fc27abecf521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767560108, "uuid": "0a019166-1ac3-4157-94c9-b19af744e498", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948e6d13-e941-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767512832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512832, "uuid": "85d9d0ff-1221-4b07-a53e-e9d13e6b2c77", "comment": "Malware payload", "value": "67c2bd7ed93c63b163b32f7d8bfe3f37", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512832, "uuid": "f5d418ad-ba1a-4307-906d-e68b4ec0a283", "comment": "Malware payload", "value": "137aaacf908cb8fb74c71e5b5fa7afbbf6961b314e388b4b8c8f11c86a1bbe06", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512832, "uuid": "c6e5b831-037e-4e19-87c2-cf08074d4b7b", "comment": "Malware payload", "value": "2fd61e4fadc1ad92380eae28cf15bd8e1627114b", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512832, "uuid": "58ea7a3c-ccdb-4852-b336-45b10d3bb7ae", "comment": "Malware payload", "value": "0592712d1c6ace1c1833ae97440e6462dc3ffb2bd961a0760c2cf3e0cf9a432bc45d608728265f4f219c043f87e268c4", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512832, "uuid": "a2d20aff-0207-4e4a-9a53-318d4fa7b79b", "value": "T182C5BF05B3C816A5C5D7CB34C61BAF36C2B2B416073691EF1E56D34A9EB6BE14F3A600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512832, "uuid": "27fc7ada-d9a9-428a-a7bb-15db5345f0f1", "value": "30c027c0bc23b678b06e85836c1bf1d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512832, "uuid": "31e97c06-3394-47b2-8a08-384de7ad3014", "value": "49152:8X8aRLA12GJ06IMsOBjEOJKIk7lFrlF3JhnoDPtsVEZ:cwJIMsOBjEOJKIk7lFrlF3JhnoDPtsVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512832, "uuid": "775be6e1-3c19-4bd3-9ca5-3c5bba5c7335", "value": 2713600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512832, "uuid": "cce6f56e-c970-458b-823c-806d4d019da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512832, "uuid": "8ae89c61-5392-441d-a571-407c8b646497", "value": "libvlc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ade1831-e98e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767545887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545887, "uuid": "271a92a8-3c88-4032-9861-b61d6cdf8d48", "comment": "Malware payload (AsyncRAT)", "value": "f0ce6a5d7ea6f393e4eb7679b7e06d28", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545887, "uuid": "ba61d9f2-9e2e-4b43-911c-3d1e7bfe2abb", "comment": "Malware payload (AsyncRAT)", "value": "1424940ec6af15c735a6a67737d7c7c5851a905c2e98f06646d6564b9bf55d34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545887, "uuid": "847bb995-95f4-41cf-ab43-1bb26432f453", "comment": "Malware payload (AsyncRAT)", "value": "51c8ef6b21cc3e2181be0c65a88d6b23eb906bac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545887, "uuid": "ddb32525-b3e2-44d7-b84c-21697a5f51d5", "comment": "Malware payload (AsyncRAT)", "value": "8cd18aba3842ec80cc76b08b798e4e062436c36d5e0155825ddde023c7e67c9b617b97f3f0de6c6c5bd015c1db758f6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545887, "uuid": "10e97389-7731-47dc-9b3c-4a6ae1213b77", "value": "T130233B0037ED812BF1BE4B7869F26145867AF6732603D64A1CC451CB5B13FC68A43AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545887, "uuid": "0ac36574-6387-4ac6-ac61-3d977a0c5e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545887, "uuid": "bab61c3c-911a-40da-a089-c6dbd9ac81b6", "value": "768:ouMvdTHfEmGKWUc6vQmo2qs4LiE0yFjrdjYkk8PIuWjb1gX3ir59yQO1DCGfJQgd:ouMvdTHfhy2ILBXQBuabSXSrpGRtdMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545887, "uuid": "4121e522-2070-4d4e-b3d6-7d90c93cde15", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545887, "uuid": "42bfdd86-af60-4892-8f88-3006d79ef7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545887, "uuid": "225f68c3-f971-40d7-99ab-b0611b096f3d", "value": "AF88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1660ff1-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767509954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509954, "uuid": "5710f8e5-a9ae-47a8-ae3d-41067b915fe5", "comment": "Malware payload (Mirai)", "value": "412addf4c974ec7cb0eeff939e7e60a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509954, "uuid": "3755032f-d71f-46dd-8212-1c8d41fb9ce3", "comment": "Malware payload (Mirai)", "value": "151c63cf003caa0135619d35215c3763b2f450b62b9b605f5aec54a4b775a345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509954, "uuid": "e9692b42-e63d-4567-94e4-d916ad9fa8e2", "comment": "Malware payload (Mirai)", "value": "45786fcc55e2782998747b224d1c10a8e4e82c65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509954, "uuid": "9ca7e68c-cdba-4e13-8b47-14216f4d04d2", "comment": "Malware payload (Mirai)", "value": "9eb154ded29c1f3fc872ae5558d386950ea3fc9eeb0ba61822b5caefded4400d9870ab1f34dda78042a468c2b2ba606c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509954, "uuid": "7236d884-cd5b-4a15-b5aa-38508c91fe62", "value": "T10E7302BE060488DECE906AF782BA4F561F510DB510838D40F6A6E6B21BC71742DD7EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509954, "uuid": "3234424f-536b-4046-85f6-03994cd170df", "value": "1536:z0B3b87urwemjU1Fh+V3z6HdTSPzy4JTJeSesSg0uq+EStWxwyVJuX:zwweV+VGHdTyf3esTq+E0G7VQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509954, "uuid": "8d4a5a8d-551a-42dd-b082-50bae9589ba3", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509954, "uuid": "2310b27e-0fec-486f-8645-728021be3012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509954, "uuid": "dfe47631-f699-4920-adba-0eb8f3fbf58a", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74afb5b-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509937, "uuid": "cdf5f1b7-a3af-4f61-979e-a8e6b3b04f75", "comment": "Malware payload (CoinMiner)", "value": "a1dee6046f8e2507052e6aee8956df66", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509937, "uuid": "2c53e397-e63a-4683-9625-21ad21ff95c4", "comment": "Malware payload (CoinMiner)", "value": "162f33041205b635b2406adc74723806cd550f19f243856bb6e3d4197e75c69a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509937, "uuid": "47ba0582-4ad6-410d-b96c-1cc8434c1be9", "comment": "Malware payload (CoinMiner)", "value": "524466de16d631e7a313df7eb270a3b0d69ef71e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509937, "uuid": "bc477a1f-7242-4c97-a823-99ae1f7f07d1", "comment": "Malware payload (CoinMiner)", "value": "10c36ee120b9b849cf7dcdff53a7c59f058250efe811c333dd4193fc284e83f0f5fbbff4f23c06e5b3256fb1dd2003c1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509937, "uuid": "8b22a2d2-1b71-46c5-a25c-e8237141cdd3", "value": "T10F7533E101C3F6BE56D89BC415E837350D6155E05A3A5B5AF80F0C6BFC61FE806ABD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509937, "uuid": "6689218f-6a6a-4b6c-82eb-bd4d1240e5ab", "value": "24576:G3LWjlhQ4nr0vJbDFF4xjPQ86X8ut9QF+8DfiHJqZp8C18zp0iZy0TTvUTosc:G3LolhQAr0hNW188rJTQ+p8CU0r0/Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509937, "uuid": "82128ccd-1491-4d23-9ace-2a81bc563ea1", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509937, "uuid": "393c5368-0f89-4bf0-8181-8ce88392dfa5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509937, "uuid": "6bc37524-0306-4f36-a9ee-282a68b5535e", "value": "162f33041205b635b2406adc74723806cd550f19f243856bb6e3d4197e75c69a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8796fa1-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "31b13d68-0985-4656-92b5-1244bde0d24c", "comment": "Malware payload (WannaCry)", "value": "0a453c74a3629d81cfcc10e77c7b3539", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "9b6fe1c6-f706-4f6d-9393-a23979e0acf7", "comment": "Malware payload (WannaCry)", "value": "1933a6ce867e1084daa57778ad534e85f11870f6d18c6d714a33ef37cfacaf2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "109540a0-d903-4c2e-af9b-c2294359c020", "comment": "Malware payload (WannaCry)", "value": "42898765c973687d0879df11d53de7b1e9b70e6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512060, "uuid": "6e58f535-ca7b-405d-958e-ad3c4af2c03c", "comment": "Malware payload (WannaCry)", "value": "aef8eada4d76e155d9ceb87c6dabac81757485f581218b543ccb6beb41a0976383fd859058161d6a9e4a5a1cdad39189", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "f7c863c2-2fdf-4b83-9537-ac30583a6a6d", "value": "T15536D01A3B9CC0BDC0654231A4634A35EBB7BC5A5278D60F5B98CB650E63390BBB5F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "f008c41a-ff48-40d5-92ea-cfaba004520b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "7cf370a1-9efe-4656-988a-4f8d63589f55", "value": "6144:jE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qb:jvbLgPlu+QhMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512060, "uuid": "62820f79-b0c3-4b9c-b8ea-9ecbd45b0ca9", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512060, "uuid": "83921634-3c6c-4233-a5f0-83dd8d37c492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512060, "uuid": "b5e31738-9768-4242-ae8c-c396a29839ed", "value": "1933a6ce867e1084daa57778ad534e85f11870f6d18c6d714a33ef37cfacaf2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2949d5-e933-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767506729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506729, "uuid": "e9b5facb-e009-42f5-b8de-f3488ce97d31", "comment": "Malware payload (Mirai)", "value": "761d248c78519a539742e5d8453d536b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506729, "uuid": "0d7a77d0-0ff4-4038-9e37-aaea38a45b0d", "comment": "Malware payload (Mirai)", "value": "1a236d5084671562e6560287e3bf5fd7660c2a06d017e29e4b9144117fb600d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506729, "uuid": "c2ef4bf9-b064-4287-9bc1-0280e7a99715", "comment": "Malware payload (Mirai)", "value": "85543ccf6b672c6dcd9c73dfa8a55a3eb789b092", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506729, "uuid": "3e571697-94a6-4e29-8dbf-2b9685c9bbeb", "comment": "Malware payload (Mirai)", "value": "61232cb435bfe13e9e30e7f21a1667fb119c3e409e4371614d0cdc0a218634b740ce5d9002b12253bccb27e2eddca972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506729, "uuid": "87bff64f-875e-4240-8e18-01875c8e3895", "value": "T159E48D98FD4E3D46D2C7E33C9F4A97A1212BB5E4D32382B27981125CD4DAEEDCAE1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506729, "uuid": "e3241c1d-fd9c-41c1-b8d1-f35731b5c9f0", "value": "12288:RyrC1FSU8e5tAEameudvSHfn/hC+yS0oIs5W1LFRy5:RyrC1FVgEfdvSH/ZCxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767506729, "uuid": "95d0e88d-18ed-4221-8bd6-a0d823133f91", "value": 719264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767506729, "uuid": "5392e1e4-ce66-4867-89df-05a3b39d10ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506729, "uuid": "92d0216b-104a-48e4-927c-bda7cbbcba46", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd374ce-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511933, "uuid": "ffc9e1dd-e820-40a0-b9f3-e2406bf0aacb", "comment": "Malware payload (WannaCry)", "value": "8d340ce819b42f0c5a27753dd7170ff9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511933, "uuid": "8ebe7e71-ac53-466c-ad26-87e542a09d45", "comment": "Malware payload (WannaCry)", "value": "1a56abbe1e353687a049b998b555237aa0ca8d1ada3a411f8d6357b8a6cb509f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511933, "uuid": "57db15cc-aa76-4366-a04f-2408d70dcc35", "comment": "Malware payload (WannaCry)", "value": "cbe85644608a3f2142eca72282f31cba8bcfe4a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511933, "uuid": "f90a0934-0202-4912-993a-b5e016043bb4", "comment": "Malware payload (WannaCry)", "value": "112987222a8dd52b341d4c897d1956f15e6a737b0d226a51e956b1dda8d6a934a4ce6be32984023c95a4d9ea03eda931", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511933, "uuid": "49b1a368-bd22-493a-bfea-65545eacae82", "value": "T14536339971BC91FCD20529B444A7CA23B2B23C6E26FE6E0F9B4049761C53F56F790B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511933, "uuid": "d567ab67-dd26-4a19-a9c4-b6591ed9c78d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511933, "uuid": "bad9666c-bfd6-477f-9c2c-3eb8501ce91a", "value": "49152:RnHqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1HqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511933, "uuid": "eda077df-d8d9-4037-9525-bed6036a5323", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511933, "uuid": "c560bac1-f691-4809-a2ad-dfda57aba0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511933, "uuid": "999fee94-bb0b-4b4d-ab59-9bbc826d6422", "value": "1a56abbe1e353687a049b998b555237aa0ca8d1ada3a411f8d6357b8a6cb509f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df24fc6-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509787, "uuid": "89b0e434-e87b-4f5e-bd76-c0f1d3503c31", "comment": "Malware payload (CoinMiner)", "value": "879a58af88b6fcf5f308921c7a45ad35", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509787, "uuid": "9247ca77-c71b-48ad-a0f7-8502689aa32c", "comment": "Malware payload (CoinMiner)", "value": "1a84d492f225a4e97cfe63df37eac68d500f17e4d8098159cfb706d58f3207ca", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509787, "uuid": "ab57e52e-9e00-4e6b-a5df-8c46c5b3c177", "comment": "Malware payload (CoinMiner)", "value": "e4f8965dd313acce1bd1f6c4427ae5f531308c9d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509787, "uuid": "d13b65f1-2ffd-442c-bfe5-15741bcb4a77", "comment": "Malware payload (CoinMiner)", "value": "cd32e67c1b3bdbda01543a3360f839f478a9b9d935444c8b67fe3ec9a9aadfcac0972992b2f49abdaa72c597f506e6cd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509787, "uuid": "d21e0c35-27c4-4823-8063-66bd44393fdb", "value": "T149A5335101C3FB3F919EDAC4A4F8BB310E6555F02B291A52B85E0D5BBC72FE901B781A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509787, "uuid": "4c5d0d24-57b8-4c05-831b-b6afda9a8678", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1N:G3LG658+S8YrCpHy2dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509787, "uuid": "9925ef3f-3913-4876-b597-a5371bb465f9", "value": 2174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509787, "uuid": "1389a583-d6f0-4c16-8627-2b6daf711930", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509787, "uuid": "13fa0e3b-c12c-4a7b-8e0a-22674ded3771", "value": "1a84d492f225a4e97cfe63df37eac68d500f17e4d8098159cfb706d58f3207ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d863ad8f-e98c-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1767545158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545158, "uuid": "66b15e88-263c-4b0e-a995-763ce05c14eb", "comment": "Malware payload (ScarfaceStealer)", "value": "1db7096b549e55a42713fc0185756b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545158, "uuid": "600c91a8-c7d9-4dea-998e-a83e752218d8", "comment": "Malware payload (ScarfaceStealer)", "value": "1b9bd85e37381900782f18d0c0f4b3a7db62aeee3e6501a973e5f8305ea060a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545158, "uuid": "ccf8a8b3-e5a6-4478-9bbe-cbe304e8e8e7", "comment": "Malware payload (ScarfaceStealer)", "value": "6cb873faeb08673c49074150fc31c4e6d0a0bcf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545158, "uuid": "baa2311f-0b52-4c23-a04c-77433fececae", "comment": "Malware payload (ScarfaceStealer)", "value": "d7363610ccffe173d4de261376075f0df34d6ac02b0ac5765cacaead85155b6b5bb50cb438f10e7366a8ad4a0e9be673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545158, "uuid": "dc1304a0-2182-40e5-b3c7-cdde279d6743", "value": "T1800723C67EE6C36CC093563029C65389B5D4729E90FFCA6F36CA9C067550D264CCA8BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545158, "uuid": "293159b0-b41e-445a-a60b-a0122d9f6228", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545158, "uuid": "48adb322-517c-4b41-b838-1a66edd155e9", "value": "393216:+iBPL1IWydhCjcGaNNiWshoTSkRmWGpm0dW:71G1Gaudby4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545158, "uuid": "e88ff1ba-949f-45c8-acd0-81c457f90561", "value": 17163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545158, "uuid": "7db7611f-cb6a-4a3e-96cf-0e44fd0f8263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545158, "uuid": "0313aaf1-8792-46f7-841c-82a7d304f6ec", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c888cb40-e90b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767489726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767489726, "uuid": "01f660e7-4715-4739-a44d-de10b2e66ad8", "comment": "Malware payload (Mirai)", "value": "24a490dbeb9ba40200f42b3f15665370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767489726, "uuid": "79b77acd-4430-45a1-aac3-ba3d728e8935", "comment": "Malware payload (Mirai)", "value": "1bc4dc66711c1edf331432d54b3a39f182656dd719e5731d786b902fcc916eab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767489726, "uuid": "e8275763-c0ba-4f54-b843-b3d19e7f5aa5", "comment": "Malware payload (Mirai)", "value": "a1dd19414923464d593bb4845a64a0629e00204c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767489726, "uuid": "8c6bd03b-d29e-4cd9-9e8e-37b934eace10", "comment": "Malware payload (Mirai)", "value": "125a122a984209e027c3884f4c02d2d3a2b08971fcc680053e1d1356d83958edd2d06f783d0615438c552f74a0c3122d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767489726, "uuid": "d5585d5a-5960-4fd1-bf41-c9e02d0b000d", "value": "T1DE335A4AEB83D4B1FA5205702427AF12C332E625641FEADBD3D47C71DC62A15AB173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767489726, "uuid": "c36a3973-6e78-4788-95a6-178fee713773", "value": "768:0gOJaFpDS2T/qDy3ZLpIchpt9nbQD32WI6laVO8DWZ1HTVMUuxm1u0F6jIK:0rFJwLpFhVI32r6QVJ61HqUukHkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767489726, "uuid": "6fb73c75-ca73-47ef-b9e9-3ae4d1bf458d", "value": 54412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767489726, "uuid": "fbd70ac1-d6cb-4383-9a9c-bec0f706e74e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767489726, "uuid": "e594eaf5-0584-478b-baad-5776fab23f4f", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ac7dbd-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511601, "uuid": "f9806654-87a3-4302-a9a1-55dbfe41b1e3", "comment": "Malware payload (WannaCry)", "value": "82ddd26ce164bdc0c2df7cdd9236d850", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511601, "uuid": "75c06d1e-fe20-48c5-ae2e-1256178fc1c8", "comment": "Malware payload (WannaCry)", "value": "1bd5bf71cec5756b0dadc09f743502b463d765648439591cf701481adb6e5af4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511601, "uuid": "b4652514-1f56-4958-9063-e012f5bbda1f", "comment": "Malware payload (WannaCry)", "value": "02339f2a9eeebed86f1fcaea18a4e7b71a24be83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511601, "uuid": "b2c50431-c75d-4957-9b26-2676bdf0c3ca", "comment": "Malware payload (WannaCry)", "value": "f884ae67829074f3a6c8aa059bc549c631f723cf9179d9924f43b74602f0df14d22b99091ea491e56e5451b404a77d19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511601, "uuid": "1432f86c-cd77-4892-bb96-6a76f7a86c4d", "value": "T1EE363359717CD6FCD105197400ABC967A7B33C6A26FE6A0F8F408A661C13B59FBA0B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511601, "uuid": "3ff92e7f-c831-4d1d-9a09-d8d440018723", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511601, "uuid": "3a11da6a-5895-4db6-9ece-6b4f61e984cc", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:+DqPoBhr1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511601, "uuid": "3d3b08a6-878f-427d-a3a0-253e2ed636b3", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511601, "uuid": "afb8b961-659e-49a5-a6bb-749172141ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511601, "uuid": "b5a9fc8f-6171-41df-b9c0-43eabdee63e0", "value": "1bd5bf71cec5756b0dadc09f743502b463d765648439591cf701481adb6e5af4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bb07fd-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767508990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508990, "uuid": "bca07987-d488-4e0e-ac77-b85b9eea5698", "comment": "Malware payload (CoinMiner)", "value": "915920fc8d3d38d677e494878e76d6a7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508990, "uuid": "f1194828-785d-4651-a824-59811d0b68b9", "comment": "Malware payload (CoinMiner)", "value": "1c092539288ebd94c578bcc4b466d77e06d624fd2ca0dcdb13475574ca8b1423", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508990, "uuid": "ac9e84d5-616c-4fca-b8e5-5e3d4be48510", "comment": "Malware payload (CoinMiner)", "value": "dc205746895ac46f377441356739acbcf0099e27", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508990, "uuid": "5149e79e-b93c-4afe-8269-ff45ac2868f4", "comment": "Malware payload (CoinMiner)", "value": "fce84cfcd2f8259910212d665d8d8e8e33fddc67006c6a011a87957821164c6aed0476b583262930d34da06ad710d2f8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508990, "uuid": "fdd9c04a-7908-4b55-85c7-61e6c6718967", "value": "T19D26333511CBBDBE7589C964ADF4E7314EA925E29D684105FC390828BCA1EE3407B73B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508990, "uuid": "9a5ee39a-4d1f-456e-9bf9-94c7ff76b554", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhx:CC65sr3KrCfsYiZQgzJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508990, "uuid": "1446760d-05b4-4976-b62c-311ea914bdba", "value": 4427776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508990, "uuid": "bf3c307e-bed5-4d13-a128-32c17619d19e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508990, "uuid": "008e32ba-c803-4a2f-b12c-d544a7fe3e66", "value": "1c092539288ebd94c578bcc4b466d77e06d624fd2ca0dcdb13475574ca8b1423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c5d194-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555131, "uuid": "4ad27431-99b6-4499-beb9-eda6e7b5b98c", "comment": "Malware payload (Mirai)", "value": "fbd95d6fbecff9b0a616bc197fc0197f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555131, "uuid": "6b87f956-0ab3-4363-83ef-0c11c2413359", "comment": "Malware payload (Mirai)", "value": "1c9b1a4fe6eccfc41f32f27e801701c503fcbb9fdba0d4f3c11f92fc65d08dd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555131, "uuid": "21ea71ea-860e-434f-9456-e0cf9213bba8", "comment": "Malware payload (Mirai)", "value": "04744aad87d0f429884b58f3b9b2d9f17df6f509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555131, "uuid": "03a4dea6-0b2f-433a-ae11-1652e4371900", "comment": "Malware payload (Mirai)", "value": "057822e56173e589a9a43c4b9eb1d9a6e1f2679c22bc8884afeb2570f9eac24de66f6bd649676c3af1323af3695eaa06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555131, "uuid": "bbef1bd9-16d8-4d4d-9449-a7978ef03bd7", "value": "T15EC3122977B8FED2E451A8F290A25EA3C5FC40CE84791E80DE05F9A3377D6178388275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555131, "uuid": "8c534f8c-6d8a-47fa-93a8-c05bc850795c", "value": "3072:qqg3p8HDYz/g+bna2i7iPdU0GDne7fWkfVEhJxccZMd/pAosq:qqXHDv2i7L0EvgEh/boxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555131, "uuid": "c7693572-70d8-407f-a786-b515b85c4419", "value": 124188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555131, "uuid": "e4c48d82-d4c5-4264-b666-0a083111e767", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555131, "uuid": "524bc843-5eea-4a24-83ba-9b3d63d04f56", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67ca369-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512486, "uuid": "8e17812f-a0de-472c-91fd-c08647d82c3f", "comment": "Malware payload (WannaCry)", "value": "62186bebffffcfafb1c70a8ff03fa317", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512486, "uuid": "b34b0ff1-d845-4e3c-a84b-87a9bac5985e", "comment": "Malware payload (WannaCry)", "value": "1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512486, "uuid": "a4d7e602-12a7-45fb-ae4c-c7424d194828", "comment": "Malware payload (WannaCry)", "value": "6fc4434a5fc48ef8c1792f8d7ca49cba14556378", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512486, "uuid": "8466d075-5937-429f-b146-e9afedbba864", "comment": "Malware payload (WannaCry)", "value": "154c87635da66e2438ded8b525b2afcc48ce594ad70eaf36abc59a0374d488c374572f893e69b34f771bf3f8e42bc627", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512486, "uuid": "3e8c8244-7331-47ff-a9b6-56cd91c06689", "value": "T125363359717CD6FCC10A25B514B78963A7B33C5A62FE6A0F8F4089A61D13B19FF90B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512486, "uuid": "4c5b2466-a46c-4b9e-a033-0cdae700cbc0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512486, "uuid": "50d7924b-7b94-4761-9e2d-f493abbaf500", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARd:d8qPoBhz1aRxcSUDk36SAEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512486, "uuid": "e3021fe4-704a-42da-a558-701b9d589cba", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512486, "uuid": "8ac3a35f-b2c8-4a3d-82cc-4d5ecf5cdfdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512486, "uuid": "effdfaad-4f80-4f4c-8ec1-74d370231460", "value": "1dd001ef5ae3fdc07d44feae5246b23f199e01ce4f7e2b7dd5a354f7aea227fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f45d7a2-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509682, "uuid": "8756b562-b615-4aa1-8053-8ba2567bc7a3", "comment": "Malware payload (CoinMiner)", "value": "1080bb7d91852d3d1ecbc8b74a455faf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509682, "uuid": "6dd414ce-29f6-4993-abd8-7bbd1b37ff10", "comment": "Malware payload (CoinMiner)", "value": "1dee3970d5a9891fe54ef0f90a1e275393de1672e8542e7a272601930b1b6d32", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509682, "uuid": "a7d48573-9d5d-41b8-b283-3b0c51cbcecc", "comment": "Malware payload (CoinMiner)", "value": "4717eacc0fecc6276e1b8cea0b441ba43e382cda", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509682, "uuid": "ce763a51-7bf2-4132-9d75-936279f08356", "comment": "Malware payload (CoinMiner)", "value": "370bb007bb94f4578dfb3062d94166c42a7f8e3dcc41f81d30ad9c74a367f373a608f8a726cd7f3ed5b740c462011265", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509682, "uuid": "83e78e80-8e1c-41bd-b698-4f2d828e4622", "value": "T1D1B5335202C3FB7FA09DE9C4A8FC7B311E6654F067281A52785E085ABC71FF901A791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509682, "uuid": "b4805758-2440-4789-ad1d-3810db4142f7", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3i:G3LG658+S8YrCpHy2dUux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509682, "uuid": "056e8f4f-b530-49f9-ab87-203402f03489", "value": 2285568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509682, "uuid": "9937eeab-9454-494c-9701-9b196ff4ef55", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509682, "uuid": "8ac5a632-4ead-49f2-bf80-2ebbeaa5a8b9", "value": "1dee3970d5a9891fe54ef0f90a1e275393de1672e8542e7a272601930b1b6d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9e8d8f-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555067, "uuid": "116e0eb7-0f23-41b2-a7ca-8b0eb248c269", "comment": "Malware payload (Mirai)", "value": "a3078b00d7d13ba7ebdf8c86faef0b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555067, "uuid": "cf21ad6c-86ed-4269-bdd6-bf10d7f0fcc5", "comment": "Malware payload (Mirai)", "value": "1e83746c01189fb3804fb357862af9d52329a7260900455d16c62f9d22f6fea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555067, "uuid": "fa0b7ceb-80cf-4fce-a111-6317fce400f3", "comment": "Malware payload (Mirai)", "value": "9678f54447a7112802e519277dcd715390f39984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555067, "uuid": "599a87bf-fabe-425e-8a7a-c7980c409ae5", "comment": "Malware payload (Mirai)", "value": "4fbf5220c1432b62c05ac1b233f361ff01bc14b42f7b9a42b68d0cebe5cd00b6d5964173b172a0d9f59f99b6059e94bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555067, "uuid": "b163e43a-b0cf-49ac-96fd-b44ac0291b61", "value": "T13F042B86A643DEF2E80301F021B7AB314A72F83F143BD685E7B5BDA19D456C1911A3BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555067, "uuid": "629c318e-681a-43e9-b876-148532c1ae25", "value": "3072:XgdNO/9zKA/gDTKyLPHkagE25SL9oXjsnKfaV7G1BMWV3dTR3SVK3wr2F2E15D:AO1OA4DTh7HkzEXL9+IrsMykK7L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555067, "uuid": "0b228bc0-d996-427f-83d5-c0ef2ce409da", "value": 180344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555067, "uuid": "1ba67ad2-e28e-4704-ba4b-586a0580521b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555067, "uuid": "3dd4020b-a069-476e-9ad6-21e99076d3e9", "value": ".x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787ad22f-e9a0-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1767553587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553587, "uuid": "e01dd4f3-f788-4fc6-b333-1703be2de158", "comment": "Malware payload (OffLoader)", "value": "6b18bc2388eb1162da48c366fc90bedc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553587, "uuid": "290df646-0816-495b-a8b2-d390aa335813", "comment": "Malware payload (OffLoader)", "value": "1f0f46dc270ea7e929b2ae662a8480f5766df7e17ff76816bba7a07865b2806d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553587, "uuid": "d27be160-1a70-4999-8c00-985ad0856802", "comment": "Malware payload (OffLoader)", "value": "c759351e55b66f8f1c2f5c7ce5ce975dd05d4561", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553587, "uuid": "66bc4153-8bf3-4266-8e97-113605de6b4b", "comment": "Malware payload (OffLoader)", "value": "65829a08d9cbba017bc8295c7844ffc3f76497e2654278852de54c04eb533c39892459e38fceaf688d023e691f7d8beb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553587, "uuid": "2be16f03-c918-4bbc-89fa-605162383949", "value": "T1F0361227B24A673EE0AA5B3749F2D2105D3B7A61A51F8C1696F41C4CDF2E0602E7F247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553587, "uuid": "2814889e-aefb-4712-abcb-f8c0b39ef240", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553587, "uuid": "49c9e8f9-197f-48be-bca2-bf022efb50c7", "value": "98304:HN66h+qY9CLppI6cmLB6/EGv+e+6QX0/RSLOEAN3v5Ilb:/ZgCLrI6cmLw/Rv+e+6dZ1PN3ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553587, "uuid": "acefb675-a9c9-4d5e-9d7e-0b987e474a30", "value": 4944303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553587, "uuid": "148a7352-8969-470c-9781-b0f4367ca1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553587, "uuid": "d2efefb0-305c-46bd-ad09-7081370f7b62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faa0d1a-e90d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767490329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490329, "uuid": "b9ab3eae-747a-4b89-a1f7-22d4cb26d2a5", "comment": "Malware payload", "value": "37cdd3fa929672fab5bc585caac81520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490329, "uuid": "cb4bf124-4ad6-4bd3-b857-548cac14d846", "comment": "Malware payload", "value": "1f16aafa8a5cffd79c1cfef1b0fbd52161913e37e85eb3ff482ac0bafedbe6bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490329, "uuid": "2748d1a7-41dd-4c5b-b691-fcaae1ab873e", "comment": "Malware payload", "value": "d4b140595d3c8b88106cb68ddc5fec1c84318f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490329, "uuid": "eca6a629-3537-4f4c-8786-9f806a84de38", "comment": "Malware payload", "value": "84d6dee589fc22dbc9c18c221e3e8a0d7eef49f794f86e3f805bad0e6389404ccd33af874c5d089a0d1589d714313428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767490329, "uuid": "9c800a4c-4fd8-4acc-8819-b0563bd1b97b", "value": "T1A0B34B42F683C171D5A982F930765B3A4A32E87242558C42D7F9BA75FAB5C03EB4632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767490329, "uuid": "256ebe82-f2a0-4a49-86de-ae55472f4609", "value": "1536:48/DQo+wTRi1wQK4eu2lvfBMoiW8O0UlK283Dks3KYr8UIuyY4j:h+wTg1wQKcSZMo2wKPTkcQUIw4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767490329, "uuid": "7bef7a94-84f0-4069-a097-a8adfee350aa", "value": 111372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767490329, "uuid": "60b7948b-7355-4921-84a9-3cdc99bdab17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767490329, "uuid": "cc3981c3-fd15-43b6-a3de-5ea0ff5bc6ca", "value": "rondo.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0205b27-e9b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767561841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561841, "uuid": "7f12480f-7962-4c3d-8e09-acdcdbff2bbd", "comment": "Malware payload", "value": "7930a3cb82cab99c3a7de6f533c434ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561841, "uuid": "93c80f6d-6a07-47f0-996b-9c2a377c8328", "comment": "Malware payload", "value": "1f654bc92ecdec7ccbea91251c03fdbb59b382b8d677fe56684e95be9ecd3fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561841, "uuid": "51736e4a-9135-4786-8e25-42eb9a671eab", "comment": "Malware payload", "value": "df2cfd871066d19dcf3669eeaf7cecfb158f3ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561841, "uuid": "8dcdcfcd-bddd-451d-a082-f689e161bdb7", "comment": "Malware payload", "value": "1bd57e363a1190a200da0d8d0d1faeee220a931104442bc9e860c032f10976d334b24540c37d60496017abe22fce8d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561841, "uuid": "56055def-2e68-4868-8fc5-22b195e0faab", "value": "T102763953AE858224C5ABD17DEE75A256B230B444033113C3AFA74BB24DD7BC4573EB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561841, "uuid": "42079dcf-c4ec-4929-ade1-a816f13ed57d", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561841, "uuid": "1d2771cf-be58-4903-9181-2e48bee9be37", "value": "49152:ijbsLFrb/TBvO90dL3BmAFd4A64nsfJvt3ppv9bXRUnsZrcUTlaHENkpUNmKeBFL:ijRqoGtvl7vzi6zkDYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561841, "uuid": "2905d049-1fdc-431c-9f7f-723695d3b403", "value": 7550592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561841, "uuid": "d67e6e68-db82-4fea-879c-fb81e2869d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561841, "uuid": "89f7f05d-6a9b-430b-92a5-2f303b26e02f", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717aa8c8-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511055, "uuid": "d64aacd6-c7bd-4914-90e5-0fd66b365552", "comment": "Malware payload (WannaCry)", "value": "761f81925b4d559b5f5562bbbd1a82ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511055, "uuid": "a2efc2b3-2427-4de5-95b7-5eea59163980", "comment": "Malware payload (WannaCry)", "value": "1fb1b346d56ed3d31ad48b5883aa7d80c4b93bc0102686cf56d976be412fe53f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511055, "uuid": "53732133-cd2e-44c4-b198-67609fa4858f", "comment": "Malware payload (WannaCry)", "value": "548fddf476dcc8e5e454c3aefc93b971d5fbcae9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511055, "uuid": "0640af26-86aa-4837-969b-2e4fa837c22d", "comment": "Malware payload (WannaCry)", "value": "24d22e5fbde38266bf44e299e791aa55eb361dc11095b7f0a88c14f73b78bf7bf06122f8820b4ec110e673027582b70e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511055, "uuid": "336df0dc-fcf9-4276-8378-315cac1f916f", "value": "T12436128D6B94966CE2050230289347A576B5E4BC13BADF873FE8F2642FD23D36E95740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511055, "uuid": "4936ca46-e71e-477d-92a8-523e47d480de", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511055, "uuid": "e3cda4a1-137c-47d8-85df-49e9e39fe433", "value": "49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQ7ZCEau3R8yAH1plAH:TDqPoBhz1aRxcSUDk63R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511055, "uuid": "4be9036d-52c1-4782-934c-2ca5880283ed", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511055, "uuid": "332894fa-94ac-44ab-9b99-eedfe3a31e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511055, "uuid": "55751e2b-6cd8-403d-8140-b6e09087760d", "value": "1fb1b346d56ed3d31ad48b5883aa7d80c4b93bc0102686cf56d976be412fe53f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eee5f8f-e9bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767565221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767565221, "uuid": "64f271de-b961-4d55-b110-1a30e684107d", "comment": "Malware payload", "value": "b0db2be0b9a71cc153c5bef9116554d6", "object_relation": "md5", "Tag": [ { "name": "eiserone-com", "colour": "#4FA6B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767565221, "uuid": "f793ff83-7761-43c8-9646-a663a86fa0a4", "comment": "Malware payload", "value": "1fd37983486d85c64fd378ff0ae7357bb6b854a41e09eb3981608fe15903458c", "object_relation": "sha256", "Tag": [ { "name": "eiserone-com", "colour": "#4FA6B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767565221, "uuid": "68ada4b7-d932-4219-86dd-e300055fb20f", "comment": "Malware payload", "value": "7f556c4ffa7e8939cb731a6a0508cb41bb1af483", "object_relation": "sha1", "Tag": [ { "name": "eiserone-com", "colour": "#4FA6B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767565221, "uuid": "e7c575c7-1944-4b86-95e0-cc7550588f24", "comment": "Malware payload", "value": "25c8418da14420576e902085d3fae779d08fd62455aefd0e6c51041447e132f10159e35761d4d9cf68f9501c74636360", "object_relation": "sha3-384", "Tag": [ { "name": "eiserone-com", "colour": "#4FA6B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767565221, "uuid": "0cb20414-4127-414c-aafd-333055b59d24", "value": "T138F533F8D0F297E96163ED0405E4AF71D3A5B546CEFB0D6FC93090B269A2A16C79813C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767565221, "uuid": "0afa235f-f9c9-453e-9b2a-36312b42c4c9", "value": "98304:JT1eJpMcXtPTJnm/08tgoAIGaPFo2+wj766SChQGk/4VcQM0S:JBeJpMSjnEtg9ILX+0j9V7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767565221, "uuid": "827db028-9eb6-420a-a93a-c03a7e724918", "value": 3634371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767565221, "uuid": "88cbd113-c5c4-45f2-9fa6-cf59457ed22d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767565221, "uuid": "35687993-1a09-4801-8bc0-cbacf0ad3e7b", "value": "ppruystgksmc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80be85ba-e9b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767563479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563479, "uuid": "da4ebb3f-0cb7-43f5-86b1-35ce1fad35ae", "comment": "Malware payload", "value": "85a37da9eee887c78a190e782cab3a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563479, "uuid": "2276b849-4132-477c-9f39-7c2067da8107", "comment": "Malware payload", "value": "204edb6596915f23e5f2fd3d15a6e9450dabeb70c2bb9a0e3220bc779b15ff11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563479, "uuid": "70092a41-0433-44d5-a9b8-3a78606ca247", "comment": "Malware payload", "value": "22c8931bd5dc06fe6806be25f9244d5f02e7252a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563479, "uuid": "42e606c0-7cf3-483c-a728-c865e5456a87", "comment": "Malware payload", "value": "25b2df81ca68210060387564f92873c2e2cf2e73eaf3e5e925b6d43e987decfa5226a08196d3719dcc762e037eaf5343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563479, "uuid": "981a4068-51e7-4d35-ae21-3f62aa1aa5f4", "value": "T16D086C4262EB04C4F9F7DA759AE66617C673BC122F3095CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563479, "uuid": "01d060e7-9456-4b5c-ba8f-e448b4edd8af", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563479, "uuid": "24e87f0f-763b-4d71-95d0-e5fb04f4c4a0", "value": "393216:uy84WHCQTas4MEMMurULlv9iaVZhLqJvHoNYusIyNOnS0B4AycWMCY+m3TIuMHPO:uUcTyuSsJYqlA4oe5rs3wb31CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767563479, "uuid": "912a3632-43b2-44fd-bdb6-32bc1cc9edfa", "value": 81911472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767563479, "uuid": "895653f4-5881-44ec-b6fc-16722e747290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563479, "uuid": "eeb98788-5fb7-448b-bd61-a3ca5b0d3be8", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bc0895-e9a7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767556431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556431, "uuid": "863ce9c1-b954-40ce-8755-c292a229ff6c", "comment": "Malware payload (SalatStealer)", "value": "171505f0bfb9ac2493c2584d957b7616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556431, "uuid": "2f63ca2d-d752-47ee-bedd-7be66139766e", "comment": "Malware payload (SalatStealer)", "value": "21169cae3cda0bf0475ed05934f5be44c4bf922007c0f4c790336a3e1a2113b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556431, "uuid": "75570e23-6ebf-4e96-87e7-7bcda48c5d95", "comment": "Malware payload (SalatStealer)", "value": "acc545c0e7fc70beed85af64c206448f869b396f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556431, "uuid": "09b862ab-a04c-4d3f-94bb-320fb2ade10a", "comment": "Malware payload (SalatStealer)", "value": "d01647c34cba77aae4a1f9744f64701dc05b314c0125dab06c07f0dc0eb161d3fa71e544f623725e4d18c823732d4efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556431, "uuid": "4184d957-96cf-4223-9b75-e5af194116da", "value": "T19FE533DDBA0EC197D40261F898886A7670A6C51BEF8EC7B8B3431C55E72137076C7B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556431, "uuid": "e4d0a663-411e-4b4f-92ac-12e8f84f7cf3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556431, "uuid": "10369b35-3072-45e7-8204-52064e79e0fd", "value": "98304:w4ewKwvknFcKFAbIIKTdy35tdKr5EZSPP09HY4X:uwviwEIgGghPQHzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767556431, "uuid": "4d08b0bc-8d1c-4050-8f3e-76a4856af25d", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767556431, "uuid": "4617dcee-2a21-4be0-b84e-94baa8ead4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556431, "uuid": "71fe636d-10d8-4e43-9cd9-8fac9736cd1a", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187f0812-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511335, "uuid": "a0008fc7-8537-4a56-8377-b2c3e52bac55", "comment": "Malware payload (WannaCry)", "value": "0fcbcd2f1a4184a0b5ebdc2e65b492e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511335, "uuid": "0d31f395-7643-442d-bc86-39c2eba4d539", "comment": "Malware payload (WannaCry)", "value": "222a7059f1845110a8050a900f7f98bb6ab4338c98093646d1d972bb120dc99c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511335, "uuid": "009d5b72-2442-4ca2-a425-e2b6333783a2", "comment": "Malware payload (WannaCry)", "value": "71ca12fda25f3b8bd56d60843f2f3bf840d710e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511335, "uuid": "a146aca0-9a2e-4998-b1e4-50a7c644914a", "comment": "Malware payload (WannaCry)", "value": "d06affb5c2cca3a84d325b6e476f866325c9e6dc68d105f35bec5943c68825c76fe50ba94216ae0855a77f196b32e4c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511335, "uuid": "d2fecdc8-fc44-48c2-b1b3-e43c6c703e55", "value": "T1F8363394622CB1FCE0440EB444638A1AB7B73C69A7FA5F1F9BC086660D53F5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511335, "uuid": "37f16a7f-372a-4b56-bcb0-203127c4e0e0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511335, "uuid": "6bda69c1-d6bc-4544-97ea-92af97e24c39", "value": "98304:TDqPoBhz1aRxcSUDkB6SAEdhvxWa9P593R8yAVp2H:TDqPe1CxcxkBZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511335, "uuid": "b06ab847-49d9-4c0d-a9ed-e6e646e95565", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511335, "uuid": "ae3e05ce-4a6f-4b6f-b725-4379f34c979a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511335, "uuid": "8fe071e2-a87f-4a5a-9698-25596f6a23d3", "value": "222a7059f1845110a8050a900f7f98bb6ab4338c98093646d1d972bb120dc99c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85729c18-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767512806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "490af139-a80a-4f00-8be6-9e71f88e2b30", "comment": "Malware payload (Mirai)", "value": "7aa57e87ca104493ff6097d6fe376fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "c2392890-d0e8-4b63-a4e1-82bd83fcbd16", "comment": "Malware payload (Mirai)", "value": "225cd2b57a2d1b3d1c74fd22f441c7b885f0236ddb36e582946d48ada975eefe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "0b0174b9-42ab-4694-afe0-9fd4bd9e0ab4", "comment": "Malware payload (Mirai)", "value": "2c31299ca7a9f98b8fbed3d5016e5f5c796681c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "fefd9c9a-7f9e-4b9f-8c5d-ca913ebcdd09", "comment": "Malware payload (Mirai)", "value": "c787ac0fecfa4db1c012334d0e00e49496ad123b51c9e1b2a034667a881d5e27942a352ca2183681f47a150c559a686b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "5425ccdf-18aa-41cd-909d-1735a0d02555", "value": "T100141886F8C18F11D5D012BEFA1E128E33135B78E1DE3212AD255B21778B9AB0F7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "e1431a1e-99bd-40a7-9911-138ba382c2a1", "value": "3072:SoHOLb7otuoJBONyMdUyGBZ1XSQHjoWaS7rbdKtuSarTErqx71:NHsbFA0kMdJ41X7HjfaMAtuHTErqx71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512806, "uuid": "4e317d69-c3c3-46e3-8c73-3db4d1a4669f", "value": 196988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512806, "uuid": "f95d1ac2-c9a5-4eb5-9e95-d30f0fd56df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "c2b8f8f8-b6f4-43e9-bfa3-fae143e0d3cc", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e70435-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511757, "uuid": "25b970c9-2011-4b9c-938b-1ce5e9780206", "comment": "Malware payload (WannaCry)", "value": "94b1b4ca313dc3ae348fa5a79b36ad34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511757, "uuid": "e6722f96-1f90-40a8-9086-557b4c995390", "comment": "Malware payload (WannaCry)", "value": "226d05ba1cf4b464249e425f70f76a72b3dd318395947359fe8a7d5ad20200f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511757, "uuid": "935de28e-c901-4005-9a3d-877e738155fa", "comment": "Malware payload (WannaCry)", "value": "54a755d92ce1ee61ab2d115d82127488a3900fad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511757, "uuid": "4405e691-a0cb-4f48-89b3-5153fe15af97", "comment": "Malware payload (WannaCry)", "value": "06c1a78b33815c53dc6860c622cb68216beb832575cd925563ca1134e64e52f77b87664345c0ff4e70d581c8856488b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511757, "uuid": "c9d7693a-c801-425a-bcc1-dd65a34e8b9f", "value": "T1A636AE01D1E41A60DAF24AF726B9DB10873ABE46995B9A6E1221410F0C73F1CDDE6F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511757, "uuid": "7e18cd91-3376-452e-b993-4b2cc7087a00", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511757, "uuid": "db0bfb94-e9d5-4806-a639-32ea66f3a73b", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhMJM0H9PAMEc:d8qPoBhz1aRxcSUDk36SAEdhMWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511757, "uuid": "a902e0e3-4763-4498-a0c3-4d713e4dd5cb", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511757, "uuid": "0b4fbfad-bc6d-4da4-b0f7-30bad378aa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511757, "uuid": "cc89debf-c35d-4f0a-b3fd-4446f7b2b6f0", "value": "226d05ba1cf4b464249e425f70f76a72b3dd318395947359fe8a7d5ad20200f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31287875-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519966, "uuid": "84af41bd-7b9c-4334-ba80-d0a0c0de8f85", "comment": "Malware payload (Mirai)", "value": "349ceff9c6e4a3d04077b97ffd9ac81c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519966, "uuid": "ec560243-4c5b-4dd1-9f4d-7f13233338df", "comment": "Malware payload (Mirai)", "value": "22a08bc439429b423015e098fb653a71940ad6f0b0c40eecfa876560a567d83b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519966, "uuid": "836be41c-bd6e-4158-a13e-94dbac93cb38", "comment": "Malware payload (Mirai)", "value": "5cfd9d160b9ac61b9ee4253fc7fc41f771cd403c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519966, "uuid": "763986a5-9b1d-47c8-91fe-e4a0eea8ad0d", "comment": "Malware payload (Mirai)", "value": "071f955e4f109a1e5ee03c3ea8f0e57952f55cc584735af309bcf24c0db921effe786310bf588633d91db9d9af248c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519966, "uuid": "c36d2754-a1d3-49d6-bfc0-f54e64b22436", "value": "T1F7735C98B4018FBCF98BD9FA81164A0EF92163107A530F27B76BFED32D520A5CD46D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519966, "uuid": "0e3c54c4-bef5-462e-9d92-03fe0fe9c4ba", "value": "1536:3fkHON7SqMN4afO/fz9qtfMxLjw5QvvAB8yiY8fvZ:MHeuqSIz9wMxLsOa8/xvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519966, "uuid": "6c194a19-2800-43b4-9174-50203c51d64b", "value": 76112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519966, "uuid": "d36d04c1-fb39-42be-8702-b89a5d89fa6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519966, "uuid": "8e262fef-9705-4dbb-9134-83e634ffb761", "value": "Fantazy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5972bf63-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555682, "uuid": "17bf22e5-a1ef-496e-bac3-b9a65322a052", "comment": "Malware payload (Mirai)", "value": "6b31665b60d8f9a6bcb7a6cf6d46491c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555682, "uuid": "bc0b5a92-e7c9-4df0-aca4-e6b75fae52da", "comment": "Malware payload (Mirai)", "value": "22e416c15650c891328be26fc459983621ec426c443e5642de5a1e31b00b3b18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555682, "uuid": "eb6b0b50-0895-4a21-a4b5-ccc642b43d39", "comment": "Malware payload (Mirai)", "value": "b65621fbb9ad61f067a104a76878ac2a7b2a5a1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555682, "uuid": "b45a06f9-4b19-49fe-a780-2f1f0a5bb3e7", "comment": "Malware payload (Mirai)", "value": "372e9cc7681d3c5e60646b2567aa96157ca34777b51e83227884129fa980f1b2d381cb2b9b31344bedb1f346f26c247a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555682, "uuid": "6aa6abb2-ac99-4329-bdcf-919091ed8af5", "value": "T1989312227490181DE11093F4B60724B7547E426DF56EFE8EEF6F8090B4AB1BE8AD3C25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555682, "uuid": "7a9a4e85-aac7-4510-8b2a-170ee25f9838", "value": "1536:I6a54ABqLeMe+kqXqF54iLU8GT1WTG0V4pF0BP+kXy4aWuEnLN:Da5sUMi4iLUVH0VKyXaHiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555682, "uuid": "8c911132-079a-48e4-8387-b7d48bc6ccad", "value": 96748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555682, "uuid": "4f7106a7-4654-4fc9-acce-f815b814d5e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555682, "uuid": "d4150ebd-e0b1-4dfd-ad76-fbfcb6c034a2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092a67ce-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512168, "uuid": "7d9ad8c2-ba12-4354-bdbc-1c3cdbcf1fcc", "comment": "Malware payload (WannaCry)", "value": "084434a516703113776d9787a83fd77f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512168, "uuid": "7cb6a14e-5c6e-44c5-a8e7-92c2258033b8", "comment": "Malware payload (WannaCry)", "value": "23065d96066bbc0d294eb11460c1f37e12879864d615cf6ec17fbb40492ecd62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512168, "uuid": "b11e4c30-bf42-4e10-b7d7-3829972e138b", "comment": "Malware payload (WannaCry)", "value": "b5993b2ad4ff96f29d6ad2375378ff095aafba81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512168, "uuid": "056158a6-369a-4561-8fd4-4d86840280e1", "comment": "Malware payload (WannaCry)", "value": "f624fbe13714134fa32e9a8c388c205ae834bbb9642c87aa3fd4144e4c64b957e6b32f9c37bbf6f40e8ba67b4e819d5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512168, "uuid": "989f2065-c0cd-43eb-9592-35f4f581c040", "value": "T1D136231A753CD1F8C14A167964A38A66A3B37C6626BE570FDF5086221C03B50FFA8F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512168, "uuid": "5a6718ea-a91a-4a2f-bebd-ada898e95cef", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512168, "uuid": "738e1d58-2951-431c-a3fb-b79efc7c1eb7", "value": "24576:zbLgddQhfdmMSirYbcMNgef0QeQjGU6SASk+RdhAdmv:znAQqMSPbcBVQejU6SAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512168, "uuid": "f0f1a771-7c82-4fde-abcb-521336248d54", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512168, "uuid": "ed6289ba-3cea-4e34-9d5c-1e92273b3ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512168, "uuid": "d2e2736d-641f-4d4d-af34-adbdcc013631", "value": "23065d96066bbc0d294eb11460c1f37e12879864d615cf6ec17fbb40492ecd62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d538bc35-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512511, "uuid": "44481cdd-a8d0-4bce-ba8a-b4e18c3cb121", "comment": "Malware payload (WannaCry)", "value": "a1bbc4f908c7e79fa740abb5574e5733", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512511, "uuid": "71a0b54d-15e1-4f86-bf1a-28813b706827", "comment": "Malware payload (WannaCry)", "value": "23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512511, "uuid": "8d9005e3-8f02-4625-afe6-785665533bab", "comment": "Malware payload (WannaCry)", "value": "7bec90bf83835b93a718e22b2851d8561eda55d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512511, "uuid": "ab085a6d-6a5a-40df-ad60-e14366c04b32", "comment": "Malware payload (WannaCry)", "value": "0f6cca267c07550376029b71d4d29d1cf7b46e2eeff309e2240a4c72056fcb27da05f7f25205b492ce294958c3784285", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512511, "uuid": "795e59d5-c952-488a-84fa-3fb4f4c56bef", "value": "T19636235530A8C0B4D103157048ABCB62F6B6BC2917BA694FBF904E7E3F637A1E715B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512511, "uuid": "343f5660-7350-44f6-b0bc-0c658cf623f1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512511, "uuid": "b245b7d5-8a6c-45c7-b1d2-63fb7a81c1e0", "value": "49152:RnpEKUv9wC7+VQej/1INRx+TSqTdX1HkQo6SAARdh:1pyv+Fhz1aRxcSUDk36SAEdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512511, "uuid": "fa133980-c250-447f-ba83-0b205ab94f42", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512511, "uuid": "89e12a8a-1486-4ac2-8c99-bdfd27889b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512511, "uuid": "5a8e46ff-352f-4864-9699-54163e5a52b2", "value": "23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191ca2c6-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567171, "uuid": "9c3e52f8-1cfa-4cb9-976b-748c33813193", "comment": "Malware payload (Mirai)", "value": "84edee18908dc30d3a97d0164a94c79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567171, "uuid": "402b2c2e-bad5-485e-95b3-6384230ded29", "comment": "Malware payload (Mirai)", "value": "24682eda82fe824ba46a3e236135bb5250a25021fe363cabce746120c62f5b3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567171, "uuid": "a8c11d54-c2ff-457d-94b7-4255e11d6d8b", "comment": "Malware payload (Mirai)", "value": "57c6db6291132e8876556a226a765f965c28d890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567171, "uuid": "270d6608-ad25-4b1b-825d-37d38d204c2a", "comment": "Malware payload (Mirai)", "value": "203d60a4bfbc1d6e8332a682c3e26634fa7342f5c1cbe1b1db889cb96298b7d4fd52162b3db039a22fa1291d2a313c34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567171, "uuid": "2ce0acfb-8470-46b5-8d8b-33b6327df68f", "value": "T16AA2D01572A32D55F3EC1C3DC96F825BB9671BFC90F632B679411A20C90D24A3E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567171, "uuid": "1c6831f6-f979-425e-97c6-415fc2ca798f", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjDrDOhymdGUop5hg:vvQn4j+ZO5fKAlxjDOs3UozG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567171, "uuid": "633ffda9-98cf-435f-9afa-b9362d9275d8", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567171, "uuid": "8e508f2f-4f1d-4a80-b3db-b22e0d3b31b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567171, "uuid": "d7210cca-8f1c-4fe8-af77-79524db3aca5", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a44d7cf-e95c-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767524411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767524411, "uuid": "ba3844c5-3160-4311-a142-d3c46c8bd456", "comment": "Malware payload (ValleyRAT)", "value": "0c08cc1170c8ea0b2898efa68fb8d551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767524411, "uuid": "f748b2b3-2892-47ab-8dd0-8bae871a5e2f", "comment": "Malware payload (ValleyRAT)", "value": "247bc5015b57de8b3b61bd8afdf7f432aef154405129004e941b7fa890104a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767524411, "uuid": "bf659498-ad52-40b4-8ff3-0ef74620189b", "comment": "Malware payload (ValleyRAT)", "value": "e1958f05ce74115d24fe09712914a506b30368a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767524411, "uuid": "95ccd9a1-b622-420f-9ae3-b77b9578f711", "comment": "Malware payload (ValleyRAT)", "value": "80e26dd4ffd20bbb75bafd8a5c452a49acd414669ae51b677352579ba719fc3286f2f5cd7b2a2dff9149caf1611238d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767524411, "uuid": "61784c0c-5853-4baa-9098-7495e9364109", "value": "T1C2B36A1773E934F8E177823988610A05EBB6B87106619F6F03A442AA1F27791DD3EF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767524411, "uuid": "3314cbf5-d9e0-44e6-885a-0e10d51d0a21", "value": "c439f530c3c3af79d4afcfcfe4cc4e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767524411, "uuid": "9e7d5048-929a-460d-a5e6-81c6732085ba", "value": "1536:YTw3Slp7Ii2zzc8BSX8ygvoQpevTffJssWFdc9dlPB7J0eiyud:ew3dr48BS/gwQp6f8UdB7uFyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767524411, "uuid": "e27646d1-4bb6-4546-b892-3ddd457a5481", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767524411, "uuid": "c1b20062-67da-40f5-97f5-2041973e2df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767524411, "uuid": "d7f3a4cb-a090-4710-8285-28aaed102b2f", "value": "0c08cc1170c8ea0b2898efa68fb8d551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf2285f-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512282, "uuid": "f8778fef-e2a5-4ae7-a59b-6a94571beb65", "comment": "Malware payload (WannaCry)", "value": "3e6c540788ec2da97f9c6570d1ba6b35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512282, "uuid": "b6591953-5bac-4ac2-bf3f-179abcc2b6a8", "comment": "Malware payload (WannaCry)", "value": "24cf076fa7049bf0afe40d50ee953a21a3899d0160d1006e6af1f715d1d087d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512282, "uuid": "d0271a5e-92a3-4d61-b967-c479d0ca217e", "comment": "Malware payload (WannaCry)", "value": "80dac0068c9573f3c6f1401dc7023a5a2a4bb748", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512282, "uuid": "b0a1b210-8a07-498e-9323-e2095e972e4b", "comment": "Malware payload (WannaCry)", "value": "f5104f5f594ff2eba5f3e233925d5f9b0cb882b059166331c376e9f15222345e1afcd1ec51fb26b5ba2abf29462d76b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512282, "uuid": "3b2596e5-dcae-4b1e-8841-fd58931b1f47", "value": "T18436E122E08798F5D06331B0022A363BEFFCE925172FB4DB9644D8A51675BC1DB35A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512282, "uuid": "c7c7ece1-316f-409a-b29e-055ca8c2ac6b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512282, "uuid": "b85e2907-d2bb-4247-b939-c03e806d657a", "value": "98304:TTPoR1aRxcSUDkl3epTqwHGFTSBu2hi/4:TTPI1Cxcxkl3epLH6su2hi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512282, "uuid": "dde736ee-aaaf-4d43-b175-b465c2fd5de9", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512282, "uuid": "94bc35d4-6a5a-424e-a16b-11146a02936a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512282, "uuid": "4b240b84-b611-4a40-9a8a-147d881a6b8f", "value": "24cf076fa7049bf0afe40d50ee953a21a3899d0160d1006e6af1f715d1d087d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f92c12b-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511857, "uuid": "5513e7f2-e00f-4958-80ec-a702f5f6c4b9", "comment": "Malware payload (WannaCry)", "value": "fa38627c1180cba6007f30536b5c1b30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511857, "uuid": "370a5189-0fb3-4bc7-8122-7292dfd10397", "comment": "Malware payload (WannaCry)", "value": "259290bdf6747509c47e79fa4162e72299dda09fe09aaa213fa510c665bac0b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511857, "uuid": "488b8696-15fb-4330-8e6b-b9985d0e1d8b", "comment": "Malware payload (WannaCry)", "value": "a4ce6a0cefab1637162c4de40b25d87ee4fe1f35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511857, "uuid": "e25a90f2-5463-4772-b3fa-766f75e18ac9", "comment": "Malware payload (WannaCry)", "value": "186386eca5125cb99dd9bd05f39544b5381e7d0fd9e6306abd45d81573ac11c5f50ddf645185a1310c365d3f6b08d09b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511857, "uuid": "a7f12afe-8574-4d32-a2f1-19cf24b539e4", "value": "T1F5363395A66CB1FCE0401EB44073452B7BB73C5963BA8E5FDBC089960D43BAB6FA0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511857, "uuid": "ae3e1023-d7d3-401b-9be8-264ee58a9a78", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511857, "uuid": "f8e4ca49-04fb-41cf-a304-9bd10797fe8f", "value": "98304:d8qPoBhz1aRxcSUDy6SAP9P593R8yAVp2H:d8qPe1CxcxyZAPdzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511857, "uuid": "efd0055b-86c5-4dbd-9936-e0400f228440", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511857, "uuid": "10556fcd-0717-4ba0-bca5-6d2f8c9c4260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511857, "uuid": "54621ddf-6bae-4338-8ba6-9e94b47d2c20", "value": "259290bdf6747509c47e79fa4162e72299dda09fe09aaa213fa510c665bac0b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fc82f2-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511870, "uuid": "26dcd114-c1bd-43ab-b879-2b1ae5803602", "comment": "Malware payload (WannaCry)", "value": "9ba5379aa41d707a4331d27a004baec1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511870, "uuid": "0bbd30d3-c96c-418e-814c-4ef71b5600cd", "comment": "Malware payload (WannaCry)", "value": "25b7e641f8b6ae7f2c90520e00c2d0b9fccc0f12d2ec3065f8d3bd1a5915b1e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511870, "uuid": "56269e60-456a-4af6-aab2-55436b207917", "comment": "Malware payload (WannaCry)", "value": "4b84ffda81cd08adef71ced5294b4cedcfa3507a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511870, "uuid": "44779bba-895f-4c1d-88a9-586e26261187", "comment": "Malware payload (WannaCry)", "value": "94c501c6c26a2aceeff316aa5be80d1af90c822971c1029d64622fb57a77579b4cd036d20cc686a1b538fe6b24ca24ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511870, "uuid": "56a80d03-4878-437e-80c7-f745b592e78c", "value": "T1BC363394622CB2BCF0440EB44463896BB7B73C6967BA5F1F8BC086670D53B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511870, "uuid": "e5890ccd-6473-4ec2-af03-4f0c03d777ac", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511870, "uuid": "9fb0b475-0dae-4209-a743-a431573a545c", "value": "98304:+DqPoBhz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2H:+DqPe1Cxc7k3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511870, "uuid": "fdf7dc84-81f9-4090-94a7-071471154f07", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511870, "uuid": "85e89ad8-4ff8-4d49-8e6a-2e2a4af2bc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511870, "uuid": "ff3f3dc5-c473-423a-9ca2-d5c4307c203c", "value": "25b7e641f8b6ae7f2c90520e00c2d0b9fccc0f12d2ec3065f8d3bd1a5915b1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e679aa-e988-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767543414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543414, "uuid": "eab14034-f51b-495d-9f24-a5364a85fe1a", "comment": "Malware payload", "value": "a33ae5d518e9d2ad6337e73a6bb28c22", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFUpdater", "colour": "#DA53D2", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543414, "uuid": "10c08453-a964-4d89-9080-d24269888e67", "comment": "Malware payload", "value": "25c4d3695c82d6a652f70eb8213a66d206d9c9949af5516376856051dceb8c79", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFUpdater", "colour": "#DA53D2", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543414, "uuid": "2b12eac3-e637-4554-9b08-61ad01fb3163", "comment": "Malware payload", "value": "3d765f7bbfbfb626ba211937f067f5a7bb8ce1c0", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFUpdater", "colour": "#DA53D2", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543414, "uuid": "7f7888be-468a-427b-95f7-950aac625866", "comment": "Malware payload", "value": "1d21500c3d390f475933b87c9fb27d1609d7d61484f97227c823f4ae5c03202ba817ad0cd171bcfd255cf384f91416ec", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFUpdater", "colour": "#DA53D2", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543414, "uuid": "4c11fcb8-3d61-45ff-a262-f001cd68e660", "value": "T147144D632752942CC13A907D0A6FA7674335F8056712F75AABC452291FFBAB01F0EE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543414, "uuid": "c23e5db2-88fa-436e-93bf-1e8067c59161", "value": "3072:uUQq82GNMmGCHIca0Ru/r71VGpYmuLwG96oDquVpZmAHyFRI8WywaDL6iesIcR9t:oWe1pa11oIwg6YpPjsIcR94Gy4v55cdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767543414, "uuid": "7ea5e833-a292-4f99-9e65-ac41f2d81e39", "value": 190560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767543414, "uuid": "24780b87-6c81-4afb-943a-45b6f962e2c4", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543414, "uuid": "ec1c9b90-fe22-477a-a509-342ff352a1f7", "value": "25c4d3695c82d6a652f70eb8213a66d206d9c9949af5516376856051dceb8c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7df906-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512523, "uuid": "4afe5f02-b0c4-4789-9a46-da8eb51add01", "comment": "Malware payload (WannaCry)", "value": "30c62ab1d9f5e07a4af9e25e9fbd3b3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512523, "uuid": "96682c87-d046-40a2-9a48-4218b30ef4ff", "comment": "Malware payload (WannaCry)", "value": "25ecadb007c25cb3751a95eecf6e4bd44bceec72652d54e10c488c5b78a31edb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512523, "uuid": "d9f55d04-aabe-4140-9f24-d67537f87bcf", "comment": "Malware payload (WannaCry)", "value": "1723ba604ec62346b425ea3a8d7f01698586a7b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512523, "uuid": "83ae0f54-bfa9-4a2d-92f1-88801a2da5de", "comment": "Malware payload (WannaCry)", "value": "36bb78b015f44d59d09f752df6dc1fc3821d07d574419ffe7f68b3b82a17bcc562035753f71ef7275bd860f63af374b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512523, "uuid": "83d2b489-68a6-419d-b057-047207cc3d1e", "value": "T10D363359717CD2FCD10919B404A7CA67A3F33C6A16FE6A0F8F4089661D13B19FBA0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512523, "uuid": "1a0db91b-dc37-4b70-8919-9e23d326e6aa", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512523, "uuid": "acab62e6-0815-40f7-a000-ddaae68362b7", "value": "49152:RnuQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1ZqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512523, "uuid": "17b45824-b2f5-4dc5-977f-5f8528ad6fc6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512523, "uuid": "69a3bef5-88c5-4d3a-9710-4d6528b86615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512523, "uuid": "627e6ec0-c598-45a5-a267-ffb9805bec15", "value": "25ecadb007c25cb3751a95eecf6e4bd44bceec72652d54e10c488c5b78a31edb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e025d324-e904-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1767486759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486759, "uuid": "82d11181-25de-4f05-bb52-8011362cb848", "comment": "Malware payload (HijackLoader)", "value": "2366d0b96ee4905fd53cdfec2c822188", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486759, "uuid": "9080f9b0-7554-44ac-b4c5-224097ed7050", "comment": "Malware payload (HijackLoader)", "value": "26134b043d866b85cf5a6389c64c885f814c074d0cc9c413ce344f88de3e8f15", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486759, "uuid": "12298b79-dc72-41a2-9b61-28c07b5b8a29", "comment": "Malware payload (HijackLoader)", "value": "1bc93ceca960efe85172a7cd375184c7559e9077", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486759, "uuid": "07b40f05-0916-4175-9e38-105c51c967f7", "comment": "Malware payload (HijackLoader)", "value": "da76b491e190de0e08c2f95194f832fc187204b41630701247193e3ead6ffe308d2cbc99d1cb7acf11c1bcc27b2a8b63", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486759, "uuid": "8fa2b3b1-a1c8-4bbd-af9b-cae82eeb291c", "value": "T10C163356F3C60834F0B55E746E378842AD637A7419FB94892CF1C85E1EF96638E32782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486759, "uuid": "b50f4a38-117f-4b17-a936-7e064a903fbb", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486759, "uuid": "458087f7-c75e-473e-8e34-d75aaff51eee", "value": "98304:GPUSpZ9O8F+gb8cml3G1l8eDUVcun0/rpZEUYLWVk7ZYPy4d:XSpZ9R+ggl368gUVcun0/gWawJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767486759, "uuid": "f4f66a03-509f-4cd1-850c-099e3f92cd37", "value": 4334753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767486759, "uuid": "6b3a1f84-3836-4093-b974-a0a6357a6f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486759, "uuid": "2cce0368-d958-4606-a06d-e6e1f3295680", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1a411a-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567149, "uuid": "97b37b89-e099-4a97-b880-346e69105faf", "comment": "Malware payload (Mirai)", "value": "a92e1dbc6278ee89e803c7b9c40142a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567149, "uuid": "10fde41f-c61f-4dbd-8a40-fbfba3f5efec", "comment": "Malware payload (Mirai)", "value": "274b78b769af6463b6902d09fdd960f8019567489498a8c94ef9f5fc193c57d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567149, "uuid": "2f360a33-6760-42f5-a0fa-e48b15aeec65", "comment": "Malware payload (Mirai)", "value": "206d8ba78ccf91708312411fa05fe7e3db330ced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567149, "uuid": "5e1a5d1b-8992-4266-a7a2-0c2cf55d1e6e", "comment": "Malware payload (Mirai)", "value": "00f815035e6f2c31b3ac2433093bb8626e457fe46ee6f598a01acf807220c599c70f519a2954af210294b674b0af8a6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567149, "uuid": "5e9b38f6-b74c-4b1e-87f2-ba4deb3b9eb7", "value": "T1F182CF3061AB74E9DBE10435EEEECEC6971A0BF8D0FC32D217586B78894650251FD2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567149, "uuid": "896fdd30-725e-4e6f-ba8c-58a5993462af", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMabMhymdGUop5h5lC:2dV0P6+kom0tVAoNvm+to1bMs3UoznlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567149, "uuid": "acb2b476-52d7-4524-8761-53bf296ef212", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567149, "uuid": "e93fef2e-c42d-4884-a694-a71cde16836c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567149, "uuid": "ca01c137-b85f-4c85-b82c-af6761321b2a", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc6e42e-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512498, "uuid": "b826444b-26f9-4579-b2bd-91b8e6ac188f", "comment": "Malware payload (WannaCry)", "value": "19963b4382c8ce1096e580e3551fa628", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512498, "uuid": "22b66b8a-7be1-4833-81b5-3fb2c6584c63", "comment": "Malware payload (WannaCry)", "value": "279d1952e08e192c7b88eb48397f37db5f4f00d6332650cf4c5d0f4ff243995f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512498, "uuid": "db76f470-578f-49ab-850f-d431371f418e", "comment": "Malware payload (WannaCry)", "value": "62dd076c40bc7813eded7f64858fd4ed3e01d6e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512498, "uuid": "180ebfd6-dd2c-4f75-9bb2-f8228a1d7d08", "comment": "Malware payload (WannaCry)", "value": "6e19a1313d44a94c82d4a5e565e001f57a5691b5a391fb260f4fa90776b8e429890e518ba2b194356dbd74a83989aac2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512498, "uuid": "4f115221-1250-4629-8256-0963210ff54f", "value": "T1BC36E04AD3D71AA4C4F40AFA226B9B01963B5E5185AFA53F6A21044F0C77F1CADD4F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512498, "uuid": "a1e1ed0a-65b9-4096-93d5-08a06de09e77", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512498, "uuid": "f869d218-5598-4268-a950-523220f90ff0", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9bAVp2H:TDqPe1Cxcxk3ZAEUaJc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512498, "uuid": "16cc2b12-17e5-4bf6-b0f2-733e35c73ee5", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512498, "uuid": "9b1c93f0-e31c-4991-a1fd-d47d1bff5b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512498, "uuid": "22eb765e-c1cb-463b-b403-2d6efa28b118", "value": "279d1952e08e192c7b88eb48397f37db5f4f00d6332650cf4c5d0f4ff243995f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a483af-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509364, "uuid": "03097e33-6bf8-4683-a319-c8e8c2ea1006", "comment": "Malware payload (CoinMiner)", "value": "6b3932e7080aabefa615edab499011d5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509364, "uuid": "5464cc80-3d80-4a27-976b-792d446b206d", "comment": "Malware payload (CoinMiner)", "value": "284f7c53fb62ea37d86ac7ddbf94467652ed1cc6227bd7e4e3c9357c5c49eac2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509364, "uuid": "1fb75352-4135-4714-9a79-346c5d976254", "comment": "Malware payload (CoinMiner)", "value": "aa9db240ffb563db75afeb4c8f7b82a6597b4ad6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509364, "uuid": "af85bfee-d884-4d09-b2f7-4b91b298f2c5", "comment": "Malware payload (CoinMiner)", "value": "adf03faa69dc00af7e0609f1f7cafd9e079336a7a6d0911d533ee5ed173a04dab385e24658b35d4436ee7e4c4e7160a0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509364, "uuid": "5f5a2eea-9ae0-440c-ad3d-57eed275887a", "value": "T1B816336511CBBDBE7585C8689DF8F7324E9925E299784111F83A08287C61EE7007F72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509364, "uuid": "8ca97298-2a4e-4eec-b625-1d4c010571cb", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzq:CC65sr3KrCfsYiZQgzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509364, "uuid": "6d0c6c86-adf8-4be4-9abe-e21679aafdf1", "value": 4255744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509364, "uuid": "68cbd67b-29b0-4fc6-91cf-785327943db8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509364, "uuid": "050cdea2-1721-4a2b-8b8f-b80ca3e3a517", "value": "284f7c53fb62ea37d86ac7ddbf94467652ed1cc6227bd7e4e3c9357c5c49eac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d80de38-e936-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767508042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508042, "uuid": "ae1467f0-9990-4f3b-9075-bd061c81f157", "comment": "Malware payload (Mirai)", "value": "a186de0274dc842998d87f263a5b1ec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508042, "uuid": "3e7f7d49-6d55-4dac-8a90-9e86dd7cd353", "comment": "Malware payload (Mirai)", "value": "285aac15d2306cf8dc076cca91bdda3deacb33e188d772f39af8e5c7eff6da4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508042, "uuid": "ae899f99-3053-48e8-9499-5686391d000e", "comment": "Malware payload (Mirai)", "value": "42d799187f9e0c7ae5d0bf3f0ec536245fb3f6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508042, "uuid": "295d0175-21d6-41e4-b643-3790c4d933b3", "comment": "Malware payload (Mirai)", "value": "034c6e3939c409e6d35452463efe8d7ebaf70fc6de59391d800124beb87b478e0cde78b7e000f20c57f59eba4daac30f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508042, "uuid": "3a086518-f68e-4078-893b-db2d199fc75d", "value": "T13043F11EC4981CD8F998C13D2DEDB38E1970D109EACA9AD587444A4FC983AFDFA94DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508042, "uuid": "a99fa5ff-7502-41e6-b3b2-762e209b7260", "value": "1536:5GIsYa2RmMEH6D1IqZdHXXCbgOg5R/GQRah5ZMnouy8Kyt:5GIK95q2qZRXog5R/GcEZMoutd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508042, "uuid": "160bf4c8-5f22-44db-888c-36660f128a3d", "value": 57248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508042, "uuid": "1567de83-8f11-45c2-b6b3-d610b9b6b009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508042, "uuid": "6171761f-5e55-4184-a257-0bf9413ab83d", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4fbea3-e991-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767547013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547013, "uuid": "fcd69e8b-3e67-4c5a-9c3a-a17c33a80815", "comment": "Malware payload (ConnectWise)", "value": "f7d5f8eea573805b20464909e7ab08ec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547013, "uuid": "6c2ebb26-9000-442f-90ea-b1b6c2c1e30d", "comment": "Malware payload (ConnectWise)", "value": "2a63dd3034c2a3ac29e60a80e0298415db8b2ccb6ea40811310e530e5278c50a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547013, "uuid": "ca62295e-d918-44bc-b2ba-2cf21e0d74b9", "comment": "Malware payload (ConnectWise)", "value": "b09cce2acfbb53de075834b127c40277f1435aa9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547013, "uuid": "edcd0d3a-480e-4b72-8e05-6399229952ce", "comment": "Malware payload (ConnectWise)", "value": "64365ffd9ebe414de53b0ea3d99be1ef170795ebb63dcf41678d2bc931f113aca406590c3e5bda4268da698f8cc7eef9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547013, "uuid": "f2a10558-b90f-4675-9559-aa757256c4c5", "value": "T1A8D6231023F80815F5B35B35EDBA92B1D83A7E65BE12D04E1761F81E2EB1D809E62773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547013, "uuid": "37b7bd5a-9370-4a90-9044-698e935e9832", "value": "393216:mxIQzck8xIQznxIQzFxIQzexIQzexIQznxIQzr:4zOzVzDzAzAzVzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767547013, "uuid": "abb21c6e-c03e-4b99-90f1-c7315135569c", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767547013, "uuid": "e3904538-1145-46d4-8056-05630ce855e1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547013, "uuid": "b6e63979-9d7f-4c10-83b1-10fe334348a0", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f286d86a-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767555939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555939, "uuid": "f9e3beeb-084c-4cd7-9864-447fa61cf4aa", "comment": "Malware payload (AsyncRAT)", "value": "bccfd9a46fc727f231ff77b2f4099815", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555939, "uuid": "e911c5ca-f879-44cd-8593-f216cf0a2971", "comment": "Malware payload (AsyncRAT)", "value": "2a6c6d3bd8f0d37255de8ddd78ce0c686b45488ca274f1c7b1588512c0327742", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555939, "uuid": "deefc117-a031-4483-865e-01c16e95a4b5", "comment": "Malware payload (AsyncRAT)", "value": "1945f13eb27f7c0b1e62e27a865aa156c5dbd46a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555939, "uuid": "21b5bfcf-3290-4219-bab4-c794a226db6a", "comment": "Malware payload (AsyncRAT)", "value": "b69c2a5d6b4c8f42f995bf9fe39492b0e506888785e0d430b39a48cfd2af3201fcdcce3b49a67f3a120896dd0d56598f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555939, "uuid": "1c5de572-e13b-43f1-b78a-a705a380a3bf", "value": "T153537D187BFA0125D4FEAFB00CF57253D675B623A913D71F74C8129A1623A88CA913F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555939, "uuid": "edb4e512-936b-4ae1-8bef-45881f5ef018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555939, "uuid": "cb38bf9f-f6ac-4101-b13a-58365d7a94f0", "value": "1536:9S/6M/J0b/Jj4byxN5bPry3fsbBD4fTT6A6sTkfWAO8R:i/J0eobPSsbBOTT6aOWAO8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555939, "uuid": "4ac6542e-123f-42c7-bb9c-e69b219a83cd", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555939, "uuid": "792e68c8-8cea-4c2d-81c4-327dcdd6098c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555939, "uuid": "cf721774-f8e2-4f45-8ddb-9be48a795fb6", "value": "NURSULTAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ae5011-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511297, "uuid": "a65974ed-fb56-407a-acde-9b4e335b55c7", "comment": "Malware payload (WannaCry)", "value": "276c71453dd8a3cef4fd8d8cc60ea221", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511297, "uuid": "989a8274-5c43-4f37-9c0b-388bfd513021", "comment": "Malware payload (WannaCry)", "value": "2b3bb1330425f0683fcfca469069db12c9e9feeb99d7ef76e9d54d777508812f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511297, "uuid": "859bca48-c72a-4127-b72c-1fa76834366d", "comment": "Malware payload (WannaCry)", "value": "f7d716b56a79fd06b53d190c6465126c24aeca04", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511297, "uuid": "1001ace6-698f-4af0-97e3-252fcffd5cef", "comment": "Malware payload (WannaCry)", "value": "4060bf781930c6993d56e95ffe380e5b8d650b76c18722dcb979e49618d9758b8b72cc8331871280816b2008eec4c2f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511297, "uuid": "72d36b09-6f94-4c71-ac51-112ab1b7454d", "value": "T1A53633D06A8C21F8F1A55AB0D4334A29B6BB3C7D72368B1FA3C087650D537E36794B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511297, "uuid": "2d9cc9f1-316b-474f-b987-ca09f3ba074b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511297, "uuid": "bfc144fa-4b7e-4776-aadf-cb94479af594", "value": "49152:DnnMSPbcBVSH9PAMEcaEau3R8yAH1plAH:jnPoBa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511297, "uuid": "0e4a90b9-ebdc-4ce8-8c80-256ea407ebcd", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511297, "uuid": "1adadea2-bf9c-4eac-a7d4-4e950ac127d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511297, "uuid": "ffd8fa83-d059-42fd-bb07-87ad22c794a5", "value": "2b3bb1330425f0683fcfca469069db12c9e9feeb99d7ef76e9d54d777508812f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec54e85-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567153, "uuid": "3d0d2cfa-c1c6-413a-a77d-c4e9ded416c9", "comment": "Malware payload (Mirai)", "value": "39a35be6153c9df1c410fb3f7e6d8706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567153, "uuid": "685d6988-e62d-46e3-9e41-a7f3f653f1bd", "comment": "Malware payload (Mirai)", "value": "2bc736600a09538b49f17eb1eb1bb8ccdfc332355141bab80b8654437aff9b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567153, "uuid": "bba7ec13-e42a-4dc3-9b9b-2dfc828460ed", "comment": "Malware payload (Mirai)", "value": "5d1fa39625ccccddf3c4c94b94ee4ed2e27cccc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567153, "uuid": "925a100b-4a72-4306-af15-42f37c591261", "comment": "Malware payload (Mirai)", "value": "0b2d00cf8371dbc5c7fee3d8569a3dec8d352353e70d9ed50bbfa7c67bfaf2f93a2c882bbd867106db3a5209b5347cad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567153, "uuid": "af3d3690-c6a6-43ce-a52f-1849ed6e2058", "value": "T1CB330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567153, "uuid": "1f112a99-73bb-453b-98ba-1eaba5379944", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGF:r/hqaJMDg9eqK806MHdkfQX6HuCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567153, "uuid": "b565b0bc-c890-418e-a1fc-400d2fc604d1", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567153, "uuid": "92e15f4a-52ff-4619-8497-4bf2e7ab1475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567153, "uuid": "ebca58e2-6c9a-4a32-b96f-e370d49561a4", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c7c507-e9c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767568053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568053, "uuid": "8de1c58e-35ee-4b2d-86ba-ad3e34bec213", "comment": "Malware payload (Mirai)", "value": "feb7e955727a9884d725d9b9b993883e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568053, "uuid": "8848db98-da89-4a31-9d34-09357d00dc01", "comment": "Malware payload (Mirai)", "value": "2c0602f505d90397621fa76bc947823564fe785db91b6c753b85664eac8ffb49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568053, "uuid": "dbcf64af-4ce5-431a-a4d3-18baac77cf68", "comment": "Malware payload (Mirai)", "value": "5522e486fe75d715e5b8928ba1d9d6a4ac2dd674", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568053, "uuid": "bb32a0ea-53e6-4e6e-a1c9-0d38f31122c3", "comment": "Malware payload (Mirai)", "value": "d3854234eff64b5ad9488346165ab98497edf15f78804c0a0a804e1862d2fa75d3e4e888f4da68b734ddcea08f68f162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568053, "uuid": "fe22cdc0-d819-47a6-b85d-b4c4aba9df9b", "value": "T1ECC2E134A6449C53EE726CB0F6300541AEA9977D6CE8143327A6388C76E59488FFD78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568053, "uuid": "8e33419b-0b0b-41e6-9232-df8e6fdfe36e", "value": "768:OwDH9Hzhp2et9YFe48MQxaYuNRu+WgX4vcm7r9q3UELl5:PFoUT4cgNST3KLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767568053, "uuid": "1b4691c7-f1f4-4b02-ad83-2168fe147a26", "value": 27904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767568053, "uuid": "814ee368-c0ae-4783-9bab-95c5b2b3242f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568053, "uuid": "1659a917-1e8b-48f5-9cd9-535476f1a7d5", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0b7f77-e901-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767485435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485435, "uuid": "aa47ae17-93fb-4c43-a60c-f3f05389e442", "comment": "Malware payload (QuasarRAT)", "value": "0c2717822a39c71ef9fdf1055005e78e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485435, "uuid": "aa2a6042-e6e9-401a-a315-955a9ed78904", "comment": "Malware payload (QuasarRAT)", "value": "2c7558f2b15a313ec953a0c93d53adedbf480afaee6ea14c2b9c8ac276497daf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485435, "uuid": "d1a0a9b3-5633-411b-a8b1-03f164f76db5", "comment": "Malware payload (QuasarRAT)", "value": "2b11bf488cd8b04b3f9dfcfd5dcb170ee541ce5b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485435, "uuid": "9bb697eb-c5ec-4ac2-b400-007566781ad6", "comment": "Malware payload (QuasarRAT)", "value": "d28f83888e4d8bf0b3475cdbe4c6643b7b0944dad4b0834ff6fbcca32cf887907b580bace734923a6f41867bf5970c65", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485435, "uuid": "bb2601f5-0c82-4cc4-a27e-709348f40124", "value": "T1E7C523853BFC4948F6BFAF702DB626648579B8A25D21EB5E05C5309C1930FD5ACA0F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485435, "uuid": "d59480ee-a105-499c-8918-21c3ba2b7252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485435, "uuid": "a1b6cfd6-7aba-41ec-b0c7-2a1c240e56c5", "value": "49152:cKoL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm:wL+2upjBVGVl/lQrCSZ4183Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767485435, "uuid": "d6b26339-c0a1-4fc0-a9e1-23c7bbdb39ce", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767485435, "uuid": "95960f43-8ac8-45a4-b6f8-9a2e4bf24906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485435, "uuid": "73a332b4-fee2-4055-8123-8be30ae605f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e555adf-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511882, "uuid": "fafa27ff-7bb4-45d5-8a43-29b616a902aa", "comment": "Malware payload (WannaCry)", "value": "14cdde2bac06a72e8b5256fa3c98514d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511882, "uuid": "df67416c-b1b2-4e40-ac25-ddb4129382b1", "comment": "Malware payload (WannaCry)", "value": "2cb15d199102060ffb0babb25cbb44277a2400233012a324762bcaf2e916fbce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511882, "uuid": "629d859f-f75e-4fe1-86ea-65cdd305115d", "comment": "Malware payload (WannaCry)", "value": "421f4a9f835d8cde1d026385d42a02bf4c6ba4ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511882, "uuid": "ed5b01dc-a902-43e3-bdba-f18cc93aeb7a", "comment": "Malware payload (WannaCry)", "value": "a2cde3033fd9b717206543e963b768409e3049be36201d137669e82ccfb5458fa0872571cb0c308277a2a44776fab336", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511882, "uuid": "76ad70dd-da77-4ee8-b387-4af9eedc4b87", "value": "T11C362309757C91F8D189077824A78B66B3B77C5A26BE5A0F9F40C7261C53F40EFA8B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511882, "uuid": "e6139224-551f-4795-af63-690995eebb45", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511882, "uuid": "893505c0-d44b-404e-9ff3-f053fb44756d", "value": "24576:JbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvctA0p+9XEk:JnjQqMSPbcBVQej/NAARdhnvoAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511882, "uuid": "f545e134-5e2a-43fd-9b6b-a8c35337bc49", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511882, "uuid": "1784997a-d34a-4b5b-9d09-79e6019485ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511882, "uuid": "3473d2d0-20da-4a84-966f-a79c6b2dd7f1", "value": "2cb15d199102060ffb0babb25cbb44277a2400233012a324762bcaf2e916fbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fb3a5c-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767512103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512103, "uuid": "92417c21-1b28-4c50-b7f1-e78dbe464c61", "comment": "Malware payload", "value": "a77c7341143e49872ba795c7d09ed273", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512103, "uuid": "387457c4-0dad-467a-bf4a-2ea3d78e3004", "comment": "Malware payload", "value": "2e67b07fc522065a4816430eb9ebb845bfa666cc3624385855030f8d67f5a909", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512103, "uuid": "ed947be4-544e-472e-91a3-b08eeb0d930e", "comment": "Malware payload", "value": "389a2f8c4aa87fd4d6c5bf14ec5fc6e36466c951", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512103, "uuid": "5cf4f4c1-4ac9-49a8-a3dc-5a86eb8a5854", "comment": "Malware payload", "value": "2b37fdd6dd8506fd23e25f4b295e5f13ba84cda0d1dc21e105d23b99c152abaa28845c22cd25917a059bad9cdcf23c69", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512103, "uuid": "17b85720-9ae1-4979-8f16-c260dbf5ca2f", "value": "T16AC7AD1663E111AAD577D178CAAB6203EB73B40713308BDF329C43A52F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512103, "uuid": "1f155447-1c73-4fd2-a133-6ca1c1d0b902", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512103, "uuid": "9c3ab303-e771-4bf8-af38-8adf9ab1dd35", "value": "393216:WI3gBe8bpHCebvYygICa5pbkIM4Lfc5uKEkhxQjWdHkK+UUVXpyNeG8MF8KN/672:WdBeI7LfOCDsno80dguj3/oyngPV18y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512103, "uuid": "ac8500a2-b434-4349-a9ce-b2b100c6325b", "value": 57404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512103, "uuid": "d14e48fc-9114-448e-9210-cd1ed8cfb9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512103, "uuid": "c14953a0-ea73-4d8b-9d3b-d80ad13805d9", "value": "KittyCraft-Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bedf68-e99b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767551428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551428, "uuid": "30041896-01ad-4f21-a0a0-daad87cba331", "comment": "Malware payload (Mirai)", "value": "bcd91eb389d5b7422d06d0d297a82955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551428, "uuid": "fb1950c6-f413-4191-ac63-976f48161f5c", "comment": "Malware payload (Mirai)", "value": "2f1f64d4f130e3a1ae5f9bb799a72d4ecf2887de9e6694c6c63c0a9a221c4bf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551428, "uuid": "e43000f9-5c32-46a1-8a94-4631dd2ab607", "comment": "Malware payload (Mirai)", "value": "882bbc67d97e4dc54d48d707dd8b865b00553959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551428, "uuid": "b93fe730-a888-478d-af77-86e8635e9f1a", "comment": "Malware payload (Mirai)", "value": "e05fc9b950256ea3300dea3d04eefe3dc9459cd05e72be861d004fd5390e38ec5a5d1cbf8fc73d8e1c6ab8b546681b43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767551428, "uuid": "d000a719-c5c7-4a7e-aa74-b2c93eb705fb", "value": "T1F5046B06FA82C1F2E59305B35053C7699730DA31035ADE07FB58AE397D322099E5B7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767551428, "uuid": "54445ac4-f8af-4270-a238-cd8d3822c393", "value": "3072:PsIcLeZbnZjLRohbcWTzgpzakFdkJEEevDT2DgciLj7jpVL+1D:kIcLeZbAhbclhCEEZDCLfH+1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767551428, "uuid": "50d4a183-1431-4000-a210-cb7536eb5b41", "value": 184420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767551428, "uuid": "7bc5b972-6217-4d85-9120-cdb6b9afde6a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767551428, "uuid": "6c87e493-28bc-4c46-897c-d8e25f21029f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7a5380-e997-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767549621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549621, "uuid": "9b1dbc84-c75e-4c41-8dcb-fd9bb058a3ea", "comment": "Malware payload (AsyncRAT)", "value": "fbc5b6deeaeaa5cc25e1f6bc19484221", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549621, "uuid": "f68f372d-3fd6-48d0-a487-5879aa871844", "comment": "Malware payload (AsyncRAT)", "value": "2f316ddaa159806c8a6c7e5470695d6d3f9de382985bc6beb4f5d45e955d1d3f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549621, "uuid": "4ff40f5a-1780-470e-af18-78dbf68233ff", "comment": "Malware payload (AsyncRAT)", "value": "917925822cd2e63a3f73582116fe74a53ca12fb2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549621, "uuid": "f8ff02c5-6bf2-4682-b593-4928439917fa", "comment": "Malware payload (AsyncRAT)", "value": "b135813425ac3cef8d722cb3d6583474916d70bf988c39856209a48f607c35ad6ccdf391d4bcbf3b0ba70fb7dd39d99d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "credential-theft", "colour": "#31B091", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549621, "uuid": "edef9251-5ee9-40f4-995a-9ed9305d48e0", "value": "T1C95349002798C962E1BD4AF4ADF2550106B5D9772102DA5EBCC804DB9B9FFCA49227FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549621, "uuid": "c00d4f8e-f638-4b12-8b38-7466e84da38d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549621, "uuid": "0fa20752-da42-4ac2-812d-099f5ce96714", "value": "768:7Pz003ebmfriPDVwiS9JS4WIJK3UI8o/mbd1+RSCv7mqb2nHpwH1oNS8GvLTVc6c:7PFOmf08iB3AoebdbGbbmwEfGzTVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767549621, "uuid": "ff56f964-0683-42f2-8a40-7b9194e06f77", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767549621, "uuid": "c6e2d88c-a7a1-4822-9c60-72cb37f76320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549621, "uuid": "792c1009-5140-45ba-ab08-a459025f71d4", "value": "HorizonEndpointApex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299183c1-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511793, "uuid": "170c8884-1417-409b-83a7-8e10a9fb6de4", "comment": "Malware payload (WannaCry)", "value": "730be98ac373fe078cd5b180148b5c42", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511793, "uuid": "ab86c456-5a82-4167-950b-12a955f5fb4b", "comment": "Malware payload (WannaCry)", "value": "2f582f668235ac1ab24776fde5bfbfafe2f4b79b57fdfeedf12ed07c42bec0a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511793, "uuid": "1d742f1c-6985-4f4d-ba5e-8e76467ab9a4", "comment": "Malware payload (WannaCry)", "value": "d3f51aeb028abc27a98fcf0bc47082e7bd566174", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511793, "uuid": "5f1fa8de-02dc-489a-9f3e-b427aaff66fa", "comment": "Malware payload (WannaCry)", "value": "6bd9db437639268760d665f25a075906f8c0586cb129e27dbcccd6f45ce8216540eb44dad3c335f89653711f11a8dfb1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511793, "uuid": "a88a17d4-1e39-49d4-969a-6c0a1545a616", "value": "T19E36339971BC92FCD205297484BBCA23B2B23C6D26FE6E0B9B4049751D43F56F790B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511793, "uuid": "960cc23e-e7a7-4303-a88d-1c4c5491aa46", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511793, "uuid": "c0ea56ca-3eb8-4ad5-89d8-6078a073e1d5", "value": "49152:RntMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1tPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511793, "uuid": "fad111f5-47e5-4f80-9318-2260d9eaa5f3", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511793, "uuid": "de5e0d5c-ae1e-4cc7-9c0f-bade0862ed76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511793, "uuid": "562fac75-6731-4985-b136-491039778a79", "value": "2f582f668235ac1ab24776fde5bfbfafe2f4b79b57fdfeedf12ed07c42bec0a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658ad94f-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511894, "uuid": "7652717c-1b99-4b4d-a61d-22ada4f9a3c5", "comment": "Malware payload (WannaCry)", "value": "3695f6d3175e85e25ea3cc65ab3801cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511894, "uuid": "0ba3e49a-7ad7-4387-8397-91976b23ed6e", "comment": "Malware payload (WannaCry)", "value": "2fc7ae2a16b562b608dfd0e899ab172375525e0577119afe17803740cf56a61b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511894, "uuid": "ef4217f0-d69a-4b12-a3ab-cafa73a16b7a", "comment": "Malware payload (WannaCry)", "value": "a51d6b609237e90287fc6fafb0e2391893785112", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511894, "uuid": "da1dc653-ad39-41c5-b54d-14af94c7de7e", "comment": "Malware payload (WannaCry)", "value": "0b54dc7611bf8c91769b968b4f655c599c54fcd4f4c95533dc38b968478ea3b0997ab43e1876b19108c1092f24246af1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511894, "uuid": "54ef3411-1a93-4006-9e1f-4de16e8f04eb", "value": "T1FC363359717CD6FCC10919B414A78A63E7B33C6666FE6A0F8F408A671D03B19EF90A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511894, "uuid": "db5cadea-f546-45c4-8074-af068f7ecbbc", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511894, "uuid": "ea0dbb81-8a24-43cf-a3c4-d53e7a90ca28", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:d8qPoBhz1aRxcSUDk36SAEdhvxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511894, "uuid": "de88cc77-a417-44c3-9177-0fc00742bdda", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511894, "uuid": "7a5a24b2-5e15-47d9-a06f-0e82dbf767fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511894, "uuid": "de9275e3-0218-4826-8ff4-ca22ac2718e4", "value": "2fc7ae2a16b562b608dfd0e899ab172375525e0577119afe17803740cf56a61b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba01e286-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516760, "uuid": "dba74e01-e27e-4c65-a9ce-7278f91fbcd5", "comment": "Malware payload (Mirai)", "value": "36a8026e6b624ac30ffbea9da934d81f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516760, "uuid": "86dd4868-425c-4daf-ab2e-c0b8547ec558", "comment": "Malware payload (Mirai)", "value": "2fffb9108408ff01d47e00386bcff5516ccf9aa748102a107a3e3c685bb2ffd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516760, "uuid": "8a4745d5-8fdc-45aa-ad54-3896d8ab3ba1", "comment": "Malware payload (Mirai)", "value": "d62b4ac50d55e97d9d762579cef0d5a48c9d9de2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516760, "uuid": "0481d43a-014c-4c39-b55f-1d95d324068e", "comment": "Malware payload (Mirai)", "value": "4eaf7d7423706ecd6ca55f9ebb4e7cf9721abca0361d3ab3a40d9c0e51b79caff1f8add33e5c64b49ba48d76914336d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516760, "uuid": "3e6c8d98-909d-4887-bd2a-034be8ea6c26", "value": "T168B34C52BD92DA12C6C16277FB1E428C371743ECD3EB32039E266F21728A91A0F7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516760, "uuid": "ef33cd09-d7db-4b84-a1d1-27596a68399f", "value": "1536:s7I2zfobop6OBDWyFJ0dKhRPpeCDLj+CRfSd91jY/CNXwOL+77I13bmzqvwJ0e:s7IYfoEEOAyFidKhDHL/Ra7dY/4oy/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516760, "uuid": "8991aaa9-90ed-410f-8328-a8550657e024", "value": 107732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516760, "uuid": "b558fd26-6f2b-4803-9369-d66341f83030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516760, "uuid": "5d52d816-0306-47ad-bc25-7c79b12b3510", "value": "2fffb9108408ff01d47e00386bcff5516ccf9aa748102a107a3e3c685bb2ffd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dc43f5-e99e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767552836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552836, "uuid": "1b0fba1e-3e01-42e7-a001-e8805a433446", "comment": "Malware payload", "value": "ca7ccad0ebaab2ef45c148d4c0700f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552836, "uuid": "59f47d2d-a23b-44d8-8062-061a1a802a07", "comment": "Malware payload", "value": "30785c072adf3e80abaf5168169e92a2d4a849b30b26a3d46be5ba4d004f4c8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552836, "uuid": "e0538912-f885-487e-874a-b2bf06d4dfab", "comment": "Malware payload", "value": "4e0f5b14fccf89aef5f4241bef822dc422fc40b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552836, "uuid": "c3c448c7-25f3-49bb-9f58-858c6622e3f9", "comment": "Malware payload", "value": "3e7dde0b52ca2e2600c06e1a386a9bd8cc95ad7a4b1e1a9627469846ff193dbeaef3650ca87afe80a76236e78095d4b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552836, "uuid": "c33d740d-2bb3-4ec0-9372-96e16a0357f4", "value": "T1E016BFB876047DE6A66F577BDE96ACDC13B626238ACBA4CC4064B7C30563375FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552836, "uuid": "f8a29c33-3b34-4723-a049-e3875235aded", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552836, "uuid": "320e1235-64b3-41be-858f-5d9e3b96325f", "value": "24576:+tzDCv/RK9S99ZI1fhbIio5KBjzbNdjAuKErru+G4uPOa1Fc1x5eNY25QWxj/WXQ:uzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552836, "uuid": "214501a7-0133-45ad-9ecc-e74a428ea6cb", "value": 4021248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552836, "uuid": "80f80b3c-1659-467c-ac00-dfbf04cac393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552836, "uuid": "daa93494-c669-443f-8d06-8fa7ffdb1f6b", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02f49aa-e935-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767507751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507751, "uuid": "263cffe7-cadb-4091-8932-6360a09ddf45", "comment": "Malware payload (Mirai)", "value": "f8b092901deb4110a0d7ff450266f01e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507751, "uuid": "5032b0cc-a692-4560-a4f6-f07df1999f6b", "comment": "Malware payload (Mirai)", "value": "30c1fa4827381cc432b67aa1c1608170be61258bddd3a7fba2c66443e7ed88f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507751, "uuid": "3756bdcd-4223-4de5-9c27-80d962a270db", "comment": "Malware payload (Mirai)", "value": "617760e32f10ec505220a71d1f990b198026fd20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507751, "uuid": "964df7e9-67b6-4954-b055-a30717fa346a", "comment": "Malware payload (Mirai)", "value": "e92a97ece6cd06699d9a190dfd754bc820493649cca6f3c1718d7d078876783bfa95272feb035ede1bd3e9f094fe1790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507751, "uuid": "9d206e38-02ce-4f6a-a749-2c45c5dc5d5f", "value": "T19DC30855FC819B15D5C526BEFE4E528A33131BACE3EE7213DE145F2427CAA1B0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507751, "uuid": "e795143c-c2a5-4a9b-8e8a-7c22f0f1b9bd", "value": "3072:4yPwmthnU2wzeT9NTQtY/3I97aeSyuYYfvjWYASpHMJ:4awmthU2wzeJ5QtY/O7aeSyuYYHjqShG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507751, "uuid": "5acc31a6-0d60-467b-a1f7-4a88d9a37d9f", "value": 120400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507751, "uuid": "0dcbe821-f0ef-42b5-a62c-05c6b6e83d57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507751, "uuid": "bc6e4704-d928-471e-8e8f-7a67ec449748", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5b954a-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509518, "uuid": "d10b61f2-1ce7-4392-9710-e1c2943b42d9", "comment": "Malware payload (CoinMiner)", "value": "c50bf3667c6ed0c13ba10fc0d44e4da1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509518, "uuid": "e6a1a888-d88c-49f7-8b24-9e2a62c85147", "comment": "Malware payload (CoinMiner)", "value": "311709e4f1fb850427af36f44648c228763f9fde6df5d9c315e39cd1ae8570e7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509518, "uuid": "0637228c-0fc5-4d8b-8f0b-42315d0caf9f", "comment": "Malware payload (CoinMiner)", "value": "f13267c7c1cdd1ccdda784fb02fffdae6da1ec16", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509518, "uuid": "c3f1bcca-9d2d-443b-8139-811867b51fc0", "comment": "Malware payload (CoinMiner)", "value": "3f1c712f3b1b94c4a619ab5b84e80c3c8845e1a811a22a816f0a59c5add78b9435223733ffb5c18fc9de01f32df24692", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509518, "uuid": "465a76cf-803d-40f8-ac31-8da721449e8f", "value": "T12BE5335101C3FDBE9499D8D418FCBF360E6B11F0A7685522FE7A0425BC26EE640AB61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509518, "uuid": "64525ce4-f755-4774-8c3c-e54d516d609d", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9D:G3LG658+S8YrCpHy2dUu4KrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509518, "uuid": "c603afa6-cdba-4314-920e-cfec9f2d4010", "value": 3076096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509518, "uuid": "a49f47a9-a110-4c2f-a860-522d199e3665", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509518, "uuid": "95239677-b2f7-4947-b00d-008884765591", "value": "311709e4f1fb850427af36f44648c228763f9fde6df5d9c315e39cd1ae8570e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923efe13-e93b-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767510251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510251, "uuid": "118e5491-e426-489e-9096-405a895c9a7d", "comment": "Malware payload (Gafgyt)", "value": "d84280cdba7dcd1f4e8162d94cb74f7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510251, "uuid": "732433bc-2e05-4d23-83e4-ebfbe7dd3bd9", "comment": "Malware payload (Gafgyt)", "value": "31c9e46df74fa306564967c80cf057bc28b282436ff68a5516c1652619081644", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510251, "uuid": "51904913-f190-4b1f-a7ed-23d7fcafa092", "comment": "Malware payload (Gafgyt)", "value": "e0f664a6f06a271ef16eefd78d80d7a34fa3b1ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510251, "uuid": "cf751091-ef54-4efa-98c2-69b42c660fbf", "comment": "Malware payload (Gafgyt)", "value": "f0528302523bdda6e7726bb6d5ee16944d2b06d126147b364293480ab3f1e0881dba6867ae3ab0578a4d8ce69cec5df1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510251, "uuid": "c2fd5993-9529-40fe-a9fb-f8bffc6f31c7", "value": "T16F2229C433C202F726E56B4661B3837C5E4482E36163EFBBE57864B29BB0D4860DDB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510251, "uuid": "4442c40b-97d8-47a1-8b78-a8f823418ce4", "value": "96:hiOfWVc1dZd4cjzlZ16EMvyK6tTVRei0E3abaOfORMnS5gf2NUeeCEcg2Ro+4z:hs9W7I1vVYTSPDCnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510251, "uuid": "05f3313c-ffa3-45de-926e-27fb9b687e5b", "value": 10876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510251, "uuid": "bd11ab8d-bc5b-426b-af32-591dd94d6a2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510251, "uuid": "de0c770d-1d32-4d6b-8156-984e3c6cd9bc", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b20bb88-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567174, "uuid": "3c08c2da-9dc1-4b33-8f32-e98927219e20", "comment": "Malware payload (Mirai)", "value": "6203cdd409f4a9fa9388398f157925e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567174, "uuid": "0669ed9e-2d0d-45d3-8b19-2e5d934aa550", "comment": "Malware payload (Mirai)", "value": "3228ed22260ebc4f08373345d6de26fac14c116162ad6d74ac6f0a42aeefcff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567174, "uuid": "0aec8d5a-58e6-40fe-850f-031c3334a180", "comment": "Malware payload (Mirai)", "value": "91d66d2bc7e30a4ccf80ec6ac4d8229470c3a724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567174, "uuid": "a8c42dc6-4272-4c16-8e4f-63944d5e178b", "comment": "Malware payload (Mirai)", "value": "8da128da8a8b4449c98542a4e432dd52aae41ee52bac374bb9f388c4a4acb571f9abae2b712bdf47a1b2d0f177e9a533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567174, "uuid": "7f6fbfb1-e021-4b6e-bba8-e654b0e9c0a3", "value": "T15FA2D025E345AEF4DFEF9DA457C2C2C276E587C62786C8E240EEAF016506052FB88C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567174, "uuid": "1778130b-9a07-48df-9855-861d1ffca141", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5nQrM4uVcqgw05VxJi:9RxsSVsMD6xiJJE5zRWNZQY4uVcqgw0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567174, "uuid": "c8638c6f-7de7-4041-b383-38951d1c97b7", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567174, "uuid": "bd1676eb-a8c4-4073-801b-83c0dda278c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567174, "uuid": "1e9f08c3-70ae-41f4-97b6-c85cab6a854a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5503498-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513343, "uuid": "cfbaee8c-fcbc-4331-912f-32bb3bef62dd", "comment": "Malware payload (WannaCry)", "value": "118a00602d4451aa5cae47c9ab556b69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513343, "uuid": "a6e972dd-48e3-47cf-8256-14713a3f0e11", "comment": "Malware payload (WannaCry)", "value": "325dd2f83ca168f3c477b2e14c7975e8ebb56a121e5e161d0f93a6c94dcd860b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513343, "uuid": "577fae55-eb7f-4dc3-b363-536183f1905d", "comment": "Malware payload (WannaCry)", "value": "2437b8b5c1d48022674813c8bb0585607a883937", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513343, "uuid": "0dc9b5a3-b995-46c3-a175-22090c383cc2", "comment": "Malware payload (WannaCry)", "value": "352d8f186a897377d7207d6bfa07088ba96d2a1a7c602a93d74bb3a048ebee0eeb54e433fa1cb91ba309ea6e986088a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513343, "uuid": "eb59d2c8-ea9a-489d-a6ef-0ddd75fb33ec", "value": "T16F36239571BC91FCC20918B4947B8626B2B33C6E22FE5A0FDB808A261D13F55F790B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513343, "uuid": "d55b0841-69a0-43b2-9071-429c20474627", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513343, "uuid": "d7a02e0b-5e2f-4cb7-b94a-c8c32325c892", "value": "49152:RnnMSPbcBVQejq7SqTdX1HkQo6SAARdhnv:1nPoBh+7SUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513343, "uuid": "18b4bfdd-d162-4696-88f2-f91603b90114", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513343, "uuid": "fd515158-0138-44dc-8114-a9f1e6da2897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513343, "uuid": "b7043c10-40c8-4956-a7e0-85f3b28b45c1", "value": "325dd2f83ca168f3c477b2e14c7975e8ebb56a121e5e161d0f93a6c94dcd860b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7d23dd-e944-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767514108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514108, "uuid": "71cd8e47-e828-46dd-a761-972aa53b1821", "comment": "Malware payload (Mirai)", "value": "2ce92c91c2d338fe6e87a8a5ccf8767d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514108, "uuid": "67707e5e-b2c8-44db-994d-60cc34c023f6", "comment": "Malware payload (Mirai)", "value": "337335f4ff7923e2f2bb12ab7f354e255a25f510f5ee25efca7d81bc2cc92e15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514108, "uuid": "d9d64c47-b707-483a-8de2-dbb6a4ed087d", "comment": "Malware payload (Mirai)", "value": "f8bfd37a02c382ab557d091b5443e99fa0c4b795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514108, "uuid": "0c8d4421-fdda-4d43-badd-92d5c09738c6", "comment": "Malware payload (Mirai)", "value": "42ad05534fe82bd17ab44ea3bc34352b9e99113e9e68d0c823f63d68bd92b7ede568c587f05c0e8b4dc2ae2c284968a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514108, "uuid": "acc24a38-a516-4cc3-bc2a-1fb296f133bf", "value": "T191430262DCF1CC19F4A606BB0535FEC1D0C3D4AF5AA84876BB5038D01AE89B47622BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514108, "uuid": "b6d63d24-aa5b-4bbb-913f-1335e06684fd", "value": "1536:SUaADD5K5ZZwFQesZBE+a3MrucFjZSPOvdoCQd4oZGclNWcE3Unouy8Hy6:7tlK5Zi/sFCLQjZSPOvdoCQq6NW/3koW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767514108, "uuid": "dc425f3c-ff13-4223-abe6-3dbe1a269f75", "value": 59972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767514108, "uuid": "b794f22e-5ae3-447c-a9f2-47490e50f541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514108, "uuid": "361fcd41-c85b-4402-bd39-fe4e6e3110a6", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a751941-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513083, "uuid": "3fbe405c-8cb4-4b13-ae63-44b248d4401e", "comment": "Malware payload (WannaCry)", "value": "0f30b5a88e8cbc5f70b64e8527af9b69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513083, "uuid": "53548bea-7543-4286-ba2b-def324aa8adb", "comment": "Malware payload (WannaCry)", "value": "33863161f269a2542bbfcff8747bb9de1f35591addf6a5846d0829b8fe5dc31c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513083, "uuid": "8019e12e-66d2-467e-b14e-681ade81a48c", "comment": "Malware payload (WannaCry)", "value": "36ae904326cfdae71632d420b25ddbd9ccee275e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513083, "uuid": "c2108a40-5f14-4b54-b0de-12e4725ca91b", "comment": "Malware payload (WannaCry)", "value": "2f7d7978daae13eb725100ea8216b65299205a2d24873d54215a502001152620749918e5bfb48c501f73a6cb7c5ca62e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513083, "uuid": "5468db59-ec7b-4eb0-81b7-01994fb3c617", "value": "T1F43623A971BC91FCD20519B444EBCE22E2B27C6926FE6E0F9F4089761D03B59B750A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513083, "uuid": "81fbc0a6-11e0-46f1-8dc3-8d583d96fa22", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513083, "uuid": "b6be2e5d-ac12-46ce-a24a-89b3bbabcbd6", "value": "49152:znW1MSPbcBVQej/1INRx+TSqTdX1HkQo6SAYhnv:TcPoBhz1aRxcSUDk36SAYhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513083, "uuid": "b4638a3c-b041-4858-b9b8-7190fcb2b332", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513083, "uuid": "3923b25e-fb0d-4a8f-8127-fedb05855b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513083, "uuid": "b5678ff0-54aa-4770-88ac-6d7371cdc815", "value": "33863161f269a2542bbfcff8747bb9de1f35591addf6a5846d0829b8fe5dc31c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016dd660-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512155, "uuid": "162bae17-c22e-4660-a6a6-59b55163c540", "comment": "Malware payload (WannaCry)", "value": "f8df85d2d4469d4ce53c2d626ad67973", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512155, "uuid": "fcd9e91a-6e38-4c3a-a104-bd22b1048a8d", "comment": "Malware payload (WannaCry)", "value": "338f6c116a0e5047efa5c5c7dbd579887c1ae081e4d1f0f3f5c4bc742d8f18f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512155, "uuid": "fc3ab8c4-36c7-4ce1-93e2-c03bab99b4db", "comment": "Malware payload (WannaCry)", "value": "1677d9686c93f1ab38d91bdab607a0db9aa40a00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512155, "uuid": "bd65ff96-04c1-4e03-b743-cbc1c8c77d12", "comment": "Malware payload (WannaCry)", "value": "7140b3e55843fcf241c11c83b4b62b5ac609b7b00f01512be4befbcb3dd539e1767aba92012ee8126dc18f6b662dc862", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512155, "uuid": "213ae731-1727-47cf-84b8-1473212a1fdd", "value": "T11B363358652DA1BCF0440DB444A3899AB7BB3C6777FB5E1FCB8086660C43B5FABC0A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512155, "uuid": "f524795c-a55a-4ebf-a1b1-6ec1575b0f9e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512155, "uuid": "0d99197e-3e4d-4e1e-89cc-281353fc9916", "value": "98304:88qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hi:88qPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512155, "uuid": "5fabe224-a708-4987-9af6-50f829c5d5d7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512155, "uuid": "05534430-5358-4621-ade0-8ea2f5dbbef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512155, "uuid": "aea3caf7-22f2-4776-add2-6a14c72e90dd", "value": "338f6c116a0e5047efa5c5c7dbd579887c1ae081e4d1f0f3f5c4bc742d8f18f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2904262-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517687, "uuid": "96ba0784-dbeb-4472-8b6f-51d9e259dfb4", "comment": "Malware payload (Mirai)", "value": "c9c591126ac90750ed8c9acf161c451c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517687, "uuid": "f3c33bee-c56b-463b-8920-31ff5425f8b0", "comment": "Malware payload (Mirai)", "value": "33c330c36e830ddb47498d0480c5fc4d4a0ac11e4c2f1ba541a128addfcf1b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517687, "uuid": "c5d04f1b-d489-4129-b4a0-28860bbc7a89", "comment": "Malware payload (Mirai)", "value": "e602767a0b31119a2479e6f1acffd46133a3a063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517687, "uuid": "87822948-eb96-4094-8aae-d78535ed38b9", "comment": "Malware payload (Mirai)", "value": "44735eec80ed918e130cba93e5f8a8f660fab33a224b7a5dd447ee6bcf8ba299ca77c30b07b67da373077ae30dba7dc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517687, "uuid": "1aec7111-ea65-40e4-8e2a-f822b1082683", "value": "T1B8A3E6C6BB43DFB3E85321F156B75B218A32FC3A5C36D681D375BCA09A511D0A61A338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517687, "uuid": "e2cdb3d5-1cef-4965-b6d0-e9f289e0c0a9", "value": "1536:H57uQ0ieU2Nyf+ntq30o/3bJotru4YfSjowSyQPl8z:oLjtq3f3Ikajfkl8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517687, "uuid": "8f1811b2-ee04-426f-884a-59021cf31511", "value": 102012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517687, "uuid": "cf962137-d370-4871-be3d-ba80bad4ea5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517687, "uuid": "95020d70-d9ee-46b7-8fd9-4175b5a81cc5", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabbdb21-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767512091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512091, "uuid": "144d142e-16c1-4dc5-87e6-24a59efe234b", "comment": "Malware payload", "value": "41786bfc19e5bffd9396aa01e035a8c2", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512091, "uuid": "833e1288-42de-4ada-b057-e9f8fa6cd3f2", "comment": "Malware payload", "value": "344eded2d626ad7940a011da355615fcfa98e82c894eeef087b8a4391801614d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512091, "uuid": "beacff3c-0bf8-4744-b7c7-e939f00b01a0", "comment": "Malware payload", "value": "71d8cd51bece469154293582f66c54ef6b90eb26", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512091, "uuid": "32d161a1-7556-4a21-aaad-895a8b199661", "comment": "Malware payload", "value": "6de033527d631b147dcd92b606568381934acb6a7d354df90a4ba231ec8f68deff2b3a9a15b847691be035a20d5f9a22", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512091, "uuid": "4782e8b3-2fa9-4bf5-87a5-1341e3ec2496", "value": "T1C8187D13B3A704D5E8FBDA7096E652236932BC066F3095DF324C07262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512091, "uuid": "78bc18c8-a41a-4dd0-aa5c-e0feb162e105", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512091, "uuid": "6f9431a4-3dd5-416d-9244-f0b4da65cf22", "value": "786432:SxTmK5YAUm/fAQ6YeuJzrLLmpgPVlcmw:SxTmKzUm/fmGzrLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512091, "uuid": "0e124e66-667b-4ded-86ea-3ff804d6025e", "value": 89335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512091, "uuid": "2da87825-ecec-478a-8414-9cc146177737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512091, "uuid": "06d8b608-05db-4943-9fab-6bf1fdd9460c", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b798e84-e99b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767551418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551418, "uuid": "5d8a2bdf-45a7-4089-a5f1-eab18890a683", "comment": "Malware payload (Mirai)", "value": "328f2f5bfe4dd5bc166a19b32ee4bd25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551418, "uuid": "181eb29b-acbb-420a-b726-04e3496056d5", "comment": "Malware payload (Mirai)", "value": "34b5d334a98638da96d3365e9c2860efb118af76439788bf1fc0f258451e68b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551418, "uuid": "82439d21-3ac6-448a-b76d-2013cdb989c7", "comment": "Malware payload (Mirai)", "value": "4d5e11a13714259eac4a76c9c835a880a4688536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767551418, "uuid": "9f878c7a-fd14-44be-a141-fd8f2560dfe4", "comment": "Malware payload (Mirai)", "value": "395ed6d6c9c09383627acef263ab156b73e8c3ccc689fa1530c0a6574b43a63ec21c5b6ffa9cc61d08ad031367b647c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767551418, "uuid": "450fe188-54f2-43eb-a8a8-1d4c3eab870f", "value": "T19A83029F9EB6CE66DED0B37CBB206AFF5910D4341F47B754C11C9A28AAC600905643AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767551418, "uuid": "5e13fd70-6ab3-4564-b948-82250d91f6fa", "value": "1536:gWyYGOeOtt0wX1Ne/15sBWframT7PuT1zNXw14WL5iYzdx+oOL:jeQ0A1Ne/15sBr4uT1zq1nL5i4dUoOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767551418, "uuid": "3388865e-29fb-4f0d-9504-71704ca9b469", "value": 84716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767551418, "uuid": "16638ec8-b0d4-4e60-93b5-a2b7939bd723", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767551418, "uuid": "9f49a0c8-6e8e-413a-89bf-0fe543be8dba", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429b18b6-e98e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767545766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545766, "uuid": "15679067-1bf7-409f-82e9-e84bb556251e", "comment": "Malware payload (AsyncRAT)", "value": "851875436409cbd212d7361c6f98ea2e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545766, "uuid": "aeba9201-c2f5-4fce-9ec5-e51679ca09d2", "comment": "Malware payload (AsyncRAT)", "value": "34cf1f43587e6a9673ba90c0bb5d9b449607d6396a59035fd925b6b67fe6a530", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545766, "uuid": "b2364b77-8698-49f3-8b6d-eb9be082e257", "comment": "Malware payload (AsyncRAT)", "value": "f79ca6ad139cc03470aeafd4f01fd40dfde316c2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545766, "uuid": "97ff0336-fe4d-4105-97e0-68a98d7497d8", "comment": "Malware payload (AsyncRAT)", "value": "ff54aa647e3dfd2557efbaff66159e2c11f2be2fad18d6c27c1f9a2e91d49db77191caba8b60e6288e6f9a2893f503d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545766, "uuid": "f8b472da-4057-452e-aca6-60157eb8c5c8", "value": "T1CF232A003BE98127F2BE5B789DF26141867AF6673603D68D1CC4119B5713FC29A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545766, "uuid": "e0ced690-cf93-44c9-a911-174e410bafa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545766, "uuid": "5c200e2d-b72b-4666-9eba-09a78cdb3441", "value": "768:cuKo9TH4EjZWUR/ejmo2qrGozfy3CKPI0BjbegX3isfsNnmTLPYi6E9BDZ8+:cuKo9THfe2oTR0RbhXSqkmfPYkd8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545766, "uuid": "6de87fd3-cfae-4029-ba29-c9bacaf3fd6f", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545766, "uuid": "c508072d-675c-46ef-8fe6-d0bf2e59dd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545766, "uuid": "b1f69e1f-13ab-421b-ba1f-9dfb51c92128", "value": "789club.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a8a75b-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767554897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554897, "uuid": "3e6771cf-cb4d-464a-9913-a66ec5575797", "comment": "Malware payload (Mirai)", "value": "a19ddffa63df618c179c56a01db567ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554897, "uuid": "6fc8cf8d-903a-4962-8420-67b1d066032e", "comment": "Malware payload (Mirai)", "value": "351577744a562542273fde92eb54260b512d3f5357f3d77d92625995ca90b643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554897, "uuid": "1d484feb-c6e0-4b69-9bee-dd6c27490d28", "comment": "Malware payload (Mirai)", "value": "4a1a9ede17051043aacd93ac30502028f0441410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554897, "uuid": "b5415178-06f4-4453-90cb-ba3c7eb7e4ea", "comment": "Malware payload (Mirai)", "value": "4a983649cd31d14624380cb7eb128d5697bd91ed1612ce2a73998651195d8d2e3923042b4b5d8af421fa6fc3c251b46e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554897, "uuid": "0142ff0a-b947-4519-87fe-1cb7aad3669b", "value": "T1F224085DE4908B3AC7C1257AFA55428E33734F24EFEA731989345B343BE66295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554897, "uuid": "37fce5b8-eb8f-440f-afa7-608ea2b05df7", "value": "6144:DmOH8mqcmIQ8MdwMV5+Oe3HMCuuX86zE0:DcmqHQMVIzT/zE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554897, "uuid": "1dc26ae0-c8d1-42e7-9b91-98143985ae87", "value": 213892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554897, "uuid": "ae309fb0-31ff-4655-952e-c06c9629aec7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554897, "uuid": "86100771-1640-4e12-9832-325a810271cf", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46273c44-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511412, "uuid": "27b79912-a150-46df-bd6c-6fac4689ca70", "comment": "Malware payload (WannaCry)", "value": "c7308b70006a7c320238c826db65d016", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511412, "uuid": "30c35554-fc17-4722-a0df-8cf95c436223", "comment": "Malware payload (WannaCry)", "value": "3541c06a59aa97945e87baf208fccc4ac1fbdbe24267f874ee14d1dd91e70f57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511412, "uuid": "b8e8a802-2d3b-4697-a85d-9ff95ff5f487", "comment": "Malware payload (WannaCry)", "value": "aa12917d710ad7c93d1ea132720aae60bb0e238d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511412, "uuid": "93fe631f-eac2-48e1-88c6-c6d454529bd2", "comment": "Malware payload (WannaCry)", "value": "036368c430f1a1a63f3aad8a9cb0ce988cba8a6cfa994463c1989c015067ca3372915a6d4e64b8e404faf46bde04b50b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511412, "uuid": "46a6256a-ecc6-4fd6-8a4e-2ba173887061", "value": "T13A36339571BC91FCC20919F454AB8A12B3B27C7A21FF5A0FDB508A651D03B55FBA0B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511412, "uuid": "5cf6e161-0f05-43f5-a5cf-11fc9ebb5207", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511412, "uuid": "0658a76d-c0da-4c49-ac87-6a52e6f8d8b4", "value": "49152:RnsEMSPbcBVQejl+TSqTdX1HkQo6SAARdhnv:1fPoBhBcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511412, "uuid": "568e6c26-1ff0-4451-b96c-141002ff8f8f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511412, "uuid": "c4de5e4e-853e-493d-8eb9-cf9ab4d8f020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511412, "uuid": "ceb096f8-0698-4e51-8867-05c1446758b7", "value": "3541c06a59aa97945e87baf208fccc4ac1fbdbe24267f874ee14d1dd91e70f57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3596c54d-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555193, "uuid": "f5cc241d-eb72-489b-aa6f-24029683864a", "comment": "Malware payload (Mirai)", "value": "a1b764028cd34b4c334e506d8f0cb922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555193, "uuid": "4a5bf433-a14e-4543-97e5-5a14d2648642", "comment": "Malware payload (Mirai)", "value": "35ff49f44bf7f505b5cef4dc4088e0019e31bfb89a1f632db1b14620a5b54027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555193, "uuid": "b0d78063-d998-49c9-8116-0caf6df1655d", "comment": "Malware payload (Mirai)", "value": "ff25ec2f2a63622e7e819a61a6abe4c34bab2562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555193, "uuid": "fa2cfca0-01f4-4890-b497-ea6c7b747815", "comment": "Malware payload (Mirai)", "value": "8d42ab977a9d47b06c76931d02e4ea5eef935346006dfa6748c0f07f393e1b20439db0acd42a4e1fc38fde15035e6ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555193, "uuid": "e81433af-002c-4ee1-b2c1-9ca33ebbc650", "value": "T186C31221DDC884EFC9EE2B27552257F0DF98092AA6020B3A50A62B77575D8CC14FF3C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555193, "uuid": "dbd9b012-7fd0-4b6f-a356-697fa49f6916", "value": "3072:6PfKH8ZV8gRpoUwg0StzAY7a9nSk2zbJ6/VQd1c31flQlstQh:MD8gxL7nMSHzd6duEWlJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555193, "uuid": "10812488-147e-4378-b22a-eeaca377bf08", "value": 122956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555193, "uuid": "dbdf92fb-9fed-4ce8-920f-91d7a6701446", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555193, "uuid": "240ad795-20b6-46fa-b512-dac766dd65fc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d810854c-e98b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767544728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544728, "uuid": "83593fae-82dc-4c6d-98e1-b29a0200b794", "comment": "Malware payload", "value": "73b51213a03b9523b4dd9a34a7cd4212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544728, "uuid": "e139c0a2-d637-4435-ab77-05977f0e46d4", "comment": "Malware payload", "value": "36d639435272843330242dc7da60bc219994155ab8dc98d047d6afad9d0070df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544728, "uuid": "7bc1cf2f-9398-44e4-846a-cdf7a993534d", "comment": "Malware payload", "value": "be2e2a7c50ec8eddb5d70c36e5dab3560f1099c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544728, "uuid": "f11f05bd-bd63-443f-8399-4ba737c89576", "comment": "Malware payload", "value": "9df0c3a43f88c6155197c4a1b1ddc4bb02d0f77dd1a7801d0e4f1a5d826371bf052eea02a323e55f3478669b7ccaaf13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544728, "uuid": "3677b2b2-032c-4660-8a21-4476ca3ebcb2", "value": "T114373395BE8654B4E4D2BA7BD873CA06B53538E10BB05BAB572802203F6B4F44D37787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544728, "uuid": "97de814a-6d87-4061-a2d3-15d3b3575468", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544728, "uuid": "71de7a1c-4cff-4fed-a3f5-147c8ebe3699", "value": "393216:KAyubcsbAemqS/6BG95lMGi8yIMv7as8ksY6rbBXLdQsMFIurQwmONJ/plInC6y:KAyBl/mG95iTZaDHbBXLdO6bwlJBl+Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767544728, "uuid": "74d16a91-00a3-4ab4-822a-335e404a4990", "value": 22472819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767544728, "uuid": "d8cb15ea-d190-472d-999e-571db128d6b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544728, "uuid": "54826b3c-266e-4220-bc6c-8db76b99e011", "value": "Mahmut.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a95d642-e9c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767570207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767570207, "uuid": "fd77ee97-4baa-4baa-b51c-4598f9149570", "comment": "Malware payload (Mirai)", "value": "d4de9355eecf9a6217ada620cc77a3f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767570207, "uuid": "9685301c-940a-43dd-8756-38c25c315a76", "comment": "Malware payload (Mirai)", "value": "3746572bdaa051c3241dd4f49d6a5c9ea1a52a051685b88e5b26d118634a80c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767570207, "uuid": "0075acb7-1483-4491-aa60-32f587b6cd07", "comment": "Malware payload (Mirai)", "value": "a2038c03780400450d15287706458ce165cab384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767570207, "uuid": "8a71e810-5f45-4c2d-87aa-e14cfbba1375", "comment": "Malware payload (Mirai)", "value": "c5494b43f6ec377f3928e25876698702c5e90ab5859e42311c2edfbb252c629d1c5cdba17e9d45a7be74756d39b63649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767570207, "uuid": "b783bc43-128a-44e9-8cda-b5ed1bd47c32", "value": "T1CDB38BABF2470261C86206F007CBBFED3E2722C15F1785E73D69257968791CB9906F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767570207, "uuid": "6d42dd91-2ecb-4dcb-ac11-495df3458416", "value": "1536:T/nUmKI775QwSplVog4DTTtK6hWJgIW/LWb:TfdKI7Gwy7opTtK6hWJgIWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767570207, "uuid": "475aa196-fa1b-4625-88f6-2ddc6144c944", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767570207, "uuid": "4d6170c7-cc8c-4931-b416-b6b5bfd581ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767570207, "uuid": "9b0d478d-635a-4337-bcb1-04ec02be8ef3", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75f2847-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511682, "uuid": "458f5b89-749e-41bd-bd38-54fa2cdbd3a9", "comment": "Malware payload (WannaCry)", "value": "c2b3f51728001fbaaa5a73fcaf3e1a68", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511682, "uuid": "af976d62-e04b-4e26-8619-46cb76ccee8e", "comment": "Malware payload (WannaCry)", "value": "379cf4fce883e5853294990f94c082eb971db7b0e3a817f7abd4facffc4fe23f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511682, "uuid": "b6121a2a-9b9a-437d-aa13-6457c4903530", "comment": "Malware payload (WannaCry)", "value": "38b9d3880194558f17b9fa03b22d43b66691b82a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511682, "uuid": "087c2381-9994-4ea8-98ac-5a0fbb9c7b15", "comment": "Malware payload (WannaCry)", "value": "ea0f7d39164013b5511025a569b59521cd1b3be05dfc87bf57d5d8d36a553599a2cd10da0d0df16b17070437e7cde888", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511682, "uuid": "cf5d9c29-0960-4602-8514-0e55c4eccf43", "value": "T1B9363394723CA2BCE1450DB404738A2AB7B73C6566FE5F1F9780466A0D03B5BBBD0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511682, "uuid": "fc3cbf81-3ee7-46c5-926a-0379fe36c13f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511682, "uuid": "0008cc98-c0f1-47e1-8d44-efa9a909a6a9", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVb:d8qPe1Cxcxk3ZAEUadzR8ycb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511682, "uuid": "f8f95aa8-19a4-4dcf-bb80-5d4153d49cac", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511682, "uuid": "8fbf09af-b0f2-424e-a027-a1e6d963fa43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511682, "uuid": "0e38b1f8-888f-4a6a-9952-439445ef2767", "value": "379cf4fce883e5853294990f94c082eb971db7b0e3a817f7abd4facffc4fe23f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733a3a0a-e9ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767564745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564745, "uuid": "73f869f9-3414-4d21-866b-a6be966898ed", "comment": "Malware payload (Mirai)", "value": "b7e68676a75d54258a74df6e4f5a9bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564745, "uuid": "0957fe53-9efd-47d9-b458-d7017eab0d38", "comment": "Malware payload (Mirai)", "value": "3869c617d5cbbbcd9ac9eba7af569cb557a03cba0fdceed432fc113b6c8a321d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564745, "uuid": "b6863230-f31e-44c9-89de-9becf56047cc", "comment": "Malware payload (Mirai)", "value": "37e437f93cacd71941285313681b1325e8cabfeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564745, "uuid": "49dd02d7-9d7e-49ee-8a75-f8d86de49bd4", "comment": "Malware payload (Mirai)", "value": "63933b3b7698a01af8bb2e4d410326e4fe129bff881f71a5b86eae533fbbd6e7d53a44237a257e0747612856f87775a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564745, "uuid": "d06db916-847c-4217-ac45-c9b3e830b0c7", "value": "T1E123F15C932FA554DF85097CE2E82AC0AA0D87BCD0BF7B529940CA8CDDD24C727E5293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564745, "uuid": "3d9c6938-e75d-402a-bef2-762974f70de7", "value": "768:MTJNek6TqX0U+583BiMo+rAxYn2yP0RboSG9q3UELM8uNXCE1lWEf799hYVF9s6V:MTnek6OX0Uu80KN58mSrLSx9TEm6isnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767564745, "uuid": "74ed0ec9-c4e3-4800-a836-e0a5df163c5a", "value": 47308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767564745, "uuid": "9e271999-0e60-4a97-adf7-b17cb72d00d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564745, "uuid": "b47a84c0-79dc-4a5f-9963-de5fe92641cf", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbe7dc9-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513247, "uuid": "4f043147-db7c-459b-84d9-b2c9a3cc508d", "comment": "Malware payload (WannaCry)", "value": "cc26e5c41e6c3df0e9a056b6c3606401", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513247, "uuid": "5f0c8b51-1492-48e6-b110-94c2b756774f", "comment": "Malware payload (WannaCry)", "value": "388e07de03486681fc310b7a052a2836d772c3adda6c6d92902753feffc8d98d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513247, "uuid": "2dd7ab71-3e7e-4910-8330-f132bc0d04d2", "comment": "Malware payload (WannaCry)", "value": "bea0b451f33c3eb1a48921cc95e03d474dcbd6a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513247, "uuid": "daf03fbd-1f74-4b75-b54b-3776fadd976f", "comment": "Malware payload (WannaCry)", "value": "634bdca348a5452570a76c11c0ef62f4ea327a31edca4e62d164a1966f3a605712e7898987c8defacd58d26b8146d652", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513247, "uuid": "682ef586-42b0-4297-85b4-b6f0c20896e3", "value": "T135360204D6E427A4E1F20AF615FADB12A635BE47A556CE1E0262020E1C73F19DDE2F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513247, "uuid": "49818ae7-2136-43da-a0b3-eae70b6745ab", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513247, "uuid": "9352045c-cd23-4f10-92af-0176052afa48", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P8ByAVp2H:+DqPe1Cxcxk3ZAEUadMyc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513247, "uuid": "37ea413a-234e-4edd-997a-94b5e4894870", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513247, "uuid": "28b08156-6724-40c1-92af-5bab9f367a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513247, "uuid": "df6bb0e0-2d6d-4c16-9ff3-84165a889edc", "value": "388e07de03486681fc310b7a052a2836d772c3adda6c6d92902753feffc8d98d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a20e3ac-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555683, "uuid": "25c49bb3-d8d8-4954-b9a2-05db84c74193", "comment": "Malware payload (Mirai)", "value": "f508357603b3b20dbeaaa41f5f40a0c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555683, "uuid": "67e0b836-7508-4c2d-8de4-35d9fa73b1e3", "comment": "Malware payload (Mirai)", "value": "38ab7721fdd10d6d940485e35d4860a9534f6f9e54de254570bf039198f5f740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555683, "uuid": "0132924e-8e0e-473f-ba01-7a0b3c906d39", "comment": "Malware payload (Mirai)", "value": "8970f4cacdab9390713873397754c8533eee2dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555683, "uuid": "158f0650-f2ce-4634-b586-bf78019b7ccb", "comment": "Malware payload (Mirai)", "value": "d586edace5f4c6c33d0b7a9050a803ba50c8ca6d9442b32c9a9563a8349f24e5538e7bb96cd27b5e2ffa34db63c68ba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555683, "uuid": "83fab7ee-11da-4e84-963f-7290a39ff485", "value": "T138147C63D9669FD6C16294F0B3F29E385B42BC1549171EBAA8A3DAE54043EDCF1183F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555683, "uuid": "57e011eb-8709-4c85-82a2-9f32e3f90548", "value": "3072:eakgdz/h4rz+ADJRTELASFUOubJx81r0QW1gg7CKXdb:eanz/yrNDEL1COubJyG51jXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555683, "uuid": "de5ad9a6-1d04-4ecc-9364-a4fefb7b25a0", "value": 205984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555683, "uuid": "6b81d8cb-b8e6-4e4a-ad12-83ca15aa65b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555683, "uuid": "b0e90f2d-a9a3-46bc-9520-459a7ca380ab", "value": ".4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dde1904-e94b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516901, "uuid": "35655299-5fb3-435d-abe9-ae1b9314eded", "comment": "Malware payload (Mirai)", "value": "10c9701681e16518ebbc5ef6fd59510e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516901, "uuid": "6a598d59-ceec-4fa8-a5a9-6f53bf476c00", "comment": "Malware payload (Mirai)", "value": "391d3a19f8d42542ec2aacd4a70deeed0150264999f09482ae32e68d7a0cd242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516901, "uuid": "609cd71b-e73a-47da-aa68-2914ed5577b5", "comment": "Malware payload (Mirai)", "value": "c027c024d16eea105e1bf7dbc077eff3c715c00e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516901, "uuid": "f63261cd-a176-438b-b06d-91f289613598", "comment": "Malware payload (Mirai)", "value": "34ff44c2b57197d3aef2b8348dc02d35c1d49576ef9c0197307455db86b5dda4ad0eee652a5a23cd07f8b9bafce055d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516901, "uuid": "209d421f-b951-4543-809b-070170a71889", "value": "T10F031ADBB8059D3CF85FDA9E9413490DF631275150930F2A67ABFDE36C311A89D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516901, "uuid": "a496bbf1-cee7-427c-9469-40e401fd39f4", "value": "768:1ne3hoZSQh6a5fZYNCYnLIuzV7ajhJ0m+w9w/S3U5:1uecQ8SYNTLIuzdaf0m+wK/SE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516901, "uuid": "20a0baa5-0760-4357-b133-8c1dff0e74b2", "value": 39604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516901, "uuid": "7a4473f5-402a-42a6-aab7-3fdbf3427cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516901, "uuid": "3ce2c00b-3028-4cf4-a08b-0cce441965e0", "value": "SupplySrvm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dce30f-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512537, "uuid": "7fefade8-279d-4825-99f3-23aea39548f7", "comment": "Malware payload (WannaCry)", "value": "6633a19602561d359e76a67a008d62e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512537, "uuid": "b3eacf6e-4505-48f8-9eaa-39d8f37a66a2", "comment": "Malware payload (WannaCry)", "value": "39bbc42fa1212dc1465776b1c0efaed775c063385a6e6fd9d06cda483558f393", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512537, "uuid": "c7683c2b-b573-46c2-91a4-261147e138bf", "comment": "Malware payload (WannaCry)", "value": "d823708efa36c4fc6f8ec99dfa8a9741f0205de4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512537, "uuid": "2e70cb14-94ce-4911-be1c-583ef982a669", "comment": "Malware payload (WannaCry)", "value": "77a2b2496177e02c56ff60533c23eadd96edd248b3fe6bcbc923681a08ee1c502d20d5fb3a7c768457df24a62fd0a25f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512537, "uuid": "12397c5f-6d41-424b-bee7-0506b11e2782", "value": "T103362319FD18D779D16A1AB000B34B2AB3A238DDC3AB295F875C59E10C873673BC295D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512537, "uuid": "bd4be981-46cc-4ebf-adf1-6b9a73f8e39d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512537, "uuid": "475e5939-30e4-4559-8b10-dd0e1359441d", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R:TDqPe1Cxcxk3ZAEUadzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512537, "uuid": "3c8d8678-e339-4ac8-a09f-76ec31908769", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512537, "uuid": "0cbe19c4-ef9f-476e-8988-c86cb413852f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512537, "uuid": "5c148c2e-7884-4019-b7ca-c604fe9f0ec6", "value": "39bbc42fa1212dc1465776b1c0efaed775c063385a6e6fd9d06cda483558f393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187f5630-e9b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767561586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561586, "uuid": "552e45f4-26ff-406e-aab4-c7821390972d", "comment": "Malware payload (Phorpiex)", "value": "e7e955ac85bc6cf49ce677d57d86f3b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561586, "uuid": "941003cb-1005-40b4-98ec-c9fbdc7d3ea9", "comment": "Malware payload (Phorpiex)", "value": "3a2dcd6c86a8b789c5f07eec531fd9a3d9268288d8cf47e9f324dacd55bb6cfc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561586, "uuid": "7921e7f0-19b4-4a96-89a1-74301ef72e60", "comment": "Malware payload (Phorpiex)", "value": "74fa14c2a751ec23c1ee0cce1f66f5225c24a1e0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561586, "uuid": "042512e2-ae33-454f-bb5d-f99fdd67c662", "comment": "Malware payload (Phorpiex)", "value": "c4679b21f97403d2b9b5005fb7cd3a8d3d43f96dccc3c6fa8270647369a7fab6cd36a8cbd904ef4acec6babe819db040", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561586, "uuid": "8ffffe3f-1a89-43aa-be5d-1da04faa4464", "value": "T1EC823C0BBC51413DE4C144F85236AA7E8DB958BA378169EBF3C045CD89785D2F83A91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561586, "uuid": "26a78d89-cc7c-4e86-9222-053a5a79a8b0", "value": "51c161c9913a4b650517329371c6046d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561586, "uuid": "0a79c8be-1afe-42c3-ab46-2af9221938aa", "value": "192:e7wioLPXbeng7GQxN/vy4zTP6DcVD5xYQEZeaymJr1KUSh+zwzwUSJxTopHB9ctv:t5X/NScT3D5xlE4ayou+slScpHB9cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561586, "uuid": "d896caf9-4414-4393-b462-0f2b8e53827c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561586, "uuid": "e5a17dbf-f735-44c0-a2dc-bb6afd3aa759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561586, "uuid": "f600c7ee-ed20-48c7-a6fe-8599792663a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236492f5-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509635, "uuid": "091739f0-0cf7-4b17-98e0-e09be8f08a88", "comment": "Malware payload (CoinMiner)", "value": "3919ebfbe191b0ebd90a605c3e2b2b1f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509635, "uuid": "c7cf5ed0-71f3-40e2-bb07-d6649e2a9c59", "comment": "Malware payload (CoinMiner)", "value": "3c1d7cc4c3664cfe1915437f2e160591795fb671cc8c6f592777155724c064c0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509635, "uuid": "895d6eff-0651-4b9d-978a-27e223c689e4", "comment": "Malware payload (CoinMiner)", "value": "ff807cfabe53e0dc1a4a79b34f0e94e7ce1622cf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509635, "uuid": "989ac228-2afe-473d-a91a-32b1bc1a3adf", "comment": "Malware payload (CoinMiner)", "value": "0ba5a28d0cb02685c7fe56743eaccaa39524657212578f49e1ab36e5d7b84e7c7d7a910fce39d1f5df210b1563209f15", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509635, "uuid": "ecd2f832-0039-4541-b6ae-edc4e1e651c4", "value": "T187B5335101C3FE7FA04DDAC098FCBB351E6B55F05B281A26AC5A085AB831FF941E791E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509635, "uuid": "5e06b075-426d-4e6e-9537-eac1ea517419", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3lm:G3LG658+S8YrCpHy2dUuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509635, "uuid": "6c618289-a535-41dc-966f-911aaa6225d5", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509635, "uuid": "ca43f8ec-9105-40ee-8302-2c9976bfd33a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509635, "uuid": "45498720-69d5-472d-8df8-dab06c87d770", "value": "3c1d7cc4c3664cfe1915437f2e160591795fb671cc8c6f592777155724c064c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2382717e-e96e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767531969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531969, "uuid": "58084d20-cb58-48ec-8daa-37a9d1ba5ba6", "comment": "Malware payload (Mirai)", "value": "5d434f0e5bece05a1a09c50373be508d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531969, "uuid": "f18538f7-4d92-4133-81a7-67475ab65aca", "comment": "Malware payload (Mirai)", "value": "3cb4d0bddde56a9af4064d7329331683aea36abba93982fae95b708cc3ee69f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531969, "uuid": "124b8632-05c5-4903-a07d-b71b7d5375b4", "comment": "Malware payload (Mirai)", "value": "eb77e5f7f3c92bab3fcc12262bcd38daffbddda1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531969, "uuid": "80019d05-25a4-44d9-944b-8abd213627d8", "comment": "Malware payload (Mirai)", "value": "4143d8362dba4aa0b3c4b1ae01145d89a1e9efc1c8f2f470944bd74348456e0cb30bf81480318099e5a5f2c5e13ffe7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531969, "uuid": "e29cb41e-94e9-474b-910e-ec36a93075e5", "value": "T12AD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531969, "uuid": "9cd05c2c-e76b-4522-9d0d-24178f106593", "value": "1536:QKdzElm18uZJNb4AxFa8eAZHk4VB7fzTTnf5mgYivCyeqZ/Z20lCmwyw6RNPUTut:QKp50uU8e947L3f5mziPtRZ55ZKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767531969, "uuid": "56caf9bf-60d5-40f7-8dcb-a2a00266e59c", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767531969, "uuid": "1d1ebd9f-b075-42bf-923e-9f6dca386425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531969, "uuid": "cdeb01ee-207a-4e12-a859-294a699f48a2", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08ca5f7-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517684, "uuid": "b574c28c-2427-42f1-812b-334eb634e544", "comment": "Malware payload (Mirai)", "value": "a03c0674872e593612d0aa464b0ff0c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517684, "uuid": "6af2e19a-54fe-4799-9068-48344e12ef8f", "comment": "Malware payload (Mirai)", "value": "3d583ebd24ddb03761a43dda4f067a4050817237f03b878e941d4e1137c14bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517684, "uuid": "024a5607-f44d-4c43-8da3-7eecc2368003", "comment": "Malware payload (Mirai)", "value": "03ceaa3c62a104492f85b9d812ab3a6a9188ac65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517684, "uuid": "c91833e4-ee92-4133-91a6-bd9556ffb35c", "comment": "Malware payload (Mirai)", "value": "59d08de65963300feaf4f5e0eb75eb97e3a538609c1c8ebfb81d2d80aee5864c2c8bc8f3329db3138026d8b2eab37325", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517684, "uuid": "91ef9b90-2266-4bd8-9037-740630e7e9ea", "value": "T1E3F3F7C7F901DEBBF40BE376489309157530BBA64C524A72B26379ABED3A1C41437E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517684, "uuid": "ee4b9993-efdc-484a-9db2-ab9b417b4de6", "value": "3072:JUOYmP2ptPw1NyNdvk55mIoa/7Dz4FmlVJjbijLokaUiY/J:yXmpDyNd855NoQcFmyLHaUvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517684, "uuid": "b04ffc56-2625-469e-886f-dc62874abbcb", "value": 161828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517684, "uuid": "8124d4dd-9215-49cb-8f39-c5e3c61132d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517684, "uuid": "96675fb5-ae82-4640-8d7f-3f3ab8882f30", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e0429-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509624, "uuid": "5f437e74-4f6b-4344-b8c5-2d489e87089a", "comment": "Malware payload (CoinMiner)", "value": "bd48a1bca501ee201c7d739ca1b999d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509624, "uuid": "17fc4480-9d15-4ebb-8eaf-d6ee53de66d1", "comment": "Malware payload (CoinMiner)", "value": "3d66fb4b134d564edacfc9610c26e55d34f5a83b6d90643e27015b069ca3856d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509624, "uuid": "2a8aec64-86de-4065-a4c0-271b388742b6", "comment": "Malware payload (CoinMiner)", "value": "16714772b13c759aa57e3827ed42ac7f4c6b488b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509624, "uuid": "7ff31431-8fd5-47f4-92a2-e3c00502b6fe", "comment": "Malware payload (CoinMiner)", "value": "6238d41ff2e5fca1a500bb310e5d66788a188a89a1f834856b528aa1fde71cbe02e1d01d9c07661576a0ba81d7aa92d4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509624, "uuid": "a4a6d0da-5f08-4e30-9bb4-b75c2ec1b917", "value": "T19FB5335101C3FA7FA04ED9C498FCFB311E7A55F09B281A25685E085ABC31FF941AB52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509624, "uuid": "a852816f-5b58-42d6-895a-7f5d52f5253c", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llw:G3LG658+S8YrCpHy2dUu4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509624, "uuid": "b148b564-d978-4be3-b5a1-3c10432767e9", "value": 2445312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509624, "uuid": "136b859a-72b4-4bab-99e6-4f3fa292782d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509624, "uuid": "26893a3d-8750-44fe-b69a-2445cce5ae7f", "value": "3d66fb4b134d564edacfc9610c26e55d34f5a83b6d90643e27015b069ca3856d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a7c394-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509151, "uuid": "29823f2d-1d12-4b6a-a5f2-4cce323690cb", "comment": "Malware payload (CoinMiner)", "value": "65167d11ee5173e27f70d5e87c2e3f28", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509151, "uuid": "9d5b1d6c-7f3e-475a-9b9b-487ef5cec016", "comment": "Malware payload (CoinMiner)", "value": "3e17eaec4f6fe9e21f8de23f94f2355da9e9f6bfd7c85f62a8870b945239e6e5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509151, "uuid": "cb283b38-401b-4416-94f4-d25013e91bc0", "comment": "Malware payload (CoinMiner)", "value": "244f5dcfb0bbd6b9d61f15348abd0d0932cc4789", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509151, "uuid": "91fb9a51-dc2d-404f-836e-65b4de585482", "comment": "Malware payload (CoinMiner)", "value": "8c20cad2e6267c6ccb738f7bbe9fe372bdcf903a7b9d3f281aa0bafefa7c134183d98cc9d8e85cd01120745f0f7adeed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509151, "uuid": "7b81b850-5ec9-457b-a78f-410e06954b00", "value": "T16B16336511CBFCFE6485D86898F8FB374E9561E29D7C4111F92908287C26EE7407B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509151, "uuid": "ce8eb336-614b-4b00-a280-9cd596bd3813", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgC:CC65sr3KrCfsYiZQgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509151, "uuid": "69cd6b97-2eeb-4f19-8faa-18edfb2b417a", "value": 4042752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509151, "uuid": "3a71aab8-3cbc-40a5-94db-cc84718cebc3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509151, "uuid": "7f7a6ba4-8f00-439f-b5dc-b1b683bba161", "value": "3e17eaec4f6fe9e21f8de23f94f2355da9e9f6bfd7c85f62a8870b945239e6e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11376065-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511323, "uuid": "c0c70a07-1986-42bc-9e22-d99aeb0374af", "comment": "Malware payload (WannaCry)", "value": "d3891f56ad175f9af1d21f3072f73ccb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511323, "uuid": "a7a32484-f4e7-4685-8295-365cb0f8985e", "comment": "Malware payload (WannaCry)", "value": "3ed4ed12009a6787dbf21e801d25663f178df377e5ec9e954cd9c17f1cb5970e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511323, "uuid": "e2a9f1ff-e6e9-43a5-a36e-62c8dea90dad", "comment": "Malware payload (WannaCry)", "value": "b1c65e1fd7f014ff8d9d5033b2ae6feb7ef69fd1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511323, "uuid": "911a2f47-abfb-43f5-8e6d-9534cd9ecd76", "comment": "Malware payload (WannaCry)", "value": "2bca9cc10acad1830f7b18d9abab4b75da6a73cfc04a11de380b31b8137b17c13fe9269fd9da33e0ec161fc87779b02f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511323, "uuid": "97a55de0-e6c0-4a30-b0d7-9309b02db450", "value": "T18E362322E11861B5E4A305F404EEAB26E1BF3C2417B795CBAB50466A4C217F77B34F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511323, "uuid": "fb9b6b10-cbe0-4ee7-8b4a-615e77c42095", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511323, "uuid": "bde1ee39-9bc1-44b1-943d-d2c7e5aec3ff", "value": "49152:SnAQqMSPbcBVQej/1IN01HkQo6SAARdhnvxJM0H9PAMEcaEaue5c/bXZROAx:+DqPoBhz1auk36SAEdhvxWa9P59Uc/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511323, "uuid": "c0e3c5b8-90ab-4d47-97c1-7562f33dd145", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511323, "uuid": "2a5cfe9f-1f55-4a78-a206-b69212329293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511323, "uuid": "d4a145e3-126e-4070-9950-e252ae9109b0", "value": "3ed4ed12009a6787dbf21e801d25663f178df377e5ec9e954cd9c17f1cb5970e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dae8b2f-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512713, "uuid": "276cd1b1-6337-4ae2-bf2b-35098fcaff37", "comment": "Malware payload (WannaCry)", "value": "4f53357da304a79b6cb55fd8de9a094c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512713, "uuid": "9020d801-953f-4a93-868f-b5949b671b44", "comment": "Malware payload (WannaCry)", "value": "3ed9aa7e2e3eb4fa3b843e03a267f287cb6fa96e720f216e8c8dc51e0342dd3a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512713, "uuid": "9ebd3ae5-7479-41b6-a61a-df2e04cea6ff", "comment": "Malware payload (WannaCry)", "value": "9c5c47270b57100cb7b3b03684c4f284bca65454", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512713, "uuid": "7072caad-8d8d-448f-96c4-b33af98980e6", "comment": "Malware payload (WannaCry)", "value": "e0b74a76172dd38ff96e33f09628930d9c686880cda2d1c73ecfce88d6d408e37598544144520c6e4ec9b2bf345c4868", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512713, "uuid": "c0b840f2-57cc-470e-9f07-98337b862940", "value": "T1A936236A766CD1FCC10A6274A463492696B73C9A22BD960F8F908B530C13750FF78F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512713, "uuid": "2f8f76a9-589d-4d05-b9cd-c266668d5d88", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512713, "uuid": "6cde92a1-09c3-4c20-889c-3ac5ae8a170b", "value": "12288:TQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFy:MbLguVQhfdmMSirYbcMNgef0QeQjGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512713, "uuid": "e28e19ef-5540-4174-a50e-4586cb8ca591", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512713, "uuid": "e4475ad3-d722-4dba-8f8f-1d97f34ad1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512713, "uuid": "f439f9e2-6944-49c1-8e76-5f66c019bdaf", "value": "3ed9aa7e2e3eb4fa3b843e03a267f287cb6fa96e720f216e8c8dc51e0342dd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163f96d4-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567166, "uuid": "42dc8edb-05d3-4efb-8ba0-9d39ecc2bab9", "comment": "Malware payload (Mirai)", "value": "9e149acd06b9465ff787c7fa96f57eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567166, "uuid": "242ea745-8ff0-43a6-84fb-8ca97fe1f3de", "comment": "Malware payload (Mirai)", "value": "402dce5918628973c34e0582a51150cab4763739464a50e09ae9bf7aa0e255d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567166, "uuid": "66185938-3fe7-4c5c-b8f1-a9f531d66a50", "comment": "Malware payload (Mirai)", "value": "eaac3600fc66e71c0d956a6200f5a3a89c119f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567166, "uuid": "610d027f-47e2-4191-8012-266b9fe03f76", "comment": "Malware payload (Mirai)", "value": "7d62bce37e9266570dbdac98977342a92dd1c2e9ae9dd8b07f43a53bbe00134d46b01492c0f2856f634634ba8d7f861f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567166, "uuid": "484e993d-22ee-4534-a28f-48e4c0c71880", "value": "T125636D85FA53E0F2E9631172113FA7679A32E63A4025CA87D76C6F32DC67401DA2736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567166, "uuid": "0a1dd6da-9488-46aa-87a0-f97cd37cf06e", "value": "1536:x71SzkGuerW7M7cAM/pdMelw7phzEzdeljm6FjFgP+BZgh:XVG/KRiplEzFc2cWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567166, "uuid": "30b62c7b-70e7-4c4c-b757-b924966969f4", "value": 70820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567166, "uuid": "1c640084-7a17-489e-a6fd-659a1d06f09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567166, "uuid": "6dc54570-ea82-4356-98cf-47fa5ce7258a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ab2b34-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512780, "uuid": "8e922c70-1d47-4171-b01c-27edeb600a83", "comment": "Malware payload (WannaCry)", "value": "245b1c79c34b7e46285734858e10207c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512780, "uuid": "1384229c-cfb9-4433-87bf-5e78874d9799", "comment": "Malware payload (WannaCry)", "value": "402ee2b4986233b851763d0ce995ed7465ca43ea1b9857252be91e2665345816", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512780, "uuid": "5f033960-1a73-4971-8915-891e279c27ca", "comment": "Malware payload (WannaCry)", "value": "44cc3ed3ab4a2846d90a7cc95f89170e19d072db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512780, "uuid": "9f1968bc-adbc-4ab8-b52c-ce6c18e1aebd", "comment": "Malware payload (WannaCry)", "value": "13cf6872b0f14b3d236156a3bb588178ce5bd3c0c18a3141b9013164803d25a24c3afb1fff3bc8d5459b750c07384fe8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512780, "uuid": "d85db3ce-64db-48c1-8ace-92f73cbb5613", "value": "T179362311709485FBD355B932D547DD22FCB2346B082A5BBF9B4CDB8E4E2B3088851F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512780, "uuid": "c4e41c25-70b8-4950-badd-7eb03e2e0edd", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512780, "uuid": "94ec17d7-d0d5-476d-a10c-e73f7f882627", "value": "98304:d8qPoBhz1aRxcSUDkA4+kIJo4ZzyG8uZ:d8qPe1Cxcxkq7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512780, "uuid": "72777e3d-7dc8-4fea-a3b7-59986b349c15", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512780, "uuid": "5bb26732-16d4-4542-a49a-9b90ea8c64f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512780, "uuid": "8c73b93b-3edd-4565-91c3-0951a0450cc5", "value": "402ee2b4986233b851763d0ce995ed7465ca43ea1b9857252be91e2665345816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97912124-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511548, "uuid": "9125e65f-0813-4e50-8cd1-9d781c2d1797", "comment": "Malware payload (WannaCry)", "value": "0e3e5e700886a192d323c1012c6c1b2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511548, "uuid": "9731f355-7c39-4f7c-bbd8-9aa70f2f9bd0", "comment": "Malware payload (WannaCry)", "value": "408d55f5079c3c771c5e5dd310332cb9ac85cfec02fa9469538d4fb83e51efac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511548, "uuid": "c6664228-1e62-45a8-92bb-a39b459e465b", "comment": "Malware payload (WannaCry)", "value": "f7f6317e536229c740c82428c1f9bbe0ef557586", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511548, "uuid": "f68b3c46-ce16-4726-bf68-e8f64e8fa17f", "comment": "Malware payload (WannaCry)", "value": "9b944974c1ab5039c0558251d0ea60cb6a39eaffacfa2a04f3208dcc1fe6cddf890ba6c3900ed18ce1f8bd7f1575923c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511548, "uuid": "cc6a2aa8-04d4-4381-80b5-fba7a78cdd1e", "value": "T18B363319FD18D779D16A1AB000B34B2AB3A238DDC3AB295F875C59E10C873673BC295D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511548, "uuid": "ea5d3a85-896a-4799-811c-15c720cffec2", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511548, "uuid": "70759539-225a-4c73-a9a6-459491b7022a", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R:+DqPe1Cxcxk3ZAEUadzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511548, "uuid": "a1603b63-2164-4fa8-a4ea-9230c646b826", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511548, "uuid": "61e4f81c-40c0-4dec-b538-f3bcb334558f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511548, "uuid": "25f07692-327a-4d0c-bbf5-0d85380fcdb5", "value": "408d55f5079c3c771c5e5dd310332cb9ac85cfec02fa9469538d4fb83e51efac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9cc529-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512636, "uuid": "cc04e120-3fc8-4c4d-85ff-5e0dae918f11", "comment": "Malware payload (WannaCry)", "value": "5ffa56ea6ea43dc209d2cdcd4cde0326", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512636, "uuid": "f49f6199-6af2-4d5e-b8f9-2fa24b24ae75", "comment": "Malware payload (WannaCry)", "value": "409af830ebfb982062aa6a1e8c1de17605859a52917c9087397971799fb3d52c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512636, "uuid": "852bbc8b-99ba-4681-8ae2-a0c676298364", "comment": "Malware payload (WannaCry)", "value": "f0fe9a75db406fc5243b03958b976ee5dbadba99", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512636, "uuid": "821aa450-c678-4c95-812c-7a61ea4f021f", "comment": "Malware payload (WannaCry)", "value": "7cd19305db54dc6dbbd133909ff3c175e72ae59c61587a3117dc20954830773f50196f890187d3b9ac82e398b496f24c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512636, "uuid": "3d92a34e-c0f6-4138-9c66-d18b4b1c5bde", "value": "T1CA36339971BC92FCD105197080A7CA23B2B27C6E16FE6E0F8B4049791D93B5AB790F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512636, "uuid": "6d97c04e-4a04-4ad5-af20-75505d761ad1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512636, "uuid": "c1023b6d-680b-477f-93e1-5c5de5afa952", "value": "49152:RnHqMSPbcBVB1INRx+TSqTdX1HkQo6SAARdhnv:1HqPoBT1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512636, "uuid": "98fb15b0-a79d-4c38-b4c2-ebc2f8c0a707", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512636, "uuid": "0ae7264d-ee33-402a-854f-6c9679eef563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512636, "uuid": "feee59b5-121d-47c4-9c5b-30a035ca3ac8", "value": "409af830ebfb982062aa6a1e8c1de17605859a52917c9087397971799fb3d52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2388be-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512474, "uuid": "c6201534-f486-4126-81a2-328f45274e6b", "comment": "Malware payload (WannaCry)", "value": "aae2e2b7a545ce818b2b2222257bc925", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512474, "uuid": "00058a5d-d6df-4df3-94c1-f91b242df107", "comment": "Malware payload (WannaCry)", "value": "40a6e2b51e0021fef7592b2b4bd074711a9dd8962c4daf3a74c6c660d089c875", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512474, "uuid": "efe922ba-d8ba-4f25-9283-3662dd00e106", "comment": "Malware payload (WannaCry)", "value": "6976abf742bf1079d3377a23b7ae3985c47289a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512474, "uuid": "b56cee38-9524-42ea-b741-bb6531afaeac", "comment": "Malware payload (WannaCry)", "value": "e07d15c4af35fce7c2ac193ff61031da1c7883b0d8f9d3006afd26879cf12cbfecdd87ac8c34a2744e31302a132671ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512474, "uuid": "5c126dd7-dd91-4981-8fc8-d01eb4ecb484", "value": "T19536E0037285D076D0141A394C67CAECA5E3FD95FE2D800B7ED6734F29B7A85EA42B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512474, "uuid": "19e546ef-4e6a-44f2-bd2b-56bd2fd43276", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512474, "uuid": "41f1be86-2453-46aa-960b-ec2449335f04", "value": "24576:SbLgddQhfdmMSirYbcMNgef02LuYAMEcpcYyqGjNZtA0pzH5ws:SnAQqMSPbcBV+AMEcSrlAmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512474, "uuid": "f460270a-41e9-49ed-a1d7-ab9fe9c64151", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512474, "uuid": "255d958a-d661-4e91-8dd4-61a1dce1768b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512474, "uuid": "1c1dbb3f-48de-4a3a-bba3-5d75b1099a40", "value": "40a6e2b51e0021fef7592b2b4bd074711a9dd8962c4daf3a74c6c660d089c875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3737cf5d-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567221, "uuid": "8ddf4005-0c79-494b-bd76-8c59c3ae1bc4", "comment": "Malware payload (Mirai)", "value": "2bf7ad25aa1bce5123d8ac09ea6e30e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567221, "uuid": "c200e5c7-5a06-43c2-b665-438bdca3dfff", "comment": "Malware payload (Mirai)", "value": "40e0e961fb5caf43b1bdb581a43212327583c00a0b581c9820b0533ff404a4d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567221, "uuid": "8163066e-22b9-4232-9933-48b9a24ec885", "comment": "Malware payload (Mirai)", "value": "6ba7dbb175c06a916b7fc46aa5c12ee6c5190d26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567221, "uuid": "0f5b240f-dae8-434c-bf5d-774d0e135af2", "comment": "Malware payload (Mirai)", "value": "b094ca40f10f1e86cbadc95a9f1bcd8f4296520f6b78803e606433069f238b1146322d5b1f80d9b4fedd364884873dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567221, "uuid": "2ca7cd3d-e220-43d9-8325-bf4f1bf3b7ef", "value": "T13463951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567221, "uuid": "83881206-33b9-4879-8e61-61cbe6ee0b2b", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAl:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzeL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567221, "uuid": "03df1322-e0a7-4b17-b9f2-a6db09f9ac28", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567221, "uuid": "e58290a9-b4d3-4237-adcf-c45d40ea05e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567221, "uuid": "853ee07d-2861-4f39-b37e-2460ebeb217f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8104a86-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509482, "uuid": "597d21be-b5d8-4735-b4d4-33278542c357", "comment": "Malware payload (CoinMiner)", "value": "3a832741acfb5d10263efd2676eeac1a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509482, "uuid": "a9e22d43-7749-46cf-97d6-3fe035982736", "comment": "Malware payload (CoinMiner)", "value": "4125d2888c063efe7596f4b8bc7fcc11b93fd7da0c0c30338f1b1198775f452a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509482, "uuid": "4fd2f365-76c0-4a03-abeb-de0f6b8042e3", "comment": "Malware payload (CoinMiner)", "value": "28050e148d0139db931bc27cee1a94882c65e9a8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509482, "uuid": "537a5e84-3fd6-4093-a811-14d27fdc2964", "comment": "Malware payload (CoinMiner)", "value": "a537f2a1f3c1e1a7b749d65f62091911a6fbff6c3faaea43d35ed763c2839459a320452a75e34b08d4aad40d206ba471", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509482, "uuid": "10a8740c-6abc-4110-bc49-5bd7558f55ea", "value": "T189E5331100C3F9BE95C4D89458FCBF310EAB11F0AA285562FF7A0425BC26FE641BB61A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509482, "uuid": "8075e319-33bf-4e00-a822-65af5a8b6661", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E1:G3LG658+S8YrCpHy2dUu4Kr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509482, "uuid": "fe155877-9a61-47e9-b957-3742fabe12f2", "value": 3170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509482, "uuid": "9dad6430-0dc2-4291-b2e1-e5ccecda8a75", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509482, "uuid": "df5add48-3c8e-43e1-b6d5-fbd9885aa5b3", "value": "4125d2888c063efe7596f4b8bc7fcc11b93fd7da0c0c30338f1b1198775f452a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e9bef5-e97a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767537267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537267, "uuid": "a8c801b1-71e1-4437-9e2c-aa68448157fd", "comment": "Malware payload", "value": "63d7fea58999b82904a502fe14b86cee", "object_relation": "md5", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537267, "uuid": "8c0be483-50f4-407d-b170-3e482a70c2d7", "comment": "Malware payload", "value": "4199b93cf93c93bf522dcd68dacb75ed26e0855fff9e6d35a803d3e418c74dc2", "object_relation": "sha256", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537267, "uuid": "c69dfa4b-8f63-45b2-a80b-3bd047b81ba5", "comment": "Malware payload", "value": "94b5e7fb081377ee770cbfc7399cd8cd26298ef1", "object_relation": "sha1", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537267, "uuid": "eaca0891-47c5-42d4-8fa9-8a98c4773dee", "comment": "Malware payload", "value": "cf7aee5eaddf96c6dddf74c8f052103a68b2ba197eb17c7652c468f2ff06f85f83e1c5f3e8ccb65411e8e87352f42910", "object_relation": "sha3-384", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537267, "uuid": "2ccd1dfe-bbac-47d5-8b35-54afddb7ca9d", "value": "T1A495E086F785A86FE9F3C7368776465E46064C9A8B43E3874A54F13C4CB79C08E46EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537267, "uuid": "b7918ad5-9c1b-406d-bf76-249a62367f11", "value": "49152:ajI9mx82M80wIDg2Qz3O2CmXGKLc2Rj8ChTplY:aMmxswShQjym2KdRj8SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767537267, "uuid": "8e1f37e7-baef-436f-b56e-87290052705c", "value": 2060324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767537267, "uuid": "1dbf956b-f822-4f8b-88b7-2e9736afa0d5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537267, "uuid": "b4092e78-d001-4159-b840-775176548a94", "value": "FXAJVI.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d164de-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567169, "uuid": "4535b1c2-ab73-4aba-aef9-307401a38723", "comment": "Malware payload (Mirai)", "value": "0657e5a673767f92e1e9dd9687c74740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567169, "uuid": "92cbc475-ec42-44d8-a310-a8696ce9da13", "comment": "Malware payload (Mirai)", "value": "420108549b2b605beecbde87e00fecbf1e878ad20d45a48ee28c654ed5dfabf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567169, "uuid": "33906b3c-9ff8-4fe8-9fc6-e3e181172eaf", "comment": "Malware payload (Mirai)", "value": "929d2016cf43ebc566d9c56ac435b67cfaeda9eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567169, "uuid": "ab0811ee-5151-4839-bc8e-fb260e8566ed", "comment": "Malware payload (Mirai)", "value": "6b305b6aaa422c7aa9ae7f86d3a026c5e28ffbda5eca6ba5d4b57245d541f2323b8da3ff7f666f1c6b88fc773dd9c85a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567169, "uuid": "434c9f45-b8ec-4375-a7d1-2c1bab7f9c18", "value": "T1C8336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567169, "uuid": "7d29ef27-93de-40ba-b649-a78e532055f2", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567169, "uuid": "c0cbd972-c9a7-401f-8465-118d3e75970e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567169, "uuid": "be157821-92df-4d44-8019-16b00f6fc845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567169, "uuid": "ce989694-12f6-4a9f-a827-b3bac0ce3c05", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a4d602-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767511406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511406, "uuid": "e85d7b44-0976-4b43-9364-302d23bd8159", "comment": "Malware payload (Mirai)", "value": "c341681004389e9146dee9548305c918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511406, "uuid": "b492638f-f481-41f6-8d8b-0ca13489e25a", "comment": "Malware payload (Mirai)", "value": "420b164976c85eab3bc80bf576e78f6e987bc426b6a13d1902083151b0b0bfce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511406, "uuid": "eff5acda-542c-4e2b-8ca2-23cc93dfad67", "comment": "Malware payload (Mirai)", "value": "38843e225e4e4ff2280bc389f72178fa318a679a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511406, "uuid": "b338d3b5-d622-43fb-a362-d5f098461422", "comment": "Malware payload (Mirai)", "value": "6b9c162587189e2f88627d7edc9e89a0563ea6cc8256e28f6fbb909f4f8fab53b5418c099f25a316e5d39a651d01f211", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511406, "uuid": "a497224b-aad8-474c-a02a-5f44ff4e0e48", "value": "T128044A85FCD19A12CAC622BFFB1E528D372653A8D2EE31039D265F21338759B0E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511406, "uuid": "7aaeac15-0b5f-4529-8c18-37f6176b6c34", "value": "3072:2+LLSG9fhVfxDIs10UugxkfI5zf4eRC/ExZ/1lt3T2P:2+LLSIfhVf1pegxkwlf4e4/yR1lt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511406, "uuid": "dbabc732-cb25-4414-bddd-90fc09cb5a85", "value": 185888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511406, "uuid": "f5e683a6-352f-47b5-8ad0-550871804265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511406, "uuid": "11c13593-8190-44e5-8310-249ee113804e", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ed197-e9b2-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1767561502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561502, "uuid": "391ff1c6-1a34-4d7a-a07f-59fa49d7795c", "comment": "Malware payload (ScarfaceStealer)", "value": "a181d912bc0a1090ba5c60e79766e3fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561502, "uuid": "c8d0972d-c2ea-40ff-8b8e-7b5e77268e13", "comment": "Malware payload (ScarfaceStealer)", "value": "432cc68671e2f92f171d497c5d3e4b2d6e03bdc572c72daf8375e0412fd44f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561502, "uuid": "411e9145-a67f-423c-85f1-aa3638624854", "comment": "Malware payload (ScarfaceStealer)", "value": "3d67e166a2cb568f8e226bb04672cef2e0e867f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561502, "uuid": "086b7e2f-6d6f-46d9-adeb-7d13251baf55", "comment": "Malware payload (ScarfaceStealer)", "value": "4a414e621b08cdefa6112a7d02b1e8492aac8e492757d1fd2662772dafcd89793be4f7ba4555de8f6f92af7ee79f6430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561502, "uuid": "d0ab3767-e9c9-473f-8a0e-a590bfbc861d", "value": "T182F623E379DAD2E8C4A38D3029C64B5870E1738981FF8E5F37C75C06B660E174A4A976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561502, "uuid": "12cadf68-9bf8-48e8-b86e-9025ca31f44a", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561502, "uuid": "4cfb1bc9-e56a-4eea-9baf-2f9ce59e7723", "value": "393216:h+vOZyy0AqAubtuFL1yV752/9CkioNUaUtAOjT8FwK:1yy0AqAate1yVEri0UljT+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561502, "uuid": "8273c506-5ef3-4e74-a0f4-4d0f9014443b", "value": 15532032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561502, "uuid": "f960d1f2-8ac9-4bbf-a2d5-74dd13b0ffba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561502, "uuid": "38579cfe-7336-478a-b857-41727014c294", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770b3a19-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509776, "uuid": "06e17c2e-f97a-4015-8db4-2e77d5951bc0", "comment": "Malware payload (CoinMiner)", "value": "b7e63c3e9e5d53d37e17bbdacd9b8678", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509776, "uuid": "10e4a28a-22a8-4086-8c71-9314d8b5950d", "comment": "Malware payload (CoinMiner)", "value": "433da7730df26dc255b5c46349e3eec02063a963d00586e6861dd0ff8eaf9436", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509776, "uuid": "d752e3e9-afef-4202-8cdf-849a601cfa97", "comment": "Malware payload (CoinMiner)", "value": "77169090b52fdd06651ce56a609423c0768531de", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509776, "uuid": "c78f45e9-77cf-4242-a14b-5508067a71a1", "comment": "Malware payload (CoinMiner)", "value": "4500f250a0bdfea7f9daefa25a6ab54ad1fd1287727839805c10f8c18eeab6686d1ae1522754f206098cfa672f4ef40d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509776, "uuid": "60bcec6a-febe-4827-8f68-18bc5de794ef", "value": "T196A5335102C3FB3F909EDAC4A8F8B6310D6655F06B291A52B85F0D5BBC32FF501A791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509776, "uuid": "5736f9ab-220f-4822-aa5d-9d3f8064a9aa", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1ci:G3LG658+S8YrCpHy2dUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509776, "uuid": "2c3361fc-1ae4-427b-9d30-f66a9b4b9cee", "value": 2191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509776, "uuid": "54235513-f519-4ced-9ee5-624dbc06101f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509776, "uuid": "eb3578b9-eb08-49e1-b3be-68877632dee8", "value": "433da7730df26dc255b5c46349e3eec02063a963d00586e6861dd0ff8eaf9436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af75d982-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511588, "uuid": "e31794d6-1d20-4979-810c-226753010d32", "comment": "Malware payload (WannaCry)", "value": "fcb6b0f95853dfda72d5535a424b3a29", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511588, "uuid": "4f6119bf-bb3f-49d8-af76-4cef29dbaf51", "comment": "Malware payload (WannaCry)", "value": "43704ad4b343ba301fceec626cbba9a1f7dadf160523ef0acbbaa9714dfce61d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511588, "uuid": "dea2b1c1-0258-41f2-88ea-25d82594c526", "comment": "Malware payload (WannaCry)", "value": "2bac7f4fc74791cd670ea80448857fa49c9d8904", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511588, "uuid": "da899fdc-d185-4bf1-9805-f8f42fa037f5", "comment": "Malware payload (WannaCry)", "value": "92aeed54d7a27df3b9f9b626acad9db02dda251e75575cdf5f6f7a2b6417278869e721efd4e20509fee3505dba420a1d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511588, "uuid": "694ca471-b661-4352-8365-ff7db31cbb40", "value": "T1883622A6759C80F4C20A7274E8774E15F6BB3C393179960FEF908A211D13B92F628B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511588, "uuid": "eb064eff-2203-4ff0-9818-d516213e0da7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511588, "uuid": "f1b30b5d-c0f5-45ef-a059-1f1193487fb5", "value": "12288:T1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFh:RbLguripdmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511588, "uuid": "c34c92db-df71-4e52-8df8-9249676f4e16", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511588, "uuid": "d87ca9aa-597d-4974-b99e-41300660971b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511588, "uuid": "7a5da252-9aa2-4f92-8bc4-b7851d243275", "value": "43704ad4b343ba301fceec626cbba9a1f7dadf160523ef0acbbaa9714dfce61d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e64d91-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511977, "uuid": "5b6881dc-abca-48bb-b256-d06768cbc0fa", "comment": "Malware payload (WannaCry)", "value": "10c0774abb195b1a1ae8b93d6b1e068a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511977, "uuid": "02d4b4e3-e864-4938-852e-a149f01d8509", "comment": "Malware payload (WannaCry)", "value": "43a49befd0174dbcc2594eda6c46169015501f04017a9dba6ea4b51bbe991bb3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511977, "uuid": "e4ce2858-f11e-411c-8924-ca7f66046400", "comment": "Malware payload (WannaCry)", "value": "dfa0fb5f07274147b2ad50fbb0ed5d6a0975aef4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511977, "uuid": "f34d771a-7cdf-49f0-a824-dc14e6000c47", "comment": "Malware payload (WannaCry)", "value": "d49c6fe9bfc28065f8372bac8910920973e21da1854fcfc906f5a641a00c6f813bdbc07571fc6f8e3b1300b6199bfa87", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511977, "uuid": "4c3d8abd-c80f-4fae-bcfd-773f9d82c9e5", "value": "T1AF36AF21BB889861D21A13B05CF7CB66A77DFC218730474B3698B72D4E315E16F31E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511977, "uuid": "56430670-1671-4556-b7e6-b97c5eebeec3", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511977, "uuid": "28ede440-69c6-4c77-997b-f1847d262673", "value": "24576:zbLgdg5HyRNKFqCfD3JHjP/vX5BNY10Ts2JFSftF:zn9SGqCfTpfW10T/fet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511977, "uuid": "b0aa6dec-8d55-453e-8002-7243c654f01b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511977, "uuid": "208e1260-3295-4b3d-8b00-c6f1c8cce356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511977, "uuid": "98cba7f2-6dcb-42a9-922b-ab5efa28899c", "value": "43a49befd0174dbcc2594eda6c46169015501f04017a9dba6ea4b51bbe991bb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a957f0da-e97b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767537777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537777, "uuid": "bb2dfa0d-04a0-4237-abf9-5e88b654e047", "comment": "Malware payload", "value": "8409cf6e13b65bbe2b82aae424c5a986", "object_relation": "md5", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537777, "uuid": "81b0c656-92d7-4c98-856a-11b966103c08", "comment": "Malware payload", "value": "43c0c64ff06245b62077ee794e15aa23c668e0f8f9341f3665de724f868c6b56", "object_relation": "sha256", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537777, "uuid": "8f02537c-a4e5-4706-b20a-e785b0c2a9eb", "comment": "Malware payload", "value": "76af5bc9abda22218cfb1c0a3a087e5c5bc1ffce", "object_relation": "sha1", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537777, "uuid": "e70acad5-571a-46b5-80c6-085628a8fa6b", "comment": "Malware payload", "value": "a53b20ec5f53f847c71363902a402923ba0d723b476aa700ff68e012f211ca73e5079b7aeb44368f8df5f8907e0772f1", "object_relation": "sha3-384", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537777, "uuid": "83e6c2dd-0442-4e7b-8553-173232378c53", "value": "T1061833A0D3D0C85FCF578E32735B14036F3627E1CBFC650D9A40AA40DAA095E999BA77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537777, "uuid": "968b6a4e-b65e-455d-a07d-05a96ddefbdb", "value": "1572864:uwq1W5Ulrp6WZoXgdrPi+mbH5ulxJSTsJucdNgRkTm4GFtlHHASmhBPxbtMQpuz4:uwq1W5Ulrp6W+Q7i+pgeu+ZTlCHH2lxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767537777, "uuid": "1718d68e-5fb5-4ac3-ac82-974ccb4f9bf4", "value": 92438296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767537777, "uuid": "57362e0b-f455-4f81-a18d-6e9f2a807385", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537777, "uuid": "e5d8ad5a-16db-49ce-b682-50bd643b9f0b", "value": "LunX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d74c26c-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567151, "uuid": "92187d43-bccc-4242-a664-34338cae1b76", "comment": "Malware payload (Mirai)", "value": "588e627e2e17b4b1ddeea99510a0c482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567151, "uuid": "7d7d9158-3d89-495f-80b2-48a0437c9213", "comment": "Malware payload (Mirai)", "value": "43f31fd68ee126fe013f0a782e44a78255b1683479125170837fbdcf62b6d492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567151, "uuid": "d257de1f-6c51-435c-b23c-aaf444143a0e", "comment": "Malware payload (Mirai)", "value": "96cfd45786aca1e95b408d983d8ecfe81460deff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567151, "uuid": "1630bb2a-7fe2-4531-9101-26da767fe76b", "comment": "Malware payload (Mirai)", "value": "8c330d0d2d12e26f28aa0d60e415689884bad8e18c69911363453f07d5a9c51c2903f33f9a5158934ae29ac7ac95b707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567151, "uuid": "c43aa0e9-a1b8-4405-84e4-4daea5b7ca1d", "value": "T16753F856F8818A11C5D412BAFE2E118D331757B8E3DF7212DD206F247B8A86F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567151, "uuid": "edf263de-4331-4233-821c-6dc3075470aa", "value": "1536:Y0n3Y16wIYs6pOhj7olN+fz3Ixi0KEz1PmK:4kwg64j7olfKEz1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567151, "uuid": "263a4546-a15d-4a8c-ac20-fdfe7c94929c", "value": 63000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567151, "uuid": "6fdc8d25-dc02-4c0d-b771-1c99fdb2e562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567151, "uuid": "58629075-c851-447c-ac15-b44df8b77570", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dbe3cf-e9c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767568112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568112, "uuid": "df8e159b-fd17-4614-a117-16fbd23378b8", "comment": "Malware payload (Mirai)", "value": "5a470040279610714b274f8b077888d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568112, "uuid": "6d41a1e7-9921-45c3-a227-55cc2bed43cf", "comment": "Malware payload (Mirai)", "value": "44043b04f20fa1452c78a20e24ef6aca249b7f9207a502e44290be3e52e54053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568112, "uuid": "28720ca2-5c25-43f4-aaea-f41caa839c54", "comment": "Malware payload (Mirai)", "value": "3ede1319949dcba388eaa760650bc713584f1c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568112, "uuid": "e62a90a5-92a2-423c-a955-fca733a36389", "comment": "Malware payload (Mirai)", "value": "0064e53d2980614981a05de99df3772a2cf3512401ce433e8b641dcb4c71010a469f1843276c0343b6fe3302030d6a02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568112, "uuid": "f6e9c8b6-50c4-48ad-a8c3-1b4178cc439e", "value": "T1C663F955F8814B26C4D60279F92D358E372217E9E3CE7222AE205B303BC65AB0E77F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568112, "uuid": "adc35726-6a2a-4c2a-91b5-b92a5451d675", "value": "1536:etnEaCDJIyyR704Ah0g+B1V+5iMuHjzCZfbDyuvcjOIKiqjnd0Ooo:XFINRe0XBjyizagIjnd0Ooo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767568112, "uuid": "9c439c13-327b-473c-b1bf-e89dca0dab39", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767568112, "uuid": "b60664ed-47e7-4c9f-930a-cce9057582e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568112, "uuid": "11426c2c-65ab-4ee7-abb4-a9463a48f933", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405ae225-e930-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767505389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767505389, "uuid": "7bf05457-b4c1-4811-9f42-3a3f86fb3517", "comment": "Malware payload", "value": "0ef6254d74b06aa110f9b19c365e5a7c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767505389, "uuid": "4a625802-e862-4187-9a94-3456779c28b5", "comment": "Malware payload", "value": "448d45b378d037478bd7b5856ef222401102ad6ff4acfa9c9a5aa9bfcc3e0192", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767505389, "uuid": "5bb62377-557d-4822-a0e5-c0da42f53679", "comment": "Malware payload", "value": "b627f83b4b659f60f68780bb435742078a4953c0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767505389, "uuid": "8de10330-c8e9-4a90-96ea-4ce75168492c", "comment": "Malware payload", "value": "34e6d8e7c6748bf0d7211a2de61e1d1d31c7d7c6668c9920c6e5b8271c92f3f8a62b0a0b61fd0dcef7c5ab2cf3eb3126", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767505389, "uuid": "57fcba53-99df-4e4d-b2d9-7d9810b5b98c", "value": "T1DE4412BAB30967F5E889ED3BDD8DCE19E916061C12B227AF8651601F3DD443B77DA008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767505389, "uuid": "a75134b0-31e5-49bf-8035-ed22283ebcf9", "value": "cb6cec7f27008387172e48250cd60295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767505389, "uuid": "39e627cc-a124-4da1-9c9a-4e496011f798", "value": "6144:/99shBpDOJE4PEQZVOmbApzK3gARCicGknwSXj1sMH4:lCSEVWFADA14wSTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767505389, "uuid": "d20ebad6-09fd-4360-b1b9-4931e1181cea", "value": 261824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767505389, "uuid": "76f8509f-cef0-4333-bf2a-3c3db697cbdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767505389, "uuid": "0282c110-47f9-40cd-9411-0a1457b63b93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7545d09-e945-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767514662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514662, "uuid": "bd0ec2c9-ddb6-4cbb-b971-176be20c6e14", "comment": "Malware payload (Mirai)", "value": "eabad3c84bf05d93d7078e31baad9291", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514662, "uuid": "9d46392d-f66e-48e7-8975-c04353838c84", "comment": "Malware payload (Mirai)", "value": "44e0ffd03a8111ba221bf79be3170050751be49180bd653820dc3bca0c34cd17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514662, "uuid": "775e27ab-8c77-450d-99e3-6c41bc2c4cfd", "comment": "Malware payload (Mirai)", "value": "7c5ccb52f31be91a8db975685d064e18d58e7070", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514662, "uuid": "f10bc6ef-9db0-4bcd-81ef-94b8bbcca672", "comment": "Malware payload (Mirai)", "value": "88fe2bbd9a9f0c01c9fc5efe9567ba7175ac1866e9dd49dc26a86b89c44661a41d1af7956d0840f88204ca2e6286d48c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514662, "uuid": "a9a927f8-4d99-4bd9-a09a-d896b2ab2e54", "value": "T15F1429CBF801DDBDF80BEA364C531909B170B77214925B372257B967AD3A0E50927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514662, "uuid": "ceba6afb-4b37-48e9-a639-66350e460c63", "value": "3072:V3D0W6+PRn0wVQUW5SuM+uOT0mhgO7qIpjzJH+1Y+3PTJ9lZ++fFEVNjbihLCXVd:N/LnHfAS2pzJH+1R33W+fpLC7yXE60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767514662, "uuid": "816c3991-d23c-47a5-b844-0f0b09e7b478", "value": 200608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767514662, "uuid": "198a97c1-d2fd-4f17-98c9-12dc893f6b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514662, "uuid": "e43ec039-e9c0-4d73-ae81-a3c4efa9cbf7", "value": "executor.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46334b15-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509694, "uuid": "bbba9099-418a-40ab-88e2-6f9ca770cc9f", "comment": "Malware payload (CoinMiner)", "value": "fb45bf105819ea6094da176e6396a203", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509694, "uuid": "c64f8cb9-4607-4f6a-a1ba-39886ee7fc1f", "comment": "Malware payload (CoinMiner)", "value": "44e7c525635aa36edf00e2769c73ef528aa5e8a465c770a51f0fbd10f72f5591", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509694, "uuid": "2542519d-7210-4d75-95fb-f5befa772ccd", "comment": "Malware payload (CoinMiner)", "value": "1eb3c0ae63526d1772204c85d4a4b0b355c34f90", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509694, "uuid": "5e96e292-94fb-40f7-970f-1dec9ec03c9e", "comment": "Malware payload (CoinMiner)", "value": "84ec0a624927890483f1c495f61abedae32051cff3b76fcee2b7801db8440aba43fe4c50590ebb1f9936c897e6d5ca83", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509694, "uuid": "cf351ea2-ae26-428e-abbe-4aa67574bad4", "value": "T12FB5331202C3FA7FA09DE9C4A8FC7B350D6654F067282A52785F085ABC71FF901B791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509694, "uuid": "50cce03c-a71f-4e7e-a8d0-4a7ccad555ff", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3V:G3LG658+S8YrCpHy2dUuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509694, "uuid": "90283b03-e0fd-4c5d-9957-16843741a010", "value": 2277376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509694, "uuid": "da2d8482-34e6-44b0-b748-9752770097e1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509694, "uuid": "6a977dca-8e80-4179-a0ea-022bcd17436d", "value": "44e7c525635aa36edf00e2769c73ef528aa5e8a465c770a51f0fbd10f72f5591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99936a9c-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509834, "uuid": "9269b6c6-3815-4d76-83c2-f6b7acbb06dd", "comment": "Malware payload (CoinMiner)", "value": "5cf99b167218e63c9ad114272e285c12", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509834, "uuid": "6691ec68-cb43-47bb-8691-11c04c7ef43f", "comment": "Malware payload (CoinMiner)", "value": "44e95ff1fe83a1731ea65a19d1a76e31fec2b56815c6440063732828828c1cce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509834, "uuid": "fa31ece2-230a-4a47-95a8-def4ec062f30", "comment": "Malware payload (CoinMiner)", "value": "8b9ca6e3921308b4d5499fcee62ee94247c7a247", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509834, "uuid": "87ec06e2-767e-4627-bf4a-168278cfc879", "comment": "Malware payload (CoinMiner)", "value": "faabf0c0a76220c344482eb3b5a910ac727fe05a341f31b0ff718350f4de9f1b991b70df3aee4bc8dac654b0f2b7cf44", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509834, "uuid": "5f498925-cc9c-4b4b-b8d5-f4015d16ea73", "value": "T12E95336001C3FB7F559D9AC468FCB6311E2559E02B2956A6F80F0C5BBC32FE901A7D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509834, "uuid": "1fe2acc3-effe-4d3c-a843-638759b49c83", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dda:G3LG658+S8YrCpHy2dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509834, "uuid": "e7022820-39e5-4b64-a470-98bb2a060f93", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509834, "uuid": "19174f02-a063-4014-97a6-9c15847d00c4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509834, "uuid": "d1adf53e-cf4e-4517-b279-55bf04b7ceac", "value": "44e95ff1fe83a1731ea65a19d1a76e31fec2b56815c6440063732828828c1cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce973f88-e93c-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767510782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510782, "uuid": "e64700ff-a207-4ed0-9fd5-ffb6be0a7f33", "comment": "Malware payload (WannaCry)", "value": "143a3ada56e500d2fa4edb68faf643be", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510782, "uuid": "042ce9b8-0642-403c-a1c4-38a92b1a6d51", "comment": "Malware payload (WannaCry)", "value": "45a6da972965b7a3ae6015f8f3c6ad8812ca80cf693b3973e5e094c39746f425", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510782, "uuid": "c32cae48-980f-4026-be2a-7c9c1668990e", "comment": "Malware payload (WannaCry)", "value": "ed2fef7e5f8687d2fae10842774855a19847faf4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510782, "uuid": "b8607d60-1f1c-48b0-a1b9-d34ee082a4be", "comment": "Malware payload (WannaCry)", "value": "2440bf0dbd0c78dc51037de4e6a14077632edd9dbe02cb4f0d5295372a204f22a36146632e57fbddc0ec985a323eb9c0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510782, "uuid": "1b3d4909-23af-48a8-9ab3-7c0bd5d62434", "value": "T1BC36F121F18394F9D06322F001157937EFBDE925072FB9DBA780C8255A25BC1EB35A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510782, "uuid": "33c295cf-2ada-4dfa-8480-f39c8957a31e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510782, "uuid": "4508276a-7f1b-40db-b8c6-0862587dafa0", "value": "49152:RnsQqMSPbcBVQej/1Y0OuNixlZmur2u3+hPRdhnv:1/qPoBhz1zOuenmur2uuh5dhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510782, "uuid": "baa98506-b7ab-4225-95e9-709314cc5541", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510782, "uuid": "5e6da7b2-731c-4541-98aa-1df80c9f4588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510782, "uuid": "ed76b729-6f07-4eb3-a9b3-52a88262467f", "value": "45a6da972965b7a3ae6015f8f3c6ad8812ca80cf693b3973e5e094c39746f425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965b164a-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512405, "uuid": "d63e3662-0921-4b07-bb95-5962ee5853e9", "comment": "Malware payload (WannaCry)", "value": "51ba799f8fcb2325b5de4b26b3606e90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512405, "uuid": "0da57a26-c49c-4ca0-8317-aa2b76f516d5", "comment": "Malware payload (WannaCry)", "value": "45c9db17b92800e32e08bf2b5b22d6a7a4210b2d70b86d47b4bfe81b9967ec72", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512405, "uuid": "eb483ad3-a11f-498c-ac97-48303aee9797", "comment": "Malware payload (WannaCry)", "value": "f46d0f87ec9fa98cd62a9070f7c492234292013b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512405, "uuid": "ecac9598-40f1-4435-887f-df54688e2764", "comment": "Malware payload (WannaCry)", "value": "c75e9badd5323a06c017620eccbd198d053b7111515e5b4fc902fd987d674ca38e6327af52fdb8af4ede606574bc77e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512405, "uuid": "7bbd3e70-4d81-4600-a05d-f74ef9594706", "value": "T1BB363361666CB2FCD06917B2A023093BEAF37C2A6375871F8BD087950D03765AF94E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512405, "uuid": "9b787553-29a4-4727-b69e-a213119a9d50", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512405, "uuid": "a0dc9341-201b-4592-873d-7ae19913484a", "value": "24576:JbLgddQhfdmMSirYbcMNgef0upcL7nEaut/8uME7A4kqAH1pNZtA0pzH5ws:JnAQqMSPbcBVuaEau3R8yAH1plAmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512405, "uuid": "6ca4103a-104c-47f0-939e-a56ebea6e6e6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512405, "uuid": "1f8519a9-0a90-482e-8456-9998f236e985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512405, "uuid": "0813863b-d977-4d1d-96ab-a099b2122c62", "value": "45c9db17b92800e32e08bf2b5b22d6a7a4210b2d70b86d47b4bfe81b9967ec72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae9a86-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512976, "uuid": "1491a6a5-30b9-44f8-b3d7-ec2584a7c314", "comment": "Malware payload (WannaCry)", "value": "780b173de0ebd0b2a9f3416ca478af8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512976, "uuid": "2a71e9c2-3f6c-4f58-a46e-4362325e59ba", "comment": "Malware payload (WannaCry)", "value": "45def2258572f0550fc877fc074115862f484e696a1b79b0bc4f04e9710ae3f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512976, "uuid": "5684b6f9-489b-40a1-949c-10f54e558306", "comment": "Malware payload (WannaCry)", "value": "6694ddc254d599f39a84a7a96c9792fbea9615a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512976, "uuid": "f98a459f-da17-4736-b87e-6ebe7a5b05d3", "comment": "Malware payload (WannaCry)", "value": "2d439aa8cef095f8257dc42de55a284ff809a9bfa40b3c13b3653175c513560701f9fccbbf745371e933e0af20686416", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512976, "uuid": "2a1a1ff9-9f7a-4d0d-8ebe-c5c3a0efde75", "value": "T1E036236530A8C0B4D103157044ABCB62F6B67C3A17BA694FBF904E7E2E63B56E714B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512976, "uuid": "024b9364-9440-4cfb-b350-04c1fc8110c3", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512976, "uuid": "51cf0cbb-be8d-4cde-aae4-55901d8c27f0", "value": "49152:RnpEKURcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1pyuBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512976, "uuid": "354c2c26-5b18-429f-b8e0-abbb7a5b5b24", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512976, "uuid": "8b049487-984d-47a3-8e92-612e5a2cc8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512976, "uuid": "f60d20e2-8422-4517-9faf-c1f8c3243bd3", "value": "45def2258572f0550fc877fc074115862f484e696a1b79b0bc4f04e9710ae3f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36361e11-e974-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767534578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767534578, "uuid": "0fb90436-20b3-4ea0-9717-dc2cff229e4c", "comment": "Malware payload", "value": "471b14ea10752cf28963a77f27c1d4e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767534578, "uuid": "13653943-2c58-4bcc-a484-ad968cdfc86d", "comment": "Malware payload", "value": "4631bad05ddb2a68824c1517c4928f42cbf9417d339f36eeba7c8cce96d26d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767534578, "uuid": "cdd5da30-81d9-4201-bcd7-e45c8c70eab5", "comment": "Malware payload", "value": "9f77d33bc45482d529a28b07494af8b609111f41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767534578, "uuid": "6ded8b8d-7169-4218-8ec8-d014f90327c6", "comment": "Malware payload", "value": "7565f8aa61eed53520f0c10c06d8a2ead08eda2c03baf617727b6293fd3541584f7e6392ceaab544d05e50dd7474675b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767534578, "uuid": "969361ba-e556-4188-862b-128d26608e55", "value": "T1DDD533F844B3AE96E91FB76F7C0E978676DC9224C6D81FB46231B2055C338131D909BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767534578, "uuid": "90b61cd1-4420-4313-a069-7e2aa6b39925", "value": "49152:HK6lvnErLKzPahZEye3U1/60nZOLbcKl1Fkxp2FH9eqS/o0lD3hEcKbrAaNPx5K7:5lu6PKdeuDnZOMMiIB9nSZbO4Ltv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767534578, "uuid": "9bdc3a65-0bbb-4282-9b03-bd9fc27b3003", "value": 2956053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767534578, "uuid": "e0f396b4-6ff4-42fc-8aa7-4729772f1356", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767534578, "uuid": "8c7e6435-eda2-4012-b5d6-7e695fc33747", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ab2a5b-e991-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767546948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546948, "uuid": "605aab8d-6256-44ff-b204-cedc1efd11f3", "comment": "Malware payload (AsyncRAT)", "value": "0e51fca449cb9da58d7aa3d7508a0ae6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546948, "uuid": "9c4102cf-c129-45ad-991c-50600d6edffc", "comment": "Malware payload (AsyncRAT)", "value": "478b08749dd341444a0a859882c21bf63f2bd3e7efbe4def6e2f02ea6d4d8a53", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546948, "uuid": "4ed09c59-869f-4fc7-9bea-245c95b3afb6", "comment": "Malware payload (AsyncRAT)", "value": "e3aec18227e09acc0b41e9857cceb3cd9fde1959", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546948, "uuid": "9a70d32c-ce66-4cbf-b8c1-2fcd022463bb", "comment": "Malware payload (AsyncRAT)", "value": "045e8c8c48ecf000d791c52bfd533131c5125ea690a508620ff0d16a951f3b0ab30431e684ce536aed260eb29be7d034", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546948, "uuid": "df2d679e-430a-43ae-b141-8256750cbd55", "value": "T1A7535A043789D925E2AD4AF4BCF2950146B5D5732102DA5E7CC814CB6BAFFCA46223FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546948, "uuid": "7b04e7a8-8664-489c-9a18-1a1a517adf54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546948, "uuid": "cbaf08fe-b6e4-4c22-be06-68a34dd8cfeb", "value": "768:lWHkE7CUsMiPI68ir9JF0YkZI7g3mv/USmx1+HSCv7mqb2nlpwVoj0BU3+d8GrHg:lCszJUZIEWUxFGbbuwGqA+iG7PVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767546948, "uuid": "b3cfe3f8-3744-4092-924d-bffe415ea729", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767546948, "uuid": "5c7c682e-a20d-4f73-848d-dcf87d878883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546948, "uuid": "a2c6c997-4ac3-4924-9845-8a5ed023927c", "value": "InternetExplorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dda4f3-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517686, "uuid": "af6f1c85-dfe5-455e-9546-a59c169bca72", "comment": "Malware payload (Mirai)", "value": "a444ca8a936549fc43db35c8eb0d3653", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517686, "uuid": "c957bd28-21b7-471c-bd00-814af40049cf", "comment": "Malware payload (Mirai)", "value": "478d3dcb74b97c3459010226a389bc041e7608d5d0be34c9b9da7743ff6f3828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517686, "uuid": "e28f8fde-602c-4473-a06a-b3ddadfbae4b", "comment": "Malware payload (Mirai)", "value": "83cb42b348c29a5c09f728f3711d55895f0dd27e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517686, "uuid": "e8ed2294-2f66-409d-82e2-d87be49fc5ca", "comment": "Malware payload (Mirai)", "value": "5c04f5926735d97863f111533210216e9230eceeb80c627ec2856318dd31436e312ec5b24ef46232bb5af531cc566dc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517686, "uuid": "8c063f64-ed9a-4d48-9b5a-f456b3e46521", "value": "T180C30763DD669F2AD116E0F0B2F28E381B53BD6A49570A99A473EAF44143CCCF5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517686, "uuid": "9af352b2-1304-472b-9e75-03c520a44321", "value": "3072:LOVQLJXnheZln3b17cco8WJEenYwMzd1:fLJXheZln3xS1JdYjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517686, "uuid": "57249cd5-c608-43d8-87b3-b4ff8a1a2382", "value": 125576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517686, "uuid": "e2d1eb41-4867-439f-8828-3e6c1fb77722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517686, "uuid": "b31db0be-3271-4df5-8392-c27a355d63f8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e92e311-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509601, "uuid": "489fb355-3742-49c9-b502-bb4d31aa9b71", "comment": "Malware payload (CoinMiner)", "value": "1ebc68df94c714213623709f0bb442d5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509601, "uuid": "bb495578-fc7b-42a7-953e-04dd2a970bf5", "comment": "Malware payload (CoinMiner)", "value": "48a3bbfcf1ed4d853b7af824ed58a119e875d3f9192eedb83085ef4278f168ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509601, "uuid": "641db4e9-fdda-4543-9a3d-70ad0a6f308f", "comment": "Malware payload (CoinMiner)", "value": "41034da631b06b6a363632f02526a42ff5cb9f2a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509601, "uuid": "8936392f-081c-4dd4-97d9-d74cf8d75db7", "comment": "Malware payload (CoinMiner)", "value": "3065a1c6aa3b674f37213d0f587ebc1f1a148c63cc570c9376c018b62000fa2771f45ed404a5d5e2e35ae31c34ebae0b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509601, "uuid": "8cb7b003-d1e6-481f-ac8f-6a386e27ca27", "value": "T148C5336101C7FE7E504AE9D058FCFB310E6B51F0A7252622B96A141ABC31EF641BB52F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509601, "uuid": "180d5c20-3c43-41c6-8d9f-f33b08bdabd6", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi7:G3LG658+S8YrCpHy2dUu4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509601, "uuid": "37620196-4969-4baa-9168-3fb646b0fdd7", "value": 2699264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509601, "uuid": "6ab60b05-1190-4546-ba7c-34486bca17b1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509601, "uuid": "07eacf61-cf08-4290-9da2-b203c5cf585b", "value": "48a3bbfcf1ed4d853b7af824ed58a119e875d3f9192eedb83085ef4278f168ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2240ca-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567258, "uuid": "e15b58be-cd7f-44bf-b209-91e7f106e285", "comment": "Malware payload (Mirai)", "value": "112012c29667e2c6a6f20cbc035dbb11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567258, "uuid": "40c541a8-38ae-4936-8ea6-3cf523692281", "comment": "Malware payload (Mirai)", "value": "48d245dff8d62d6b2bbd39753939c0cde8545a6df017442dcb3241f982cdd19a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567258, "uuid": "c748b5fd-5d4d-41c7-a23f-bac640b5743d", "comment": "Malware payload (Mirai)", "value": "8dc0104c5fdbc64327c428d5a57e5f4d5510256e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567258, "uuid": "5b6cecbf-f6ff-4da4-9751-dc383cc88532", "comment": "Malware payload (Mirai)", "value": "e9c2f5af065d41bd3ceb6c46c72059ac31731e65cce0ae764f73461461064a307ee91238c5aaff77b400edc914e19029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567258, "uuid": "2d587373-cbf4-4233-a500-2fbc8d7d5c39", "value": "T176C2D0E07726ED31C520AC3EE52B4C8A3A51067C91FF353664159D358FC1A5A63B88B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567258, "uuid": "b4236e27-94c0-403a-88a1-7aefe060e1b3", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrx19q3UELuf:PKy4qfqoeJdXWgxILe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567258, "uuid": "199a54fd-3e2c-4b5b-a71a-6db081f42f79", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567258, "uuid": "d7f12e72-957b-4487-8c87-402f770b0e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567258, "uuid": "ef4a0178-2f13-4eb5-8673-cf4a604e8a09", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6f8984-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519962, "uuid": "07e18419-76fe-44cd-9b9d-baca48ce13bf", "comment": "Malware payload (Mirai)", "value": "0fce2fa5add6bd107bb342b70f7f9adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519962, "uuid": "135d80ec-ba47-46a7-ac42-19166cbe2f0d", "comment": "Malware payload (Mirai)", "value": "495589601b9205915fa41ee902dcf061441d70177fbedc0c658f524fbc3b393e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519962, "uuid": "7563f424-fee5-4d7a-8b1a-d01daf8562db", "comment": "Malware payload (Mirai)", "value": "835b57733859dd5f82a258106365db6646359865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519962, "uuid": "8b3614d8-6f81-4559-adff-eba328d2a294", "comment": "Malware payload (Mirai)", "value": "60a81fc895b92ab60b424f4e6fc9c831b232deea29abce3330de2150c4d5492fba63d7308d9a95982ee0f0a5deaf723f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519962, "uuid": "60bcffd5-96ea-4705-9830-b2561992d94a", "value": "T18B732946B98489EDC088F43847BF7176C516F1BD6339B1DB27C8BF1A290DE900B1D96A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519962, "uuid": "27e77238-8370-456b-8522-2c01da7aa21b", "value": "1536:O7faMW+Ryn1ddDhX1mB/LFxEva+dArY43i7SLF2UOqiFcc6iECOWYsJg:OnRynfdtlmBDFxEvaVJJdOjycqCOWYsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519962, "uuid": "3674f786-f6a0-4f6d-8769-a8a16cd36c46", "value": 76832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519962, "uuid": "84e1d730-d013-45fd-ac36-71e27efb8354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519962, "uuid": "bd70f97c-ce0b-443d-8c7e-56e11e953f00", "value": "Fantazy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af29ac4-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513191, "uuid": "beaf485d-915e-4f05-935f-6585f4668a89", "comment": "Malware payload (WannaCry)", "value": "198c6a0b4a257db95f0e744cb08ece92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513191, "uuid": "51cd88b6-d3d6-4766-a95b-75e268df6ece", "comment": "Malware payload (WannaCry)", "value": "496ccbaa8515503920f55dda70be96a848bef8af973dbfaa7073e5e43abe0811", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513191, "uuid": "f3ccc87f-3de8-4ecc-bfef-447a9c36924b", "comment": "Malware payload (WannaCry)", "value": "3a8e40f74ed7bf8c480d07455a7fe68e2ae3b7d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513191, "uuid": "63f8515c-33a2-4eba-9ccc-b7645f140cd6", "comment": "Malware payload (WannaCry)", "value": "7545848f9969866819ce1ac69c4435dff777f18818660b2c8388e64bea45dacc8724c21ce380ca456ba22fb480945bc3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513191, "uuid": "d6cb22a9-ebb3-43d0-b129-b52798009fc9", "value": "T18E36236D717CD2FCD10A267554A78963D6F33C5A22FD6A0F8F808AA60D03B59BF50A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513191, "uuid": "aee4fd8b-9a2f-4d90-8813-bc18560939be", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513191, "uuid": "46e4a18c-1c79-47d3-a41a-0c7c998fdf20", "value": "49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQ:TDqPoBhz1aRxcSUDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513191, "uuid": "9875ac5a-7cdd-4b8d-ab96-d32b3582ad4b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513191, "uuid": "55bf696d-f4c5-45ed-b989-123ef3adfdc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513191, "uuid": "317c5e5c-0842-456c-8ec9-e9af7b596237", "value": "496ccbaa8515503920f55dda70be96a848bef8af973dbfaa7073e5e43abe0811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37601758-e99d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767552189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552189, "uuid": "95174cb1-a18e-402a-ab2c-62fb0cd79184", "comment": "Malware payload (Mirai)", "value": "eab644c26ebff68af84221ae7b955891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552189, "uuid": "ec4c6bce-69fc-4888-aea0-cf485d1581f2", "comment": "Malware payload (Mirai)", "value": "49a9fe989569e30072b57e5ba13045380c80d79dd5c4f9e927d4bd287d545146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552189, "uuid": "043bd440-6a37-49f6-9757-aff63a554b71", "comment": "Malware payload (Mirai)", "value": "234aa0642c6e79a3f9449f5c8a5a5b7ec72b2872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552189, "uuid": "86adf3a9-caa0-46c4-88f7-5ac014a56769", "comment": "Malware payload (Mirai)", "value": "33f0f3ed15c03b930cd52537f5e53df8cdc22052cb429753800f9b70cfbac52ede1728ebf74195bfd28e58fe74010d8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552189, "uuid": "d146aca6-3de7-4d00-bc50-bdc052e92e98", "value": "T10C93022AB715BA7CC9368074FA9381783753921CFC5227ED3909A91F14264BDC5EEAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552189, "uuid": "75d1940e-f787-4b49-9c00-c1ab72c3086f", "value": "1536:9/0MqlCieKpdrbT2gvjoPvsGaPRvPflbcgFVkvtYZZ/0baC42Hqm6S+VcQTc4LU:9/4bH32gEPAH9bjFV8+h0bJ96pLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552189, "uuid": "531d1f2c-2125-4fc4-b955-d8ffa65f403d", "value": 92260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552189, "uuid": "ab79b061-d0df-4804-a23f-a5601a3ee55a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552189, "uuid": "e6a9b52c-c7ad-4428-95aa-65143b180f7f", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5854ed14-e978-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767536353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536353, "uuid": "db01cdb9-00d7-447e-b8a8-6633a0b461f7", "comment": "Malware payload (Mirai)", "value": "8a4c92621f71c6565c40eebd03d1421c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536353, "uuid": "798f0300-9ef6-41ee-9365-e58200bda8bf", "comment": "Malware payload (Mirai)", "value": "49baa52c3fda131a738b845c9f1010e361db5715ab76fb7ddffc9b5453476ffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536353, "uuid": "e40d5dfc-fa60-4bbe-aabd-692d8a2b2918", "comment": "Malware payload (Mirai)", "value": "38525fc1bcf8a791e86920b52df7b716f6124382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536353, "uuid": "15765e94-c40d-42e5-8b4b-ea1c370bff42", "comment": "Malware payload (Mirai)", "value": "cd576e2238a0e112c10b4a006e24b6a4d5d7dbf5d0240c3c475f0a1096d0ab6e4a44774d6bf56da4c4598b5d6cfe42f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536353, "uuid": "197b1adc-3dc2-4617-983b-e0d0b0a4f1e7", "value": "T158E36AC5E28FC0F6E80251312176BB3A5AB2FC3A523DDA87D7B89A71E8835C0D51675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536353, "uuid": "56d3f8d3-303b-4654-8d5d-abf9a85889ce", "value": "3072:iZ6vM0I0UkSJffFrpSrB6MgAqsdE8fh/g3PKYKnBq:iZ6vnI0UkSJ3JpQ+/KYKnBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767536353, "uuid": "01b110f3-97e9-4472-beb4-9b940f5a37b3", "value": 148556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767536353, "uuid": "6738812a-bc17-4a65-a29a-71ebfbb6f837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536353, "uuid": "8165c4a3-3191-4ec8-8457-46484d9b3f47", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f426d1-e9c3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767568830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568830, "uuid": "eabe2b0a-d2ce-47a1-91b6-f3505f084ebc", "comment": "Malware payload (Mirai)", "value": "fcf73ae13534b5f8cd43a696e1e5ccad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568830, "uuid": "9d54cd02-4489-4e74-aba7-c7734a41132a", "comment": "Malware payload (Mirai)", "value": "4bff688f2817cc74b2475f40edbec64df2132a73307a5f318f3080c3765c8a90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568830, "uuid": "debc323c-3197-4d59-9c25-dba408aadba7", "comment": "Malware payload (Mirai)", "value": "1d11cd9b84bee69221c445286e2ffc9935d3d08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568830, "uuid": "aacf5f44-cf32-44fe-810f-fd25edf32ba2", "comment": "Malware payload (Mirai)", "value": "98ab159dd46d1ee2e10a4194862e904da62e9a49548c44f8b6d9f68a6130a0ac87f11896f4f101c66770864de1505fba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568830, "uuid": "16702323-2317-4f5d-aa60-9c9321d5993e", "value": "T1298302AF2E9ED8EDE10FFA7E1268A37A6208BC41185C1972E50110E4CDD4D55AEF1A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568830, "uuid": "9f92e33c-8901-4e47-9d8c-b99437d45281", "value": "1536:EhmyLPX/xSucVhGTtcQaCKL902zr/gd3HtunPaAoKzw5Ga:PyLpSrkTLaFL2mnPaCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767568830, "uuid": "8bd87342-7fa8-40ad-bfe2-8f45df74ee14", "value": 83040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767568830, "uuid": "29456607-b0c1-4abd-b0b6-998bdb7fe2da", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568830, "uuid": "f235e152-e78e-48d2-a603-34950444e633", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de121a9-e94d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517813, "uuid": "7754c779-5105-4a34-a097-37f5a0886632", "comment": "Malware payload (Mirai)", "value": "8b746277f33d45978f31e0888cf6fd55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517813, "uuid": "bb3982f0-b760-452f-9434-5661fe28d576", "comment": "Malware payload (Mirai)", "value": "4c0896abd837f7263217ec3a9735eb5f888acfbc70f9ef4cacaf7740ded45cd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517813, "uuid": "0ec325bb-ca28-4e71-9385-500ca0abb00d", "comment": "Malware payload (Mirai)", "value": "953a4be999988c7f890151192dd8896cf5f13764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517813, "uuid": "5aa79c58-ed4e-4ade-9c54-82c1333f77fc", "comment": "Malware payload (Mirai)", "value": "a76afc436504e1de8e31830588451e1cf191b99033a990adb70698b3df64c4ca1932545d208e9922d96f043328aff93d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517813, "uuid": "54565b22-44f9-4fad-afbb-323c1b3b4c7b", "value": "T1D3A3F582AF43DFB3D45320F542B7AB258A31FC3B8C36D685E375BDA18A115D1A616338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517813, "uuid": "218dbfdd-c1a0-44cf-8334-d3768cc16033", "value": "1536:BbtkAP0v6MwnVN2AW/a1bwt3zERIFG2MSZN/GUMOmSzQP9:RP0vemC1bwtjERIc6oU3Ju9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517813, "uuid": "b93e993a-ba21-4bd2-9ae0-e765c07c16e5", "value": 102012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517813, "uuid": "537ff678-25aa-4a37-936a-e9239ac4f9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517813, "uuid": "d1238cbc-5f5d-4717-ac20-0d53950836e5", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07e45d4-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509926, "uuid": "0a95f259-6997-4832-9d84-09d8ff814932", "comment": "Malware payload (CoinMiner)", "value": "01809b75d06c9a7a197cfb2612442c05", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509926, "uuid": "842648f6-b5eb-477d-8ea8-9441f895fbb6", "comment": "Malware payload (CoinMiner)", "value": "4c484166bbe596b0e12c8bc60e99d509845b6a51efee6ad26b33279e287aa5c3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509926, "uuid": "bb914a06-5c07-4801-a418-447e55cd627b", "comment": "Malware payload (CoinMiner)", "value": "fcaa63c75e0662de5f68fc3c90a90aee7d280392", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509926, "uuid": "b8891544-9307-4fae-9707-117f57fcae65", "comment": "Malware payload (CoinMiner)", "value": "b256016db95fbddb6b113441f837e3c97e184a26659b219c577869fb2705e096a22d53e5d4c42adf458b36cdbbdd0344", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509926, "uuid": "f6798552-8cf4-427d-bf04-8b161158740d", "value": "T1A07533E001C3FABE56D89BC419E837350E6155E05A396A5AF84F0C5BFC71FE8066BD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509926, "uuid": "26b71bc0-e0a5-45a8-a39b-0987e1fbc8c6", "value": "24576:G3LWjlhQ4nr0vJbDFF4xjPQ86X8ut9QF+8DfiHJqZp8C18zp0iZy0TTvUTosUn8:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509926, "uuid": "96d2ed25-061b-4a41-a0cf-4e05df631ba8", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509926, "uuid": "7a274253-8e43-4e8a-80d3-239315585c9a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509926, "uuid": "b811a75a-4dd2-44a9-9c49-b86770d301ca", "value": "4c484166bbe596b0e12c8bc60e99d509845b6a51efee6ad26b33279e287aa5c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1602fd5d-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509184, "uuid": "c56a2fc3-859a-4fb1-9f52-7037483214e7", "comment": "Malware payload (CoinMiner)", "value": "8c17775df5a81067ad7f0421ef55f2eb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509184, "uuid": "c0e90b02-230a-4682-96ae-8c550aed1c9e", "comment": "Malware payload (CoinMiner)", "value": "4d37cbbcb7287fe0498f3af2d1fba663c0f8ca9652841c0748808ba9010817cc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509184, "uuid": "7a8c51db-b0fc-4a50-9152-89c24a2b4aa8", "comment": "Malware payload (CoinMiner)", "value": "3bc63719719472e5c774d8ec4194c1c5400468a9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509184, "uuid": "c69ef4af-cb02-46d8-bff8-34d1da67ac42", "comment": "Malware payload (CoinMiner)", "value": "f4ebe73c6d070e93e0e9db0f15f160cf67fb8e175892684fbef38edbb4cc9c5f908863f1e490f2962a00daccbdaf6f55", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509184, "uuid": "ce8c40cb-e1d7-4fe5-8cd8-b80c6a5b73dc", "value": "T10A0633A601CBFCFF6885D47858F8BB360F5551F19E784165B9290829BC26EE3407B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509184, "uuid": "9e4cef49-8fd1-4519-96bd-d678d6873f4a", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgM:CC65sr3KrCfsYiZQgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509184, "uuid": "25a2d112-e528-44a6-9d45-e27e9e24c889", "value": 3903488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509184, "uuid": "a6ee69c2-c4d2-491a-98d0-28fe9ddc8e25", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509184, "uuid": "bf826bb1-d004-4e16-94f2-f3403b88ba2e", "value": "4d37cbbcb7287fe0498f3af2d1fba663c0f8ca9652841c0748808ba9010817cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68c6253-e96d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767531867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531867, "uuid": "8fa7a320-fa19-4793-ade3-29377442a1b9", "comment": "Malware payload", "value": "1ddd9e4bbde05628861fbf4eef0bc819", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531867, "uuid": "2689cd71-b227-4015-9831-7a52c92cfe82", "comment": "Malware payload", "value": "4d7bab90bb6afd463918c1470cfb79e9c87414876b22f4e148966ed3c8f790b7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531867, "uuid": "78eaee91-0bd9-499b-bc1c-872e054abdb3", "comment": "Malware payload", "value": "440b929b60cf29dd8c229bfe0b5c2adad02bf841", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531867, "uuid": "314d35aa-6cb4-449b-9b47-4a83a3e75a8c", "comment": "Malware payload", "value": "123da234e9d13cbbba8e50b3a9569e067abc58f5409a11e1f4a973f2885181c9c4a5dc7c0a7a39d0429704d86b3913e6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531867, "uuid": "f367f22b-377c-47a7-b5ca-1158c31e50f9", "value": "T1E9062224F261A4FEEE66867C89121106FEA27C628721DBEF135089375F17BE05E3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531867, "uuid": "2c378339-605d-4491-9450-b28f0de8ce32", "value": "3b4447580904d2f483c38cc264186fba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531867, "uuid": "e2d8c5a9-c686-4875-82c3-c4eafe673cf3", "value": "24576:eA+zbpalL1g8wZ+apu0XDu46Nj6AN7c6YGwDKVHrE+9Lk7O9NmTBu5c8Gm:4zMlL1g8eK0MN/Ng6IDKVLDK6Sgcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767531867, "uuid": "098954c5-025e-484c-bca8-6ccd7806fcad", "value": 3795456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767531867, "uuid": "9fe45ec1-1b8b-43cd-ade6-8ff1f8ba6797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531867, "uuid": "b7540bf2-9593-4860-a8d6-83d32123491f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d20e863-e98e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767545676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545676, "uuid": "6060cbaa-2c50-4067-91cf-c2d9ea38a4f3", "comment": "Malware payload (AsyncRAT)", "value": "6920daf1b733b874af3e124046acf9b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545676, "uuid": "5809c6be-b1b8-4e64-9d77-887513454f52", "comment": "Malware payload (AsyncRAT)", "value": "4e6b67e845d6d452927d6fb370b806d0d19a1362d5abb4826544b49e91ee15e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545676, "uuid": "848cea2b-3407-469c-998c-05c67b698ace", "comment": "Malware payload (AsyncRAT)", "value": "7800bb233d6a5a7b786fcf8e09068eaacbdae0c5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545676, "uuid": "e9066bda-5177-4b32-ac3c-ba4c6b2f3a00", "comment": "Malware payload (AsyncRAT)", "value": "864f88bbf402b22181a448ccc95ec375efa087d2167e27662d15f3baec58bbde315d4cfc545ec576b7348105badd41f3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545676, "uuid": "6deeaceb-9d98-47ab-b05c-74fb6e923205", "value": "T1AE233C003BE9822BF2BE4F789CF26145867AF5A32603D54E1CC4519B5713FC68652AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545676, "uuid": "f06c158a-6cb0-43ee-bb86-54ff07b76835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545676, "uuid": "9458dd53-ce36-44e9-82ab-709cf3be1584", "value": "768:/upf9Tx5PWZZWUvfyRmo2qg9sa7r0uPINzjbegXZiGLSneWKOWF8jBDZ/H:/upf9TxtOO2xsmAXN3bhXoySeDOWFwdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545676, "uuid": "8f09e179-7257-484a-acf2-ea5c0d19322c", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545676, "uuid": "0fc906b9-c8db-48bc-a9e1-02465156aeaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545676, "uuid": "04d8940c-6825-4cd5-9d3c-cf52bb918c3e", "value": "Go88Desktop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a880325-e935-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767507500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507500, "uuid": "ec8e58db-2b1f-49cd-b9f4-d01fe2289c27", "comment": "Malware payload", "value": "95427a095c29547c19cb767a8b4a8949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507500, "uuid": "1b19a8b9-053c-437b-899c-7c4928440576", "comment": "Malware payload", "value": "4e7384185cdff726ae05bad052983c0b3854bd5a3a69897d980cacef2f9a06fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507500, "uuid": "2b768edf-4c69-4bc3-b6bd-da9ed1035cc7", "comment": "Malware payload", "value": "45ea9be58c9d8f2691c06a33af43c1a70e5e10c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507500, "uuid": "402bd52c-f2c6-4115-928c-0e5717f5f51d", "comment": "Malware payload", "value": "a19de113d810ce184b55df39d68912c00c8ed576dfd59d9b9a10d58cbab3938c0267c93f6e2dcefe677caebb30271bab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507500, "uuid": "234f08e5-c881-4aa4-aaaf-c7c5f2e411b4", "value": "T1B594DF12F3103EA7E10A9135588143046B84AE7573E29302FF97B6B9656F1B58F387BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507500, "uuid": "2f4a1dba-a5b0-4c7a-8e78-d282f16936f8", "value": "12288:jeOQTNK9VSTaCjxgiInSD3AYQnaRXSypmnMzYjQv:jNST11giI03TTmMkjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507500, "uuid": "f63e3b02-f47b-4bcf-a5da-9841fb1d8008", "value": 432288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507500, "uuid": "6b2c93f8-6671-4aaa-a5e2-8841f352105e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507500, "uuid": "0945618d-d0ef-4ce3-af48-b3164d73c708", "value": "rondo.armebhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e131c2e7-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517685, "uuid": "7bfbe9e4-0a39-4789-851d-441298ecdcb8", "comment": "Malware payload (Mirai)", "value": "743c1792d92c9570ff3afd0a31875ac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517685, "uuid": "1c682769-4f13-40ba-91c6-ae3f59cbc263", "comment": "Malware payload (Mirai)", "value": "4f257a13ffd805be0f85de05168830ab684db593ba2388de3a96c9e8332c3346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517685, "uuid": "fde53dba-6b53-4321-8640-61400ad87dcc", "comment": "Malware payload (Mirai)", "value": "66e47ee094d61efa4cc623060b7d91328f600fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517685, "uuid": "90c91bdb-db27-40d4-bfe9-703bf7774b00", "comment": "Malware payload (Mirai)", "value": "ee8e55d25673e39e0d67bae865d01f0b1db1eff6748d81706dc98f5f84d2548dd4ca8596d11e9ea05b24b711e3d87db7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517685, "uuid": "eed37439-56b3-4247-bc2a-bd97dfe79d50", "value": "T17714C70AAF620FBBDCABDD7702F90A0128CCB85725653B753574E928F60A58B49D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517685, "uuid": "445cec83-a3ad-4032-ab13-4ae898f6d70a", "value": "3072:5Y0NxsN+4gI65vZV8xaQw2WaHExwFVgZ8F:5Y7N+405xGuftwbjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517685, "uuid": "284ed83e-9046-42c0-9fa5-cb2669454cfa", "value": 191768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517685, "uuid": "98cbbeae-3985-4ebf-b8fd-390f405b02f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517685, "uuid": "62a1bf4a-e527-45ea-976a-9906e2c37a84", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7e3c3e-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Virut)", "timestamp": 1767511260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511260, "uuid": "18c2063f-8889-49ea-92e8-1c91a4e9ae5a", "comment": "Malware payload (Worm.Virut)", "value": "a86ac5079c0fa733090a3d75b3df2e37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511260, "uuid": "24644049-f92a-4ac6-9e9e-15db5f6ac9a9", "comment": "Malware payload (Worm.Virut)", "value": "4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511260, "uuid": "c49e4a13-626a-4e05-9da2-a74b3fe8ae61", "comment": "Malware payload (Worm.Virut)", "value": "b2beff735401274a8ba8f3756766880328df21de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511260, "uuid": "9f58ae57-4693-4c7b-9830-fc1aac650345", "comment": "Malware payload (Worm.Virut)", "value": "0fee837124468758ca1efd0b1768760d3646f89578a284f75533e9febb1d7ae35ec0ba427767878c871877c269ff340b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511260, "uuid": "9d35c6b6-f21e-40f2-b550-964d9279feff", "value": "T16436235A766C90FCC11A627964634A66E6B73C5A327D920F8F908B520D13760FF78F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511260, "uuid": "d2ee929b-50f8-4591-bce7-7605c76df2a9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511260, "uuid": "f88e0b7d-7c4e-410b-afb5-4c8261061754", "value": "12288:jibLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFd:ObLgddQhfdmMSirYbcMNgef0QeQjGt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511260, "uuid": "17153020-0e33-4f89-8f04-594e62c1182e", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511260, "uuid": "ba5f27db-2e8f-4fd5-a611-726f9a572d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511260, "uuid": "4cee14ae-8679-463c-9047-88e4dd9ab352", "value": "4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c116fd-e978-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767536314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536314, "uuid": "a3bdd673-77f3-4b6f-a3b9-7666bda5f49d", "comment": "Malware payload (Mirai)", "value": "193a18c0613d9aa10dc1a4842454118c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536314, "uuid": "ba21c99f-a5ac-409e-9eab-f82e9f1a9845", "comment": "Malware payload (Mirai)", "value": "4fd9552897d87ab63fef8a228d25388101e549e12d233cf1b214922058dc5a73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536314, "uuid": "f7f5ec33-8c61-4290-b1ce-7e6a0441088a", "comment": "Malware payload (Mirai)", "value": "fca3969e46e137625813c1279f9f45f568671df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536314, "uuid": "df3baab4-a329-42a9-bced-bae30311de88", "comment": "Malware payload (Mirai)", "value": "482857c787b918ab425c6d3c0252a1776c67277b809e38c4b8ffb0610d0760c89f54fae3039be9000999ef3c227534c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536314, "uuid": "dc4f648d-b4e6-40ae-938f-5737e8739858", "value": "T1D643018200DE4642CB7B2037B2CFEA068992474529C103DDAFF8781568DEB75734779B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536314, "uuid": "bf555c8d-0ae2-4b4c-9760-d18f57ca6605", "value": "1536:b/2gJkgfeSjUUmZ9rqzG/u486qytSRO6/Kv+BL0yOnouy8HyE:yEJNs9+zCNjtiJM+BL0yOoutX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767536314, "uuid": "842e638d-85b6-4369-be42-30493b969b8c", "value": 60020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767536314, "uuid": "1c118fe2-e8ae-449a-8873-e30b2be6a471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536314, "uuid": "934aded4-25fb-4376-9aed-2dae214780e3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5c9bde-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513222, "uuid": "f5ebc3c9-8f0c-44a1-b165-22b73e076357", "comment": "Malware payload (WannaCry)", "value": "8090ed29e8afa2d04b54ee0cf4b573c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513222, "uuid": "5d816387-0639-4b92-b129-f8c3437a1a68", "comment": "Malware payload (WannaCry)", "value": "50513f3e383da1173175067c95f20bb81bd00b33cb85d4dd41c341d91a23290a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513222, "uuid": "646b2aae-b10a-4527-bd14-6e2465b42ee2", "comment": "Malware payload (WannaCry)", "value": "642913feed72e220aa168f5a1343379125cf5acf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513222, "uuid": "b857f58b-ab92-485a-ba1e-ee12839f00cf", "comment": "Malware payload (WannaCry)", "value": "1b4f69933b4572ca828a798fcaa6edf736812b907ba2a18379b44d33056bf4e44f49e19633232eebf8d6f788a2b4d8d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513222, "uuid": "b217722f-0d15-4e16-b4c2-f5afd80658f2", "value": "T171363368723CD5BCD10519B40467C927A7B33C6666FE6A0F8F5089670D13B6AFFA0B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513222, "uuid": "6aec677a-89b3-4284-9e68-a8ee4c04ba64", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513222, "uuid": "2acd631d-b064-4b29-8cd7-849bd16a8ff0", "value": "49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9P:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513222, "uuid": "7ffee1ee-64fa-4744-be11-571292053b9c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513222, "uuid": "f49cb6d6-24be-451b-8618-08ec7a4df117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513222, "uuid": "b335a148-4f3b-4126-b93c-4f0f6723c468", "value": "50513f3e383da1173175067c95f20bb81bd00b33cb85d4dd41c341d91a23290a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8e6d89-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509352, "uuid": "c9b86162-db70-4bb5-a7c6-b0013a52f830", "comment": "Malware payload (CoinMiner)", "value": "8ec9b0a480597dd6702146a3bc1a6440", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509352, "uuid": "0ae1e8cd-3c75-48d7-b459-3c01f2dfc1b8", "comment": "Malware payload (CoinMiner)", "value": "5144e9e0ec1af3a8aecbec068911ac00ef43e65ee806eb824694a5f1fd1f2e21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509352, "uuid": "7fa8dd95-b736-4069-87ba-9baeaa0f0cfd", "comment": "Malware payload (CoinMiner)", "value": "e37fbb9f1922421813738013397cfc8deace8025", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509352, "uuid": "e9bce417-2173-4376-903f-3922ccad96b5", "comment": "Malware payload (CoinMiner)", "value": "6e8040deb853390fab860942973b9c089c6f7c0bde9e21669cc01fe95a32edc0aada7559964547f74865b4d9d89160d3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509352, "uuid": "87ceb5ce-71d7-42b7-b45d-7e96169cb68f", "value": "T1DD16332511CBBDBEB585C828ADF8FB324E9925E19A784111F83904297C65EE3407F72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509352, "uuid": "d42abab5-37a6-44c0-b6f4-e726e79ec836", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhG:CC65sr3KrCfsYiZQgzJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509352, "uuid": "4bb2f79f-4d6a-4725-afb0-d438d441067f", "value": 4288512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509352, "uuid": "669efbc5-5525-4d01-8c36-23fa344e5162", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509352, "uuid": "f5bd3491-342d-4f38-a42d-c05292b911ac", "value": "5144e9e0ec1af3a8aecbec068911ac00ef43e65ee806eb824694a5f1fd1f2e21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5550d4b4-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511437, "uuid": "80a28426-d6d7-4088-b121-aec8ac4de81e", "comment": "Malware payload (WannaCry)", "value": "93dccec5044f671be4a063f121744dd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511437, "uuid": "a3f32594-55f5-49d1-9bfa-3710f80a4f8b", "comment": "Malware payload (WannaCry)", "value": "5174ac8dab94a0dbfd0a37d348008a9a42d4787c519f8b5e9bb5f109cc403ba5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511437, "uuid": "96c0488c-6eea-4e0c-a434-96852e612aed", "comment": "Malware payload (WannaCry)", "value": "89d0e0e1c77c6e24aba2963fce8c9dba56794a1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511437, "uuid": "61794246-389a-4f9a-b538-06b1cf808658", "comment": "Malware payload (WannaCry)", "value": "171e7c6824d8801c6c34caf62baaf2ba809e61033cccc1d6be84ff3407dec1edb343aa6f1f4f22579d8a217bd93f25b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511437, "uuid": "802ceb0e-13a6-4c18-a091-a0134e535d7c", "value": "T1D3360115E1E86B64D6B21FF6217B8710537A3E4589AB925E1760A04F0C33F1CDEE2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511437, "uuid": "93a5ee75-08c9-4eb7-8487-f5a60a4f82ff", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511437, "uuid": "25f8e96a-9c0e-4399-b458-8d86cb51d39a", "value": "49152:RnsEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA8:1fPoBhz1aRxcSUDk36SAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511437, "uuid": "d6d1afeb-851a-4420-b376-24f7c2c28c44", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511437, "uuid": "494e9837-9b35-4531-a9ad-51d6965eca17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511437, "uuid": "a8c70d49-afdf-49ae-b43b-034ddc35df2c", "value": "5174ac8dab94a0dbfd0a37d348008a9a42d4787c519f8b5e9bb5f109cc403ba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d88892-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509447, "uuid": "b3724902-fa6a-4255-97f5-80215db0f92d", "comment": "Malware payload (CoinMiner)", "value": "4d873b5a00e0402bfc1fea3466752f65", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509447, "uuid": "ef6ca388-335c-484b-837e-3abda35e529b", "comment": "Malware payload (CoinMiner)", "value": "518f804a1854541c2b23dbbf0294468893254df5d5268b3fc1de29269e43efc9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509447, "uuid": "b26d89dd-f755-4e15-a8e0-bfafa5579ada", "comment": "Malware payload (CoinMiner)", "value": "961fdec37f570cf9c35bff23be4cda2db107a1c0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509447, "uuid": "76460ea8-d8b3-46e5-8908-bf5ba4565fb8", "comment": "Malware payload (CoinMiner)", "value": "4156cb2494448c416934bc8bc05aade1601591043bcd78fb6c79dc24a1e7c5687b6042a37e53fcd820aa6e2d2a800d26", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509447, "uuid": "6e733be1-8514-41f1-a87d-88167dfb43b5", "value": "T1EEF5332101C7FCFF5985D4A054ECBB310E6662F19B689664FE690429FC25EE340BB62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509447, "uuid": "623d58b2-95cb-49a6-aa15-df5c696e83ed", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vH43vQ:G3LG658+S8YrCpHy2dUu4KrCf43vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509447, "uuid": "2220d219-49f3-4611-a80b-40b51f1471b0", "value": 3448832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509447, "uuid": "07298863-04e1-4b7e-a197-a67658b2dcea", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509447, "uuid": "4879f9a5-49a2-44e6-b563-9b614a55b2b5", "value": "518f804a1854541c2b23dbbf0294468893254df5d5268b3fc1de29269e43efc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86866f6a-e98c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767545021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545021, "uuid": "fb42ef3c-1378-4b28-8358-e0d0fecccb7e", "comment": "Malware payload", "value": "7e584814b2603e65e5fb034d7c0daeef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545021, "uuid": "ddd8a4f7-33e0-4eac-a2e4-e5ce8a650918", "comment": "Malware payload", "value": "519c74b092c2908924d48c32dc2c31e061020c3e58cea3f1cb79eb6b71c1d16f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545021, "uuid": "9b503206-31e6-4247-acf7-e3f42032a36a", "comment": "Malware payload", "value": "947bec4da28299d39489fbe97a0320861172346c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545021, "uuid": "7fb425a5-70ab-4933-8f3c-ee12a8939c45", "comment": "Malware payload", "value": "54a84db2429badfe698f9b9d2f0782aa8ba00af5e167f04618f22d01c70b507c3ce7a153f0c4365d8f9b95e5c6d01ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545021, "uuid": "b07e3c18-691a-4421-b4a2-b9010d19672d", "value": "T1FD086B4262EA04C4F9F7DA759AE66617C673BC122F30C5CF221C17291F736E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545021, "uuid": "aa4af7c4-07af-46f8-9182-c61fceb3b642", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545021, "uuid": "fc2e3792-3c6f-4d4e-91ba-d8a4aa737406", "value": "393216:0kmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNK:05NmdsJY62A0y8Xy5rs3wb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545021, "uuid": "e1c08146-425f-4ad9-a6cb-8eeb2a2af8a8", "value": 82116070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545021, "uuid": "16d17ee1-b0d4-4dcf-81a9-05ea8e2b9361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545021, "uuid": "7920b313-939c-40a2-9f2c-1803de707e91", "value": "n3k8r1p0zu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1010d43a-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567156, "uuid": "0c63dc0c-4804-4089-922d-b52216e68868", "comment": "Malware payload (Mirai)", "value": "8d492c737c3ba77937aa3e46d522d34d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567156, "uuid": "bdf495ac-7b57-4ee9-a633-734e738ba063", "comment": "Malware payload (Mirai)", "value": "5346313aa9314d35117977182ab6d2da1e328ed73b6c0dae71907cba16257a64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567156, "uuid": "4c784ca5-fbb5-4af0-8a0e-ba2c94800737", "comment": "Malware payload (Mirai)", "value": "f46363ca48868e3443e0cf5d1865b1f157e2edcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567156, "uuid": "f64580d6-58bf-4767-b2f6-d39bc79dec8c", "comment": "Malware payload (Mirai)", "value": "949ad526951c0cc3d96b1f0feccb53a22de837549be71bdea55be789f01e55dda8ba882868152d91c01c442d87979a3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567156, "uuid": "73d7213d-81a1-410f-b50e-8da45b4c5064", "value": "T16BA3C50AEF600EFBD86FDE3745A90A0535CC554722A83B3A7674C928F64A54B4AF3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567156, "uuid": "4fa53258-12aa-436f-95dc-8356c4855e80", "value": "1536:AX/710ISiGVmDeC3Td4Jq2GtkZ26ffGVjFpeIvqi3B5yDTV/LLFQl:K/72YBt2t8baiMTVvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567156, "uuid": "f9bed612-7e40-4962-b33b-f73d9577d226", "value": 105668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567156, "uuid": "e53a1460-35f3-4a7c-b04e-2ab7a1166c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567156, "uuid": "c7f1ba9a-da54-4617-a131-59938ed1e43e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fc7555-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516775, "uuid": "74a530e6-523c-4091-bd4f-c7a2c7e8066f", "comment": "Malware payload (Mirai)", "value": "9d00be4fdce186b3658f408091fdfd81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516775, "uuid": "29181f7a-74c7-4edb-8b38-7cc405b307c0", "comment": "Malware payload (Mirai)", "value": "539fe644b3ab28ee19e8725e4a7a3a4a73c0366bf24be2e34def22eefa1fc839", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516775, "uuid": "43a6091a-b8c2-44a8-a18d-31c552adf538", "comment": "Malware payload (Mirai)", "value": "5c98092e1758384a77c4ad8b4726aaa79a9eca2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516775, "uuid": "06c3c436-816b-4126-bb4f-de126dd18b10", "comment": "Malware payload (Mirai)", "value": "260a4d5c2f8aa7bac861dddbfa39af112ffbf2594d2f5929a407f70fd7cf6c8528740bf96ad614046726aa4cf15c54e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516775, "uuid": "3cbc008f-8f77-4708-86ef-08b03bb469aa", "value": "T1EBD33B56B9919F11D5C731FAFB9E414933136FB8D3FA71019D206F61238A99B0FBA202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516775, "uuid": "d1a938fd-cbff-476c-8cd2-b4df5f6ae9e4", "value": "3072:psRZMM7BN+/NG7VqaLO9i3ICJt7svve2Etz7sRJBb:psRZMsBuKYaLO9i3ICJBsvgzoRJBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516775, "uuid": "cf7a027a-1aa9-43dc-92a0-ef0fc5ca6d31", "value": 133424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516775, "uuid": "b2c1adb3-5c3c-41be-af76-2dc56b99b224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516775, "uuid": "4d6ee560-642b-4d54-8b5f-57ac67496421", "value": "539fe644b3ab28ee19e8725e4a7a3a4a73c0366bf24be2e34def22eefa1fc839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d08389-e998-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767550205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550205, "uuid": "888d60de-c66e-42f7-9bd3-8d82aa0dafd5", "comment": "Malware payload", "value": "2317ca71bb85351958efeda1ec3a939e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550205, "uuid": "ae965913-2b29-425a-a961-4059d526a21a", "comment": "Malware payload", "value": "543594bf52ef47ee4ceca4a23ede9f9065ab14ef461c56e07a9964886e73e604", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550205, "uuid": "732f7f20-9328-4b4b-ad4f-d683eba6d7de", "comment": "Malware payload", "value": "cf71c19648d779843c2b1e3b9f54e82646fa2b15", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550205, "uuid": "359eacf5-12ef-4b58-8c67-d91f9ed33b67", "comment": "Malware payload", "value": "6195055579458686e8a2b5834710934ae9880910ab3881777c3c29ec6d4e2205765e60f6271f3b16980fb57b8cf86c07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550205, "uuid": "d81f9d08-5c17-4e0d-9183-f6a9aec6aca8", "value": "T158228E10E9D428A0C50FE3BBE67F59CDD6190AD930599C8AD3086890F69F082CBE7E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550205, "uuid": "fa5dc184-2580-4d76-9665-38fa9346e837", "value": "192:h+02TEeyQzmrYLgrT2GZoSRNUcNYbmk4x8keNB7R/QXJO5WtsJeqPdZ8e53Z4hST:sPz5oTRwcNSmk49ABV/QXJO8c9d55p4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767550205, "uuid": "ffb45baf-d030-46cd-8296-38065bbc9249", "value": 10697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767550205, "uuid": "e0ee3de6-8c7a-4277-8cc1-ca4d78c8a31d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550205, "uuid": "d0bcee0e-6954-4f55-af0f-1e88a79009f5", "value": "quebecgolfkiloch.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3615b0ae-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509237, "uuid": "38a489f7-8bcc-4771-887d-977e5ffac9c2", "comment": "Malware payload (CoinMiner)", "value": "e9e8a0e3c1aa006b4852b701231b0d3e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509237, "uuid": "6d8ae7ea-e716-464a-ba5c-74ca6fd96dc9", "comment": "Malware payload (CoinMiner)", "value": "54515d1fd5b1561ff68c4c1719f12d837d8d448fc7ea38e7fc9e53529debd747", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509237, "uuid": "afeee9ab-5ae4-4c86-802f-3427c0423458", "comment": "Malware payload (CoinMiner)", "value": "e8273af7bc5f166b2485f6d3163586fc719fc3f6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509237, "uuid": "43cd5b81-b69f-4244-aa7d-f0d6fa53a6fb", "comment": "Malware payload (CoinMiner)", "value": "ecd85e1015a72569b0ef6e844129e5576d0bc3df1ed7a56104791e7a9721f3da4eae4537319f9c14bf0537788e719f28", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509237, "uuid": "0ec8efcb-23e1-4758-aadf-554bdc2de1fd", "value": "T1DA06336202CBFCFF5981D4B848E8BB360F5655F19A6C9115F929082DBC26EE3407A737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509237, "uuid": "bf5e739f-49c0-4619-8213-406ccf342fe3", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQH:CC65sr3KrCfsYiZQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509237, "uuid": "0f61abe4-9566-40df-9fd0-c171cc35cba6", "value": 3792896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509237, "uuid": "8f2397e7-fb62-4e62-b043-4ecbba56519e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509237, "uuid": "3dd3caf9-ac68-47fb-997b-c25a487da658", "value": "54515d1fd5b1561ff68c4c1719f12d837d8d448fc7ea38e7fc9e53529debd747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08c8d3c-e9aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767558030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558030, "uuid": "df5c6e94-68f2-45e9-ab6b-3a38e875a768", "comment": "Malware payload", "value": "03b7e7f220cfcf93c2c12d5b5cf6359d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558030, "uuid": "1c47f970-7e7c-4d77-bd3f-d3155957e2a8", "comment": "Malware payload", "value": "549a43c66af47894b4a8e119a578a38904519a3f74fa55b180c8c1b81917695c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558030, "uuid": "1cc45a95-fd45-488f-bd52-94318641055c", "comment": "Malware payload", "value": "402074d4926864443735cfbc60be4a3ea786c3c0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558030, "uuid": "6a895862-30a7-4b5d-a67e-bf55689c1810", "comment": "Malware payload", "value": "9b657a3fbbfc992103ab78fcd142460681f6181a570e20ae8ce02f96fd00371d039ebbb079347eb32c9a0c0f3ab81c56", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558030, "uuid": "2c6c6339-9078-43a5-b4be-3cd192ae6931", "value": "T16521F4CE58B4B97A6148CF4572E290C970F4C9E5E57049139AA478F784C82072738FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558030, "uuid": "2d579d4c-48c3-44ac-a850-b206d0223dd2", "value": "24:3J3nEELbMSVEcoLNIZEtnDEVKTKCEHt/EOFEL59METNP3E3eQbEKEeEz3gE15dEf:zJykQ4lFAptEeoSrN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767558030, "uuid": "607d67c3-70f5-49fa-aeba-feadf3714a77", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767558030, "uuid": "4eef2fff-65f5-4a56-aa6a-d0efc28c4878", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558030, "uuid": "6c3857ca-9f53-4d72-99ec-665e5a4019a0", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea361da-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567261, "uuid": "5a24265c-b5a4-4037-861f-190a5b9d40b8", "comment": "Malware payload (Mirai)", "value": "d2b396d3c8d85d7d33554f35c53ce51a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567261, "uuid": "f7cf01fb-ce27-40cc-ae19-9b13c937c517", "comment": "Malware payload (Mirai)", "value": "54c6150e81b420393138f9b8d23b4a6d6bc07a146a4e96004566217c1ef514dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567261, "uuid": "9b352e7e-03a8-48f2-929f-da7a869e032d", "comment": "Malware payload (Mirai)", "value": "aba97e0b3636e0f9326f51dbf08cf84246a64521", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567261, "uuid": "572e6d6b-c08a-4a7d-949d-7fc0d92a66bb", "comment": "Malware payload (Mirai)", "value": "5325cf4e6102619ed11a2f856e93172b88522e960025aee0dd0a87681d8c66b9740ed95154ff192eb034474b0bb4abaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567261, "uuid": "226b69de-d617-4a69-a0a6-78b3a5ce121d", "value": "T1D3332A03B942C0FDC55CC274566FBA36C872787E033AB9AA37D4FA266D46D611E2E904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567261, "uuid": "7619499b-c98e-438c-aec0-7bff9311681d", "value": "1536:VJCqjbwNRaPq5FllaxwOzvT1Toao9Mkv:FjEraP4llaxwIT1T3mMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567261, "uuid": "e161a712-f931-47c9-98c4-beb21b565f0d", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567261, "uuid": "d6ed5d85-10ce-4ebe-890c-b4f6cb695fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567261, "uuid": "84a07f11-c296-4bcf-aa69-79e50f3123fa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec38644-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511399, "uuid": "ac3ad26d-3825-471c-93f2-5655d51b330c", "comment": "Malware payload (WannaCry)", "value": "e593169c3ff4acfee907d410f7666924", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511399, "uuid": "f62cc2d5-fcb1-4610-92c1-2a93b4ddc9ea", "comment": "Malware payload (WannaCry)", "value": "54ffaa0ba57dc69ecf2255858d1422a583119e3a9c0bba1d70545df96aade147", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511399, "uuid": "50cac662-0945-453f-8b0e-30517630b733", "comment": "Malware payload (WannaCry)", "value": "e7125b996487dfff4e6968d89f0d500d2743a384", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511399, "uuid": "bfe82d46-f020-400e-88a4-ad888eb0959c", "comment": "Malware payload (WannaCry)", "value": "ac3dafbc5bd9f6dc1fd6ce4f37c4713ba0e7c30d6e650786767b7985d065cd3e25d6d83c5596514dad4ea18091f985b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511399, "uuid": "14824416-e50b-4d4d-91d5-75ebe6a8ab6d", "value": "T1B736C610B7E86219E7B36BB009F6472427B2BE4A9D13838F16A4715E1C33F54DE72729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511399, "uuid": "54e91053-34a4-4b42-8ef6-066da1258459", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511399, "uuid": "1d89ca16-62eb-43f1-9bbb-6217fcfd5c8b", "value": "24576:JbLgdeQhfdmYGH37byMY9+TzLTr68mhWZff6:JnjQqaae8mhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511399, "uuid": "f21e2c42-190e-45af-85ca-0fe05789826f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511399, "uuid": "3f91f624-2faa-4bfc-9d95-2cfd4c4f865a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511399, "uuid": "37047881-319c-46e7-ab53-f8f066b952d0", "value": "54ffaa0ba57dc69ecf2255858d1422a583119e3a9c0bba1d70545df96aade147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c2dd56-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567172, "uuid": "310c52c3-8d3f-4f72-aa14-156e37733ab1", "comment": "Malware payload (Mirai)", "value": "d82cd5474ed0c4adfd6f18c76d60e7a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567172, "uuid": "d4de2d7c-48a4-49bb-b4dc-dce7bb0e66a3", "comment": "Malware payload (Mirai)", "value": "5507860882d78cf19aeb6cd678b3ce2460f2784dbaff9a7c8e783436c9c88838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567172, "uuid": "0aa02d97-3f48-476d-ac04-773f891cf505", "comment": "Malware payload (Mirai)", "value": "8fb62e114ff356fb6d5ea708715828ba1fb4ff84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567172, "uuid": "bff6f23f-aea0-40f4-99d0-42936ab320ab", "comment": "Malware payload (Mirai)", "value": "b72aeab86b097d5af502e8ade78df29f5f1d8f61021603681a635dc50ebf9f419de50ab238846fc534a1310b6b7581e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567172, "uuid": "d8ba950e-6023-4f40-8251-15427e4b52e8", "value": "T1F3634B81F653C4F5D8531171507AB77FCB32DA164031C64BEB2A9F36DD27842AA2B3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567172, "uuid": "68a9f975-e274-4e71-924b-f91eb24d62ee", "value": "1536:mMlK7eYcAWKMRcCrKICDm2l6kTAKI/bOSa9g:+IHnrKICDm2lRAKI8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567172, "uuid": "2bba41aa-7d82-4964-ae2b-39c36382d441", "value": 70820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567172, "uuid": "bf760c34-adc1-48dd-802a-0369c94b0fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567172, "uuid": "a49f1782-4763-4364-ab97-3674feec2510", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4c3ce6-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767520091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520091, "uuid": "205fbbd4-e560-421f-a712-dcff2335a82a", "comment": "Malware payload (Mirai)", "value": "5ac250e53b36453b7b11df784bb89159", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520091, "uuid": "a26295fa-8d93-4f47-814c-c7881012c0fc", "comment": "Malware payload (Mirai)", "value": "55476dee220628be6cdd4987fada613d03dbd7d8f4175adec34cc0169ae73a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520091, "uuid": "da273892-1ef5-4920-8aed-4f1a482b2cd7", "comment": "Malware payload (Mirai)", "value": "a053bc615f53a1c5b11281a64c84cf6c650101ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520091, "uuid": "b19a40c9-d3bd-41d1-9f90-47b5a35ac10a", "comment": "Malware payload (Mirai)", "value": "ced9dc1389d27b8c46e8a9ee0c75152ebbe67426c9b52d398e1a9d4b5b3c74e83c14902fa3b7bf8554f89b1f6a06dcaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520091, "uuid": "5bf54a86-f8cb-4202-a6ba-2897c5818bc2", "value": "T1F4A3931A7FA10FB7E8AFDC3789D91745249E641620993B75BD30E818F20E25F19E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520091, "uuid": "43383203-f47f-4464-8b28-b7fe50570713", "value": "1536:fqnmJ0zkI+iL1TIPV+xBNLFgo4qNWfjZHS01U:ym2zmiBItMB2fj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767520091, "uuid": "4efdb145-8ec6-4114-a969-d20544fd54bf", "value": 104596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767520091, "uuid": "17deefd2-9cb0-4ff8-9a35-8aef47a33f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520091, "uuid": "c9326bcc-4aaa-4531-89f6-046ae0006d21", "value": "Fantazy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ac0e92-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513364, "uuid": "a243dae9-a1e4-4a95-bef7-0e1f02c35ce0", "comment": "Malware payload (WannaCry)", "value": "37a3ca268f5d7379fcb5268296336771", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513364, "uuid": "e61e085a-2230-433b-b737-88bf56f2e511", "comment": "Malware payload (WannaCry)", "value": "55e7e424f6e98d7996fa457a46310d0172ce842b85dbfd294b0aa7afaa703a02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513364, "uuid": "37b046d7-02a2-4843-afa3-890223f4a3aa", "comment": "Malware payload (WannaCry)", "value": "21bbd79bc1440acd99513cb6951748c195aa8d56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513364, "uuid": "a017b630-d553-429a-a1cd-0de5ce13d58a", "comment": "Malware payload (WannaCry)", "value": "de93e21f8af92c1da022bda28904e9399b192718eb578c173093ace8ba8a23300a86de2be89a03b957a4db0194873742", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513364, "uuid": "a953a7f7-c3e0-4e3e-86fa-06a80f530980", "value": "T1A636239A71BC91FCC1053975847B8A23B6B23CAE21FE6E0F9F8049751D13B59BB50B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513364, "uuid": "194c61fe-3941-4f9f-bff6-8294a01056da", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513364, "uuid": "a87ae040-0b63-4a0a-8fc2-fd296cac3386", "value": "49152:RnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:1nPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513364, "uuid": "96b30560-2a7e-43ab-b8fc-4b75c4135611", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513364, "uuid": "ad08229f-575a-4b70-80a7-54c41f82310c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513364, "uuid": "7f44aa14-37fc-4d7f-8ea5-5ea39b2b0bc2", "value": "55e7e424f6e98d7996fa457a46310d0172ce842b85dbfd294b0aa7afaa703a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be18eff9-e98d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767545543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545543, "uuid": "1187b250-6f47-4a88-a77d-4928f590723f", "comment": "Malware payload (AsyncRAT)", "value": "3e5a3f63dc5414fb103fed17781960a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545543, "uuid": "10a0ee5e-abcd-4429-817d-8056e5330410", "comment": "Malware payload (AsyncRAT)", "value": "5633b7d58dcfcae24f9ddcf10010ce9d4ddce76a4a679298374dbf9588bdc1ad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545543, "uuid": "e047e3c8-a599-4a84-ae18-9df770d3152c", "comment": "Malware payload (AsyncRAT)", "value": "437e89a10214e1812ced863e5a0aeae1241bfe8d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545543, "uuid": "ef3f6905-94e4-41a6-ad05-e4c3a44485de", "comment": "Malware payload (AsyncRAT)", "value": "c3cadd624a81d9ada6b004a1bb3d910da5de39a37daff61db4c654c1b6ef84caaafa9fd5b5c481ecdd01c4ba0635bdbb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545543, "uuid": "030f818b-72d5-47dd-8f19-29da408e5a2f", "value": "T138232B003BD9C12BF2BE5F789DF26145467AF2633603D64E1CC4419B5623BC69642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545543, "uuid": "b5807dec-a66c-4a99-86a7-16a764c133b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545543, "uuid": "aeac39e2-2ca9-4475-bf3c-e1c11e18dae6", "value": "768:zuFWATEszatAWUqJaYmmo2q9ZIJiNNkX3lQh66/lLj4HPIuGjbbgX3in/2s1ttPz:zuFWATEd62/Jg0oUguqbkXSnrUF5dRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545543, "uuid": "226663af-c85d-4056-8432-0029f4500d66", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545543, "uuid": "132bd29b-9388-47d8-b6f8-8117be9dce9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545543, "uuid": "c9c3874c-a077-4544-8319-eef2e78a3bad", "value": "HitClubDownLoad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0930b50-e924-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767500531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500531, "uuid": "957273ab-b104-4131-97ac-16c672d57341", "comment": "Malware payload (Formbook)", "value": "31aef6d32669bc5807b348f948bcc2ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500531, "uuid": "67b31eea-5bc7-4dc9-b785-3d6a977a1d1d", "comment": "Malware payload (Formbook)", "value": "5756e25b85cd80cc50822ff08493723729b4f99d37d2a0e26a4a0fa244c7db15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500531, "uuid": "2c9326fa-6ce2-48c0-9fa2-0eebbf332f12", "comment": "Malware payload (Formbook)", "value": "1bb9861dc6f0041c33972e7a407f3c70e0748838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500531, "uuid": "43c1a432-f095-420b-93fb-af1d8d054d12", "comment": "Malware payload (Formbook)", "value": "5e5ee500ff5f1fa6ba3642a2403d7036bb07ab217e3d269f721ac51b80d2681fc4f3ec2f1a07d65792d87699b4a296a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500531, "uuid": "2380ac65-669e-49ba-a494-2bb4301fc506", "value": "T127E41214322CCA17C4A25BF16972C1B817647ECEEC60D247DFC9BEDFB4B96189857282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500531, "uuid": "a1743f95-5546-4df3-8e02-10bbca4188e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500531, "uuid": "7203190b-c798-4407-a1eb-fe1d919fb3aa", "value": "12288:A7Ts8VyPDhi87TL1nBX9AsmnKl/0KnTZrBDKa3FGW1U5nFU2Bo8Bc6:6jVyPDhi87TJBCnKl1Tp/3F71qUCox6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767500531, "uuid": "07dfff4a-bde9-45cd-b5ab-c4a42e6e016f", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767500531, "uuid": "b0b32741-cf06-4619-befd-cb4c21b3302c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500531, "uuid": "0b180590-ba8b-4fb7-8bd8-0b82b3b5a37e", "value": "HsbcBankConfirmationReceipt.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7478551d-e9b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767561741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561741, "uuid": "94d0e594-b3e0-43fc-8bd2-bed471457839", "comment": "Malware payload (Mirai)", "value": "227aaf612f5b4629010278f0770ce915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561741, "uuid": "e2db6f78-fd7c-4f36-b32f-b7f7cd8f9369", "comment": "Malware payload (Mirai)", "value": "58aa46e0ea10d5d1e7504898e126c9759135d4674ab43cb85d60d4588ab0a749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561741, "uuid": "b4e8b2e8-5394-48d2-a724-5d140adfa384", "comment": "Malware payload (Mirai)", "value": "dfb739fd651b26b5531f02b4487a2ef96a1955ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561741, "uuid": "caf5c09f-da4e-403e-a540-cc2682aae242", "comment": "Malware payload (Mirai)", "value": "f0899da11ed51053a4280a9b3c25e1db14268a3a20ed03d2482f319b2a74e8a83240669301f927d42f050cc5e17275fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561741, "uuid": "11e7d1cb-e2aa-4f33-b7a1-0a353176714b", "value": "T1E0437C7BD13AADD4C14885F5A9318ABA1F53B204D6632EBB5F89C5624043ABCF60D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561741, "uuid": "b075a077-9285-4670-ada8-9260da88f7cd", "value": "1536:S7aYwtsgs5Ms5OJFTdO4gD/5Uot59+QDCWHu+7R:83Gs7wJFpO4gD+oP9+QDzu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561741, "uuid": "32a1f5e0-f4d0-4469-a517-523cca2f0318", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561741, "uuid": "ed5f6f53-d867-443d-bbcb-138938a625ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561741, "uuid": "406ab824-e0bd-44ed-b512-ae3406241195", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7608505c-e989-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767543704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543704, "uuid": "9bb70828-4c44-4cec-aaeb-fac1eb846286", "comment": "Malware payload", "value": "ecec9a9f5aaa088a4ffd954e5af64b31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543704, "uuid": "3cc692d2-4a8e-4b5d-8ebb-bcd35890ad66", "comment": "Malware payload", "value": "59574da0ef9c6d5b9e92768f874c7022363c071d13940004ae8c5893d48c8d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543704, "uuid": "319933e4-7c3a-4af7-a441-8678588f9eff", "comment": "Malware payload", "value": "ffba59e9ef9a3726d34488cbf1a2e33ce1d5826e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543704, "uuid": "78ee0e8c-fbd5-42b2-93bb-f168f6f7acb8", "comment": "Malware payload", "value": "011cbbaa2598a0f27a48727b8f0db8a2456d01f7219aa79345259e100da2e59e859c4a7d1190313218b8f655a1aed7a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543704, "uuid": "6ddc68d6-b097-42e1-8ef0-6aea39571a84", "value": "T12BB533F909F3AAA6962FB72FAC0F87D977EC5128D6DC1F71613572408D228132D40DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543704, "uuid": "2e41d6aa-7cfa-4193-b038-842b50317f9c", "value": "49152:HK6lvnErLKzPahZEye3U1/60nZOLbcKl1Fkxp2FH9eqS/o0lD3hEcKbrAaNPx5K5:5lu6PKdeuDnZOMMiIB9nSZbO4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767543704, "uuid": "389983ba-7a89-464d-84f3-734ae753b636", "value": 2492925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767543704, "uuid": "3b632a2d-5963-4bca-9f2e-596914e9d767", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543704, "uuid": "13f3fb6c-13fd-4cf1-b220-67fa540003b5", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31b9edd-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512883, "uuid": "ac09c703-36cd-4951-8cdc-27599c2d917e", "comment": "Malware payload (WannaCry)", "value": "f533d98dedd515845f2b1f6608d94985", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512883, "uuid": "de6365ad-fe74-41c2-867b-055ad3ba8f07", "comment": "Malware payload (WannaCry)", "value": "59a94320888f10f0c4897f49ddfda96a2f2a4d026d2db0a7d84d87accc4ed5d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512883, "uuid": "cf259562-5848-466d-8cc8-72f107d54696", "comment": "Malware payload (WannaCry)", "value": "de4f88f8a9a88b53c002471cf3b2c8b6620f4773", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512883, "uuid": "95ff38d7-dc86-4caa-9389-26400b0b1707", "comment": "Malware payload (WannaCry)", "value": "f8fd88a4eaf955f6877adf1e1fa987bdf5775f0df5a5d35fe63c052552cbb4658a68695ae9570cb1170b17d9ae4fc9f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512883, "uuid": "b718d4f7-7fb0-4c9c-9c87-dad2e1ca23b3", "value": "T1F636236976AC91F8C10A627564738926E7B33C99227D960FDF908B520D033A4FF68F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512883, "uuid": "9ac64abf-828d-428f-b280-dc4c4d13bdff", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512883, "uuid": "2516941a-9193-4a55-a8b2-c15619ec0190", "value": "12288:T1bLgmluCYQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEX+:RbLguqQhfdmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512883, "uuid": "8b02801c-44c0-4a5d-9eaf-a701c7fe0b7d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512883, "uuid": "2f283667-50cd-4553-8e3b-6defd94e8d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512883, "uuid": "4e0604f2-46d5-4af1-bfd9-38b6145c986a", "value": "59a94320888f10f0c4897f49ddfda96a2f2a4d026d2db0a7d84d87accc4ed5d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e666c2fa-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512110, "uuid": "848a4076-6f40-41c9-b79e-1cf5515f0251", "comment": "Malware payload (WannaCry)", "value": "f14afcac1094f1a6dfd84da5162a55c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512110, "uuid": "4ffcdd24-ec74-4044-a3db-003306f70a85", "comment": "Malware payload (WannaCry)", "value": "5a675b17184d2d5495c19a334e46a50b5944d02fdd06b808931ef25f434f23e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512110, "uuid": "f8a54533-84cd-4ef2-b0e9-aefe58df33e4", "comment": "Malware payload (WannaCry)", "value": "c602f0e078e7622cc20e61e2f8bdc31b3ccf076d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512110, "uuid": "6342ce91-ac8a-44c0-94a4-79ca30b9a440", "comment": "Malware payload (WannaCry)", "value": "1e120f290c31e9d741577706eb4bad302a73165b03d18f511a12848651034e86d0b66c88fee48011390bcfbc8a711b2c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512110, "uuid": "5ead647e-2a9e-4c24-bf45-f94987f571b2", "value": "T120363354662CA1BCF0850EB40473896AB7B73C69B7BA4F1F97C086660D43B9B9FD4A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512110, "uuid": "83363c29-f9fc-4d2f-af0a-875195ad77f2", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512110, "uuid": "0a3c7272-ed9a-422a-8903-eff8bebedf17", "value": "98304:+DqPoBhz1aRxcSUg6SAEdhvxWa9P593R8yAVp2H:+DqPe1CxcuZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512110, "uuid": "7c5c1738-c333-47e7-a49e-44c49adf2eaf", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512110, "uuid": "6e13f88c-a775-4e8a-8543-4cc04884fee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512110, "uuid": "4ce014f9-86d5-4aa7-8601-bf2ce28133da", "value": "5a675b17184d2d5495c19a334e46a50b5944d02fdd06b808931ef25f434f23e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e56b79-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (Expiro)", "timestamp": 1767512249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512249, "uuid": "a5c3aec3-f6b6-4987-acac-a94d34c08d1e", "comment": "Malware payload (Expiro)", "value": "dad8337fdbef72740b7aa1e3f2f476df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512249, "uuid": "28cc49fa-ffe9-4ff2-9e84-442122dc162e", "comment": "Malware payload (Expiro)", "value": "5a918027e1e2cb43385297d324dc8e00e2dc48d5aa35016bf375117edc0b023d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512249, "uuid": "05e3180a-f056-4910-9c16-94bf15650f61", "comment": "Malware payload (Expiro)", "value": "d840e0b3ff1d7c4f9ae649aae1d7a3afba3a933c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512249, "uuid": "67b70766-b398-46d0-af65-9852593ab362", "comment": "Malware payload (Expiro)", "value": "2d1416998cef728fecff4ddd66531609f33aa43330da68c4f452e271241a9358a2e18a826c1dc10c53571cc5d5a7f4e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512249, "uuid": "b27dc0d5-e327-444b-8589-d27522d63667", "value": "T1DC36339974AC51F8D1550ABC80BBCB1AB1777C6E25B95A0FBF40CA356C63E40DFA8603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512249, "uuid": "91334cb3-9175-45d3-8c36-e4c349f3dae9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512249, "uuid": "d01b717d-a2bf-4e97-88ac-92bb0338946a", "value": "49152:PnsEMSPbcBVQej/NAARdhnvoAHEDmg27RnWGj:ffPoBhzNAEdhvpHED527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512249, "uuid": "bc86c998-5ba9-4cf7-81be-2c33f1a047ed", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512249, "uuid": "be8ba5bd-238e-43fa-bf05-94a7195d613d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512249, "uuid": "c4e8dec1-75e1-4d2a-8cd5-00fb56c52d9c", "value": "5a918027e1e2cb43385297d324dc8e00e2dc48d5aa35016bf375117edc0b023d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc344a21-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509140, "uuid": "d66cc57e-2803-4249-bd7e-62b31cc9a314", "comment": "Malware payload (CoinMiner)", "value": "91390111ce2ace9485f78f9fa936025e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509140, "uuid": "aba437ef-0a8b-4282-a493-7e8914144bff", "comment": "Malware payload (CoinMiner)", "value": "5a932046c9181756dd9fb8099fecedd1453173c75872ffdfc78c70c9fa77c9ce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509140, "uuid": "5f22bb2f-e35b-43bc-9d7e-ab65c292c966", "comment": "Malware payload (CoinMiner)", "value": "aa8af87f38fa23001871e26c90b580e9c74d6053", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509140, "uuid": "d1a58056-757b-4b1b-ade1-e8c0bb0a6310", "comment": "Malware payload (CoinMiner)", "value": "eb9e7236c3e74a1f1074fd51591446e771b63e8cdad9d2a64f6ae44b110a80bc59fb2b9d7d5a29e612e18e729e8fe523", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509140, "uuid": "52faf65a-d03d-4e6a-8b9d-ab22666da813", "value": "T14F16336511CBFCFE6485D86898F8FB370E9560E29D7C4111F92908287C26EE7407B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509140, "uuid": "5e246b39-2c95-4c79-b2c2-26e080d539c6", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgU:CC65sr3KrCfsYiZQgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509140, "uuid": "ec959511-9962-4981-b1b0-e3b4f4c61ddf", "value": 4046848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509140, "uuid": "ffb463bc-c681-43c8-9329-e49506efa4c3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509140, "uuid": "7505065b-a596-414f-9401-f92965d5cfa1", "value": "5a932046c9181756dd9fb8099fecedd1453173c75872ffdfc78c70c9fa77c9ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3187e5a7-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512236, "uuid": "b11a0be5-d07f-444e-b9fa-91b0f2447140", "comment": "Malware payload (WannaCry)", "value": "b1bcfbc60ec00a9e26e351b13918e330", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512236, "uuid": "62bbf048-2ab6-4a2d-9b5f-9362584e1935", "comment": "Malware payload (WannaCry)", "value": "5aa8766bf3681668744a5f7af73072c5496f601fb15f79958bd78b4d2ded3979", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512236, "uuid": "e61bd3a7-34f9-4987-a9f7-648190d97e50", "comment": "Malware payload (WannaCry)", "value": "cb137fd6580fff3b31027602a6b09343003aa539", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512236, "uuid": "623a5524-1eac-4abf-ad21-370ca15bf864", "comment": "Malware payload (WannaCry)", "value": "11e639b7cc927c73802c78b423b0a749e28afde0931eb73a119b88db4f22d1c4f31c2aa80d1ad7ca6632ecd893c1b25a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512236, "uuid": "1d2542dd-c932-486a-846a-1a3ba46f53d9", "value": "T1E436CF42D5961EA4C9E10AFB227ADB10923E5F5986AFA13F1225410F1CB7F0C9DE5F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512236, "uuid": "a041d608-5fff-4b35-a7bc-1ea6740e4ec0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512236, "uuid": "ee2aeb39-9e80-4cbd-aa0e-5804c26a22c5", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:+DqPoBhz1aRxcSUDk36SAEdhvxWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512236, "uuid": "75b4577a-73ac-415e-8f4c-e9f491a29142", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512236, "uuid": "7de4cbcf-40a8-4d3a-bae9-7f054b838162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512236, "uuid": "10b652e2-4fb8-47d3-a71d-d0ba5200dfe7", "value": "5aa8766bf3681668744a5f7af73072c5496f601fb15f79958bd78b4d2ded3979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3699718-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513286, "uuid": "937315a1-a70d-41e0-8af4-05c0af835e14", "comment": "Malware payload (WannaCry)", "value": "0abd719d9108612e187eeacd63059b3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513286, "uuid": "3d634c1c-22e9-4029-8d79-d214a4a24382", "comment": "Malware payload (WannaCry)", "value": "5aec6e6089d7281fe47ea64d1685e420f6cd99828137dbe8c6674c90a65dc52a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513286, "uuid": "24a674d0-e88e-4cdd-8b28-812d6aea0903", "comment": "Malware payload (WannaCry)", "value": "dac3e29f3d2fee538569fef2f01fb7aba0a53623", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513286, "uuid": "e568d7a5-7b41-4308-80a2-3e2e0a528884", "comment": "Malware payload (WannaCry)", "value": "13fa307201552c4da6226f7b31deb97115586213c5395ea8df63ed2d53683246715c8727ffc008fa9d94ff7720cc1f3a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513286, "uuid": "e5611b77-4fd5-40f3-8a1d-6cd9b72f0567", "value": "T1D1363368626CE2FCE00509B404A3C967B7733C5567FF5A0F9B8086A61D43B5FAFD0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513286, "uuid": "48decef2-e72a-4d3c-b2ff-d28a1345fc3c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513286, "uuid": "47366788-1201-4e4a-abb2-eeaa084f5cd3", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593G2:TDqPe1Cxcxk3ZAEUadzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513286, "uuid": "86a55553-29ee-42db-893e-9b190146ae48", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513286, "uuid": "a5d2e5b7-8764-43f8-b4fa-60952f62d3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513286, "uuid": "83886b51-1486-476a-9de0-8147a2fa32e4", "value": "5aec6e6089d7281fe47ea64d1685e420f6cd99828137dbe8c6674c90a65dc52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7204fb-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555129, "uuid": "3f6e7ff1-4332-4cc3-bb07-5062b7cfb57a", "comment": "Malware payload (Mirai)", "value": "38a114fcd59e76b169a187b3db2540ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555129, "uuid": "b14e969a-7017-498d-81d0-2de4e9c2e36a", "comment": "Malware payload (Mirai)", "value": "5b655be020f819301e7a506deccdbc285060d4d805a7f9363eb944cbb9cd23ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555129, "uuid": "2966f0c1-70f8-4184-a157-a8d24a032932", "comment": "Malware payload (Mirai)", "value": "1c0b93af2fe1b53cdd96af191fe3c52659315683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555129, "uuid": "48956832-2de1-400a-8c7b-a56561985213", "comment": "Malware payload (Mirai)", "value": "c6c57dabfeae02484fa1232ae29f879b0f416f9304d80cb250ea55ccff77eb99efbb0dd57d0747218edd20aa7952612e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555129, "uuid": "ee56ef7f-a531-43fd-9deb-47a0f54850d4", "value": "T1AF240946BD919F13C6C222F6FBAE418D371667A9D1EB3103DD216F60378A89B0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555129, "uuid": "c4467732-60d3-4db2-b787-af1eeeb72e5b", "value": "6144:snL/0gzBMDE85/zXhcKJQZukRsN94XRWn6TFHVAOy:snb04BMg85/ziNZDU94XoG1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555129, "uuid": "eda53d01-4aec-4156-82dd-7b9e774cf3cf", "value": 227680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555129, "uuid": "a6e0e6ec-20ab-45e0-8bac-98a70c1ffd90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555129, "uuid": "fcb0a4fa-0055-4380-b258-2f47d61ecec7", "value": ".a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12db6557-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512185, "uuid": "9905f0da-850b-433f-9e40-82d87e3b80ee", "comment": "Malware payload (WannaCry)", "value": "fcd6ad3cf9eeb9e996c0255893b21bcd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512185, "uuid": "57a75fab-4f72-46c0-96d0-d4ac25222fdf", "comment": "Malware payload (WannaCry)", "value": "5b955991e4d5a58277ef2b1effb6f397c6268caa651c00f2be21aa3559104049", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512185, "uuid": "57df9bc1-0e2c-476e-a0c4-590d7059b589", "comment": "Malware payload (WannaCry)", "value": "0c82380bc2060b07a1617a2b46ccd4966ce6127c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512185, "uuid": "dae74778-7879-4862-97c4-9c6a20ec7bb5", "comment": "Malware payload (WannaCry)", "value": "439a29f95a804f73eb68cc0f41d048b3ffdfe7adf3b21576f6146c9aa6abcb1f862f8a903625afc078f52637f7f40c97", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512185, "uuid": "a366f9be-57ad-48c6-b895-18f175cfac78", "value": "T1AA363358713CA2FCE1450DB80463896AB7733C5966FF6E0F9B8086660D53B9F6FD0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512185, "uuid": "055ec1ca-6ad0-439d-bd85-5aab312a947a", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512185, "uuid": "afc5718d-1049-4866-b84c-dc033ac66101", "value": "98304:T8qPoBzz1aRxcSUDk36SAEdhvxWa9P59XH:T8qP41Cxcxk3ZAEUadLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512185, "uuid": "33e5d237-5306-455d-8a52-0712884bce94", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512185, "uuid": "76c15d04-d7bd-4760-9126-60a143ea4adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512185, "uuid": "e9303bd4-a8a5-414d-aa68-59dd17bfc86d", "value": "5b955991e4d5a58277ef2b1effb6f397c6268caa651c00f2be21aa3559104049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d71c20-e99d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767552430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552430, "uuid": "b14c2b70-cafb-4112-85a7-de1b5bbbfc71", "comment": "Malware payload", "value": "80a83a8f00648b97e8843880e92b0d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552430, "uuid": "d66d9448-b703-4502-975c-8584d7a83b58", "comment": "Malware payload", "value": "5be60b6dbc6d6ab4b62a1b2639acec1099ffffa6ff4ab49d957e87aaf2ba9dd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552430, "uuid": "135d6ee5-9cf0-4793-978c-946344e59f51", "comment": "Malware payload", "value": "048ff4ed4b583b841d6e919ac3d5de44676ba0b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552430, "uuid": "e2e4fbf0-191a-4807-a4e5-197905430306", "comment": "Malware payload", "value": "b83c2218c998502e5f58832e4cd7669c98e2e4e89429ad7a750280aee96f870091525f3433a6767d31a9b9115eb1659c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552430, "uuid": "2208d343-a0e2-4989-ae33-4e5712e8b90b", "value": "T105F34A22B4C094FDC8DAC2789BAFB236D972F6095138761F23C46E262E5DF252F5C650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552430, "uuid": "e89358bd-4da0-4b76-8a67-f12750ddbbef", "value": "3072:mfB8DzICOBWH1C1C6EtLzcI/6qjJ79W0QklcOakq:mZ01MHlIyOfxakq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552430, "uuid": "592aa32b-a206-49ac-943f-ac11d9edce79", "value": 164592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552430, "uuid": "e2af4fb2-9918-4a2a-93ec-970efb3fd2d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552430, "uuid": "15ff0617-cd8c-49c3-ae42-561eae73ca54", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38849725-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567223, "uuid": "82886323-f8db-405b-a9d2-efeba8c76b88", "comment": "Malware payload (Mirai)", "value": "c144a719ed06b5ce4ae64ac275c73436", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567223, "uuid": "f8058d92-c745-4be3-bab1-40f848afd4a0", "comment": "Malware payload (Mirai)", "value": "5c608609a98d12a6c38818b1ccbdd4d0e0bac208b5aa0cef821602c87348a677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567223, "uuid": "811b8198-8e94-4f01-811c-0dcf4726f1e2", "comment": "Malware payload (Mirai)", "value": "366507e7524ed2aebbbb7d00a63b8b5f1fcee591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567223, "uuid": "32ecfdfb-9ab9-44e4-896f-428ea46e5a75", "comment": "Malware payload (Mirai)", "value": "b1c5f59bc028d4af3047a4d256a8c2e3875695feb0eaa35351170f299a91a2542e320e96d0b2bf541ee9331cef15a374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567223, "uuid": "297d33b2-b144-40a5-a5b1-3c7934027771", "value": "T15F2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567223, "uuid": "2ca96425-02cc-4662-9e67-218d0a7662d8", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2iHe:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567223, "uuid": "9d9957a0-b749-4ee8-a87f-d4962f07ba4d", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567223, "uuid": "bb5ddc88-7151-458d-b280-2213eda16dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567223, "uuid": "23016d16-ab21-412a-84e2-633a725ddf55", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7b8249-e980-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767539905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539905, "uuid": "ae0506cc-8e26-42e5-b566-9a6c9e559497", "comment": "Malware payload (QuasarRAT)", "value": "518db4c02488525d1173447376a8a767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539905, "uuid": "02baed64-6b36-4bca-b374-b375d2e49234", "comment": "Malware payload (QuasarRAT)", "value": "5c8a4a8a13892a089efe1ad9b78a01e5811e7bb5b77e4c62d6da7781abf32198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539905, "uuid": "e2e89c5b-8d9b-4b53-9275-5ff1c15a9b40", "comment": "Malware payload (QuasarRAT)", "value": "c331515434632feaa8169b92095c91e7cc13f9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539905, "uuid": "d1b92d33-b959-42b0-8993-940cd40c94b8", "comment": "Malware payload (QuasarRAT)", "value": "d377d00288bc84065213ce62c9f37c8769b8122a22ff2af0b25e71996b63d34493968ae808337b765e92d43b891b11e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539905, "uuid": "a581f6b3-659d-4e9d-8f95-aa21af14a9b1", "value": "T172E56B0437F85E33E56BD2B3D5B05026A3F1E82AF363EB1B119167BE1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539905, "uuid": "773a9d9c-c706-4df3-9cf8-feae69f40403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539905, "uuid": "8ebe18b1-f0b5-4f0e-9ee5-7fe77e5445e3", "value": "49152:Ov9iiN2tPa2vpJPylxhhC25D/Wv13oZ5CBx0LoGdNTHHB72eh2NT:OvMq2tPa2vpJPylxhhz5D/WN3+5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767539905, "uuid": "b95d3210-a810-4cbb-a46b-dc83904a4a5f", "value": 3270656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767539905, "uuid": "e3d436b9-dede-4356-acf4-90ce1620ef69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539905, "uuid": "5ab99cd1-43a9-4971-aec8-c2e6cca10114", "value": "ie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7b6f6d-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509248, "uuid": "e12113fc-f959-4fbe-b56b-8c0c43b372c9", "comment": "Malware payload (CoinMiner)", "value": "bf951d9b4cfe3a3b0407c80fbb45fd42", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509248, "uuid": "dda785c4-0548-47d6-9201-44846525bf4c", "comment": "Malware payload (CoinMiner)", "value": "5c9d58c9337d7fa89e6d212ef1ffc10275d18f3e65e45a0db1a46d199729aec9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509248, "uuid": "f9fc87bb-1bf2-4ead-8bb4-a78f6df5950f", "comment": "Malware payload (CoinMiner)", "value": "59d93c080865b63793b68e3bb0caad88aa58037b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509248, "uuid": "8f2edac1-05ee-4a3c-8182-83bc4bd35f44", "comment": "Malware payload (CoinMiner)", "value": "0f73a3cc90b73a37f464cdd2476e497868860642126a3c0cf71ccdb872e9e4603899ccd410ecbce19225844f830e8989", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509248, "uuid": "0becd548-09bb-45fb-af8e-e27208294500", "value": "T14C06336201CBFCFF5985D4B844ECBB320E5555F19EAC8155F929082EBC25EE340BA72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509248, "uuid": "9296e2aa-1e87-4b5d-a5ee-fecec432745d", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZG:CC65sr3KrCfsYiZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509248, "uuid": "9662e829-53d1-4a9c-b399-82e75a36eee3", "value": 3743744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509248, "uuid": "83457e4b-176d-41f4-be03-3d4c777b4e9b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509248, "uuid": "843f9f04-afc0-41e7-9615-96a44455977e", "value": "5c9d58c9337d7fa89e6d212ef1ffc10275d18f3e65e45a0db1a46d199729aec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e2c918-e9a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767556804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556804, "uuid": "6b68724e-46b2-45cf-bcf1-dbefb8651e78", "comment": "Malware payload", "value": "981d8208d2f7b5924f61b79c5342c627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556804, "uuid": "9ae81212-14cb-45e8-b211-092833568084", "comment": "Malware payload", "value": "5cbef49843ebfcd287eb15d49e7b11e7925006f7c26eebf46bb1a3bf761a8b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556804, "uuid": "cd2cf7e3-6e12-4f49-8f32-b6caeb86e957", "comment": "Malware payload", "value": "4a8d6b339fd7ffe80d8770ce6423dd024936cc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556804, "uuid": "df4ad53b-c3e2-4f15-8a17-c029fc280a15", "comment": "Malware payload", "value": "e24b8c6ad2545acfc8b500aa1a81f364d21d4ac4ce21ec39b8df8f06f005992bffec1e10d21570b80f4cc5ce97a1bd5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556804, "uuid": "cd7f791a-5374-441e-af8d-5ea66f4fe401", "value": "T16B26D9BB8E384D89C6C7F1F69381D6700DEA9E67A4E6E0FA51D109401F43B106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556804, "uuid": "b17b9507-1fba-43e8-8f52-12e156cdb025", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556804, "uuid": "111e83ea-a869-4125-bed1-84026db0a9b5", "value": "24576:Vp7+NqHqo8ATT+X0+YPPYln3wJWgafeHAk9SEvXcoUzcIql23Xi4MQeHUU7j2x0q:aNSqwaT2PMnrtWHVqbSo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767556804, "uuid": "22131c1a-df05-4090-8257-0964b93ea6b0", "value": 4696576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767556804, "uuid": "e5bb7fb0-2d37-48b6-83e9-ea9e6c94b895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556804, "uuid": "1d9c2393-0734-457c-9e61-e0970a7e9735", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a546c13-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509647, "uuid": "28feade8-af89-448b-86da-f172e6c7ca47", "comment": "Malware payload (CoinMiner)", "value": "4791481fe9cdeeaf2240fdef56702274", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509647, "uuid": "53ef5484-9693-49ca-aaa0-2514f5de2f80", "comment": "Malware payload (CoinMiner)", "value": "5d036148f3e6ac930b9fb90d5e903dd7e0ad20574bf37f10a7fb08bac9aa4a5f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509647, "uuid": "3d10529c-afc0-4510-87cb-d5c3d7c586c8", "comment": "Malware payload (CoinMiner)", "value": "9bc3235b38e4b08f440127b235edd15e79d4dc79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509647, "uuid": "30b332bc-a2d1-4800-91db-5c3659ee60ef", "comment": "Malware payload (CoinMiner)", "value": "b798b8b07d6d503869b8c112c02d586f1de2207a3eb9dada22d7cce197c6681d4c34ec72f92c3d714546c9f23cd35463", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509647, "uuid": "c01c54ba-d9ac-4eca-9b43-c27239ad063e", "value": "T1A4B5335101C3FE3EA14DD9C498FCBB350E6B55F05B281A26AC5E086ABC71FF901A751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509647, "uuid": "011ea31d-826b-47a8-870a-4c9c1a5dc019", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3lV:G3LG658+S8YrCpHy2dUuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509647, "uuid": "db360ee1-9643-4f70-b74b-3e8f726670c5", "value": 2363392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509647, "uuid": "19436817-16f1-4825-b7f7-be275fb3b982", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509647, "uuid": "7639b1b7-e9a3-488f-90b9-5d61b4c11516", "value": "5d036148f3e6ac930b9fb90d5e903dd7e0ad20574bf37f10a7fb08bac9aa4a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4880e0c-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512912, "uuid": "26070b19-b451-47a2-9a17-b9f5a60b7326", "comment": "Malware payload (WannaCry)", "value": "8e6a0d982977b151989cae5c6e68cafb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512912, "uuid": "88601c24-7676-4147-bd5c-bf2b711bac7a", "comment": "Malware payload (WannaCry)", "value": "5e3488034a1d53dfeacf038a50ac9d3e9d68d3f2cf213903704e1c555b09ecb9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512912, "uuid": "572c0f55-eec3-401d-a789-0c3c28423658", "comment": "Malware payload (WannaCry)", "value": "c184be43990bafddac355a1fd103dc5888919e3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512912, "uuid": "492b952f-0bb9-4cc9-8cfd-d546db3b0586", "comment": "Malware payload (WannaCry)", "value": "08ef2ebf61181ff01e49d8efbbd7fc546bd8cb235d684644a01cdd40e082139d0610016018bda2cf2042f46df0d89f3b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512912, "uuid": "326c6457-5b5b-435e-97d5-0c9abfabf92e", "value": "T14736F107FFDEFEFAC14AEE71A873893F112AE5C5975306D99244DE6A08123256DE02C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512912, "uuid": "84c554d7-50ec-4b8b-81d2-ee5b0582ab30", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512912, "uuid": "fa6cafae-da50-4ece-b288-74a250403796", "value": "49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhQCdlFwJf:TDqPoBhz1aRxcSUDk36SAEdhQCdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512912, "uuid": "8868a085-44a1-43d3-96d3-58adf7e8852d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512912, "uuid": "4bfa88ff-f8c6-437f-99bc-2795b74bf093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512912, "uuid": "63b229d7-eaf0-40c2-ab2d-528b993da8c5", "value": "5e3488034a1d53dfeacf038a50ac9d3e9d68d3f2cf213903704e1c555b09ecb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce69454-e943-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767513571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513571, "uuid": "3bb735e5-8bb2-4a2f-8dbb-e4aa7bc3182b", "comment": "Malware payload (Mirai)", "value": "eaabd076a6026d4898b7bc45ef6fb770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513571, "uuid": "f44e1242-39bb-41b8-83ec-c89dba5ddd66", "comment": "Malware payload (Mirai)", "value": "5e8077aa0ef99875cbdd28be06594e6a8ed4531779861aac487c50a816f56e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513571, "uuid": "63c3a519-6da6-4f02-b51c-92e098f08d12", "comment": "Malware payload (Mirai)", "value": "f0964d82f34daa8a4d9e6f2d5a3ddbf28b0b7429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513571, "uuid": "bc9e4fbc-93b6-457e-a84c-16f290841b93", "comment": "Malware payload (Mirai)", "value": "b22e37efab53cd97ad58e0fe0715f76a5dace7a5ea123305ed31f17d7f4c46055eace9350e5a3efebb5daa158b8df67f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513571, "uuid": "6663447b-35e7-4c99-aaff-92185513fb35", "value": "T15F831B82BCD2951AC6D4277EA62E719D3361A3E0C2CB3513DCA74B15378729B0F27B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513571, "uuid": "c81a7f9e-b02a-473f-8aee-cac4dfe71c09", "value": "1536:K4MlK1EKuGZDErmKuehgWr/iFZkcP92RolA8D/DO27jrYp:K4MlK+KuGKrGWbiFV21ar7jkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513571, "uuid": "f1e7c4c6-45a1-4e4e-b4a2-db59a75ef26e", "value": 84440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513571, "uuid": "009ba1f2-ea61-4777-8c5b-f7980b2d67c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513571, "uuid": "c231a2e1-0142-4dd8-b941-59541a25b784", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46e8d46-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509530, "uuid": "a108cd68-316c-48c4-a32a-a59a192764bf", "comment": "Malware payload (CoinMiner)", "value": "cc7c81ed07d4aa3688ceac5f3a1cab89", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509530, "uuid": "f5a7fa6f-6cd8-4406-af42-8f740cbc0134", "comment": "Malware payload (CoinMiner)", "value": "5fb3840031b42eef78cb641147e476cfa8a4c6736e1c99cadfb9ce7204fbae2d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509530, "uuid": "5de09101-fe84-4d79-a718-82ed13ca5df1", "comment": "Malware payload (CoinMiner)", "value": "0b9252f1a0256b21f110eb49089b036195ed7e63", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509530, "uuid": "fe049e69-694c-4341-b8e1-0e46302a4a9b", "comment": "Malware payload (CoinMiner)", "value": "7d145787ee27bcdc232bbdd962efcafe2b6778feabfb89a7682db9784eab6325772552f96a7fbffa9b7ba9b2056c1138", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509530, "uuid": "3cc156ae-271a-45ac-b058-17f6f28eb975", "value": "T147E5331101C3FDBE95D9D9D418FCBB350D6B11F0A7681A22BE7A0425BC22FE641EB61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509530, "uuid": "f2983dcf-d882-4bcf-aedf-5f2b5fb15f58", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9w:G3LG658+S8YrCpHy2dUu4Krw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509530, "uuid": "53817ce6-2df7-4dbe-8d0c-3399ddfe68cf", "value": 3039232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509530, "uuid": "dae00027-dfb1-478e-a0fd-b5a844807634", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509530, "uuid": "bb4b9c71-ce96-468c-96e5-6c77536d9721", "value": "5fb3840031b42eef78cb641147e476cfa8a4c6736e1c99cadfb9ce7204fbae2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a67717e-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767512197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512197, "uuid": "e954ecf9-10aa-4b46-b5b9-8e9ab7ca0167", "comment": "Malware payload (Mirai)", "value": "ef7701f8a186577293e9b8976b3c3bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512197, "uuid": "979949b8-9a53-4563-9ee6-0751b4b9e25e", "comment": "Malware payload (Mirai)", "value": "605ecb383ff58245ee5121147384a92208760549f82fb0c20e4f3dd74784208b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512197, "uuid": "31b05b25-8baf-4764-9cc5-35f73d7dafce", "comment": "Malware payload (Mirai)", "value": "2cfedb3964a7242cffdc38286ff585128e232267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512197, "uuid": "b0476dd3-274c-4d44-80e7-1fade8f2149a", "comment": "Malware payload (Mirai)", "value": "7d42e7089b0b879e00ae6447b1e6d0ee77ccca49b6f1f14590be960ea23292ef80822d3bc1f84ee9aa10c372a4249a1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512197, "uuid": "9a2c78d2-7470-44a9-bed3-b352ccbc75d8", "value": "T1CCF45B02EF990FDBC46FCD70496D824B17ED89D706D0933461BC8D8CBA9D66A4BE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512197, "uuid": "27ebbfbf-b6bb-45fc-a313-3c70e6c38c1a", "value": "12288:wujvTFHI5CIIh6OvhVzQzyzhzstlJfzgb7m+WLKmGODBSJbSBgEtHuVw2zg8coPf:eUD1eHpGG5/6YL1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512197, "uuid": "0b350e29-49d5-4825-affa-d25fd2517b94", "value": 730136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512197, "uuid": "52ac9e59-896e-4e88-aa52-af2b32aa52f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512197, "uuid": "ecfacd42-f963-4752-9d68-e7fcd160c0bf", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056bd9ea-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (Worm.Virut)", "timestamp": 1767511733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511733, "uuid": "75ac998a-5a07-4fe1-84a7-fbfc7dc0d93f", "comment": "Malware payload (Worm.Virut)", "value": "804d8d0c073d2c96e9a67e9670cc8c81", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511733, "uuid": "3b00a8b5-db20-40c0-ac30-0fb3d1e56231", "comment": "Malware payload (Worm.Virut)", "value": "61384828a758382e02a459aab3b87cad8d039c956271d789354daeee3d8167af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511733, "uuid": "04116420-a695-42da-86b6-acecdb351cf4", "comment": "Malware payload (Worm.Virut)", "value": "5d30a54b484515a3752d1359eafedb12db83418f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511733, "uuid": "5cda1c3c-8e2f-448f-80c7-5e742ab378b2", "comment": "Malware payload (Worm.Virut)", "value": "43ce5f99d5739850c4d24ac61f008b0d567522a3fbc18f9e2a11424039783a2ca6537fd35509531b38f9e755ad7b018c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511733, "uuid": "5137b61b-6878-4aaf-900f-72633178065a", "value": "T13D3633506B1C61BCF0A50BB094224A2DB7777C29673A8B2FD7D0C7560C53B93AEE8B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511733, "uuid": "39f7a22d-357d-4f1f-bef0-c1dfefd4d782", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511733, "uuid": "af711aed-42ab-4794-9b8d-414346b90ddb", "value": "49152:VnAQqMSPbcBVCRdhnvxJM0H9PAMEcaEau3R8yAH1plAHS:ZDqPoBUdhvxWa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511733, "uuid": "7789b998-471a-4b9e-977a-7f4b08070f56", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511733, "uuid": "85d42908-cefd-4ffc-9522-8ac3f271fe43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511733, "uuid": "bcf6c4bd-4d23-4c49-8d2d-bf296131910f", "value": "61384828a758382e02a459aab3b87cad8d039c956271d789354daeee3d8167af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3a2c7a-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511826, "uuid": "6d8c1099-8273-4d0c-a5d4-ebd5bdc8a17a", "comment": "Malware payload (WannaCry)", "value": "5d2b58c6b2511b175e354e97e1d12350", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511826, "uuid": "e238e92f-ec05-443b-9450-fa00ccc1bef6", "comment": "Malware payload (WannaCry)", "value": "618aff19e4491629b65320f0e30904b1864fe80687efd5d2ed37a9d454531c10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511826, "uuid": "88e48387-2269-4dca-a8a9-a34333a95d6d", "comment": "Malware payload (WannaCry)", "value": "db4ae5bdf84e85b17f248992ed469d0bb657eb94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511826, "uuid": "bb8520b2-000f-4e1f-9b7b-6bc9969f14ac", "comment": "Malware payload (WannaCry)", "value": "6b731baf77f517de18b9de8ab14a1110030f5fc250caafca94ec429c08952507a193da7ccaf62f8da68c381041ffa1d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511826, "uuid": "69a44459-da47-469a-9d3b-2fde29c8d80a", "value": "T1A436236E71BCE1FCD106257554B78963D6F23C5A22FD6A0F8F808AA60D03769BF50A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511826, "uuid": "9e444b5d-abb2-4210-882e-93acc7fb76fe", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511826, "uuid": "7a5ceaaa-f358-4077-a297-a6a5b87e84dd", "value": "49152:RnaQqMSPbcBVQej/1INRx+TSqTdX1HkQo6S:1lqPoBhz1aRxcSUDk36S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511826, "uuid": "d02a089c-4602-467c-b5a5-797fa3a378d7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511826, "uuid": "af9764e4-c273-4116-8a0b-e726b1df4718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511826, "uuid": "1f38f89b-df6e-4f09-8fad-ae3e49fe7f61", "value": "618aff19e4491629b65320f0e30904b1864fe80687efd5d2ed37a9d454531c10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fe28a5-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511272, "uuid": "6a124dd1-dc72-4df8-99b1-97a94132eefe", "comment": "Malware payload (WannaCry)", "value": "8787806f8568a0d7a021722e63910a3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511272, "uuid": "00786f0d-8af3-43ed-9334-673e6f19e54b", "comment": "Malware payload (WannaCry)", "value": "624b9e13f66d9e715c32747b8b2b332b89275d1c9ae0b74ac5a61f2a8e51549d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511272, "uuid": "3891e992-69e8-4f4b-acae-e7a8e55dec80", "comment": "Malware payload (WannaCry)", "value": "f1036278c45de4fcc023482622ff203d92491ecc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511272, "uuid": "e59a3c66-f7de-486a-9242-94e5b1788bf9", "comment": "Malware payload (WannaCry)", "value": "003b193c347f101f6641ea84f9b103f8a6c004ee35e649e977fe66501329231b17c7a0a0839ccaa8265aa17c005a7301", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511272, "uuid": "81f5c56a-8d33-4662-946c-209fa9380f10", "value": "T1903623A670BC90F8D205257094AB8E12F6B67C2921FA290FEF408E762D53F56F754B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511272, "uuid": "efc5f5c1-17ce-41a1-b705-9282d652db87", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511272, "uuid": "0d4d933c-db7d-47a1-ba77-ef78f5251fb6", "value": "49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6Sidhnv:1GPoBhz1aRxcSUDk36Sidhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511272, "uuid": "23e596b2-239d-462f-b2c0-aacafd021e73", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511272, "uuid": "dee1a68f-452f-4f89-83fb-3f0496d92ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511272, "uuid": "78350d96-8332-4717-a58e-b28707bf9980", "value": "624b9e13f66d9e715c32747b8b2b332b89275d1c9ae0b74ac5a61f2a8e51549d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f7a7d-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513072, "uuid": "af7fd7c7-9c07-4c38-b2c1-8c4703e7c32e", "comment": "Malware payload (WannaCry)", "value": "169890b9811b214e922bc59501cc0db0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513072, "uuid": "f304afc7-66e9-4145-91b2-49845835d5cd", "comment": "Malware payload (WannaCry)", "value": "6385dd9f591422733a083df8105d2a90939ff7e991071595065fc1ec78e382ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513072, "uuid": "ec6b9d05-987f-44e2-8efa-f68b53f11dae", "comment": "Malware payload (WannaCry)", "value": "0b8b721c7b579de243097fbc5dafed572140cb0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513072, "uuid": "e2c75705-247a-4e71-961f-bb8e65b60122", "comment": "Malware payload (WannaCry)", "value": "2d18d0762311594e9a6103e94b662416032146973b03f0a9ab2dfaa70bd66a1f9fccf091e98f13d362231864d696cce6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513072, "uuid": "07dfab06-7b87-483e-8223-361835e8e50b", "value": "T1CB36339A70BC91FCC105397584BB4A17A3B33C6D22FE6E0FDB9049791D13B5ABB50A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513072, "uuid": "c7182a25-26c1-4118-99ac-3c6ba6d6d0c9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513072, "uuid": "14c4f15c-3b96-422a-8d5f-2b639297e21c", "value": "49152:MnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAANHuLZy:snPoBhz1aRxcSUDk36SAAOLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513072, "uuid": "7d5ebbb7-a828-4949-a709-2b7d1891a853", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513072, "uuid": "ecd58bc0-97c4-45d8-bdc8-1286def19d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513072, "uuid": "d4d64929-8395-4eca-8590-b6dff03837e6", "value": "6385dd9f591422733a083df8105d2a90939ff7e991071595065fc1ec78e382ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ce33f3-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512139, "uuid": "05b948f4-d73f-423d-9df0-858dacb61dbd", "comment": "Malware payload (WannaCry)", "value": "2c297687e5772f795814c13951abcaef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512139, "uuid": "daf0ff0d-1446-425f-ab88-cbd646f4364b", "comment": "Malware payload (WannaCry)", "value": "64f6cc6d2191e53a33ea548449ef1e5769ba304ae7d38cf3d6c62d86eddd518a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512139, "uuid": "c6617b82-da48-416a-abac-c2fdac4f7fc9", "comment": "Malware payload (WannaCry)", "value": "3dc199f61c3a0e3908fa3c0323a2d13d3526f207", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512139, "uuid": "ddc0d938-9d45-4f2a-af48-a02ce335b261", "comment": "Malware payload (WannaCry)", "value": "84271e13e4f6c284518f9a513b278e6ec6fff415836fc5605502f1c62923dbe943322f89079a2acd48eac34324d792bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512139, "uuid": "faa916e5-164a-42e3-a617-efaccc20b40e", "value": "T104363395A22CE1BCE0051DB044638926E7773C6567BE5E1F8B80B5670D33B6FBBD0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512139, "uuid": "e03741fa-6f8e-4be9-8326-656fd159521a", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512139, "uuid": "41f51b67-0186-4db0-9b6b-4f40cc504213", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:d8qPe1Cxcxk3ZAEUadzR8yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512139, "uuid": "56b50bac-19a6-4137-ac84-4a60560a1cb4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512139, "uuid": "20bb7893-e0e7-4a3c-b477-966657a25573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512139, "uuid": "92390b0b-cb5b-42bf-8d64-3e18cbfc9bb4", "value": "64f6cc6d2191e53a33ea548449ef1e5769ba304ae7d38cf3d6c62d86eddd518a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49389bb9-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509269, "uuid": "f51aa140-87d7-46c4-ac2f-0bf0c324fed7", "comment": "Malware payload (CoinMiner)", "value": "9b8b780462d14adc1c1f53efe4a67f5d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509269, "uuid": "74a04477-458d-41b4-959e-6efed6937fd5", "comment": "Malware payload (CoinMiner)", "value": "652265495eb50132b31bfea4df19a70d2d5a5efc9cb5e7faf7bde5fd40f62f2c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509269, "uuid": "2a0e97d3-7446-414c-95f7-89b479c0c11c", "comment": "Malware payload (CoinMiner)", "value": "22958590fc897d78dd45a8dad6926e427ef30cdf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509269, "uuid": "20e57b1c-d598-465b-be8d-97cc72f4d81e", "comment": "Malware payload (CoinMiner)", "value": "e5cae4efc5cad2685b74235da1b240039dde25a0ca22e9e70ef3c0532a5a16af22121bb47e42089bf2011382437e123a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509269, "uuid": "5ffaae10-926d-4b99-9081-2745242245d7", "value": "T1E3F5336101CBFCFF5981D86858FCBF360E5655F09AAC8265F9290429BC25EE3407B72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509269, "uuid": "ffabc249-6ad6-4568-bb84-0d80b4aee04b", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vH43vw9:G3LG658+S8YrCpHy2dUu4KrCf43vw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509269, "uuid": "4c5f610d-9977-4ee2-b2ab-c1594415ff3c", "value": 3604480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509269, "uuid": "ee94a203-f0d0-4630-a804-0e68650ccf5b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509269, "uuid": "72ce4008-617f-4242-8d66-3f5b1b653ef9", "value": "652265495eb50132b31bfea4df19a70d2d5a5efc9cb5e7faf7bde5fd40f62f2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae466ef6-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509868, "uuid": "db754ab7-dfbd-4b11-84ff-94fdf722bf29", "comment": "Malware payload (CoinMiner)", "value": "d3848dfee420bfdb6462a916effe2475", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509868, "uuid": "9a5b2a39-450f-4c56-b68b-cbc2dfdb9209", "comment": "Malware payload (CoinMiner)", "value": "658b869362afca63d1a6e6ee4c38213d39b61aecca2243b1b8c82bab5167cd58", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509868, "uuid": "b2973fed-593f-4092-9285-74faee182895", "comment": "Malware payload (CoinMiner)", "value": "0601e5594a4743cdcb2091623a2da6fd9f82f498", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509868, "uuid": "0e3a85d4-4ea1-44ec-8faf-fff4c1196ada", "comment": "Malware payload (CoinMiner)", "value": "f6f8e2831e98f16d696032a06e5888e1e943da12bb8433af88e18f31ae266c06fb460958cbb8860dc2f3d9506cacf074", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509868, "uuid": "204591e8-374c-49e9-a0bb-05e38e2c6329", "value": "T1449533A000C3FB7E469C9BD468F876301E5559E02638566AE84F1C6BFC72FE905A7D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509868, "uuid": "bde8c972-0c3e-4a96-b104-ee6f988e5f12", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHa:G3LG658+S8YrCpHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509868, "uuid": "4d1eae0c-2d19-42c2-82f1-f81c6f79ee94", "value": 1884160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509868, "uuid": "c4d0cf8d-3f29-4431-b30a-4da2b967cfbc", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509868, "uuid": "9b3a1ac2-09c8-4058-8fb8-4b35eceee723", "value": "658b869362afca63d1a6e6ee4c38213d39b61aecca2243b1b8c82bab5167cd58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fca4936-e94b-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1767517146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517146, "uuid": "81e71d88-c439-427e-931b-378b0d116764", "comment": "Malware payload (Amatera)", "value": "10155420d8111d2dd026fdc0c641300d", "object_relation": "md5", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517146, "uuid": "c9276c14-8118-46d3-890a-da5cc4bb2400", "comment": "Malware payload (Amatera)", "value": "65e85cf77162126eb7895dcf9858373bb307bb2c7b7b8ae8ab8d7935b78419c8", "object_relation": "sha256", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517146, "uuid": "8815be63-28ff-4ecf-912a-6293c69eadeb", "comment": "Malware payload (Amatera)", "value": "b0b9ce12a1944edcdeba799f726b55f9d21f0502", "object_relation": "sha1", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517146, "uuid": "f62bc877-932d-4037-b411-3db73900c136", "comment": "Malware payload (Amatera)", "value": "b69521d88265d5aacb525d9b8597f277a2011d5a57a497a0fa49223c2c53abaa462da34ef5fb5fca8bc9e56c1d60c4e8", "object_relation": "sha3-384", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517146, "uuid": "d0b611e8-5abd-4bb6-a3d4-4cdd9aae02e1", "value": "T19BB40802B68674FCEDD35930A058BB471E2F719BDB04CFE7A891EC8FCA1A1D1593560A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517146, "uuid": "2bb633dc-07c0-4115-987c-e4217e49a86e", "value": "846c60b7415e38d769a8b7a0468ed919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517146, "uuid": "9e4c8823-f3f6-4ef0-ac7c-5bd5d7bea7fd", "value": "6144:2DctbEsnFI+k6UDai+J/OwGcKfrfImSlAhwQrdtRHpk3hd7J2PxKY99Rwmciy8yV:/jnaWUD6GwwTYdQrdtFpk3UptRwmcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517146, "uuid": "010abb43-195a-4b48-b21e-d6d9ca71ebda", "value": 516880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517146, "uuid": "83f5c563-fdc4-48cf-bf23-6158249c89f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517146, "uuid": "a201b93b-c1d9-40c0-9169-09712f6f18f0", "value": "qobv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfabe9a-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519959, "uuid": "f2f00f57-3903-4b3c-af9c-eaa931e901ec", "comment": "Malware payload (Mirai)", "value": "a25a245896cc9c365e0f4db5473aa6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519959, "uuid": "5da50a27-835f-4f98-b44c-c89d8e9d22ce", "comment": "Malware payload (Mirai)", "value": "65f3fa56f6f5ae96f2367fe09c904019d58f72a23cfb5409322e544765da18ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519959, "uuid": "981dae29-dfcc-48a6-8b38-cdf3d708b0a0", "comment": "Malware payload (Mirai)", "value": "0c2850d00c6fcdf06d53066eb77c1f694f8bfaee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519959, "uuid": "e7b021ad-c908-43ee-8b07-3acaee9b57f7", "comment": "Malware payload (Mirai)", "value": "e79f51e0faf71ebe039e3a0e5ad7b0649d541ebed79fdeed0cba216df69fd00af42a8dcb329a95d3a902e48dc9892a74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519959, "uuid": "b814934d-93cc-4adc-bb84-32e2226c3b91", "value": "T167630986BC41AB29D3C0177BEE6F109E3300A7D8D1DA3253DC245BA47A8EE1B4D67B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519959, "uuid": "dae7e23f-cee5-4788-beb9-5dd05f7ce0a8", "value": "1536:VhjgM41w3wH6pV5Xjg7j4Dm3fU2/gmG8:jF41w3w0aj4D2M24mG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519959, "uuid": "717d58b9-8943-4bd1-861b-82c07f77ba61", "value": 71500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519959, "uuid": "04e5c612-04d5-43a7-a5ab-c757e75a0a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519959, "uuid": "39f65030-ca4e-4dad-810f-8a003f4d46e7", "value": "Fantazy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0e5fc8-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555126, "uuid": "d5faf589-d888-4335-a0ba-a6a64571b8cb", "comment": "Malware payload (Mirai)", "value": "1e69f03364a695e75e28104802fbec74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555126, "uuid": "a816a37b-f8e4-4327-a225-044035180dd8", "comment": "Malware payload (Mirai)", "value": "66dcbc7ffdab1dfbef91d4ccc312e4d48b21ab87847faec3ae3a7bb71b514692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555126, "uuid": "0aa27bd0-8c09-4e9f-be04-33dedb251a26", "comment": "Malware payload (Mirai)", "value": "c63e180d656774ad56750d44c87590acc358d380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555126, "uuid": "cb01be73-472d-4d63-b075-3541639dbb9d", "comment": "Malware payload (Mirai)", "value": "10c8910c7da143d1df790144b50aa356431543b86558e86baaa3771c45c341f822885d89a819dff64fd2b9b29dbd3940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555126, "uuid": "13e120ba-3026-463c-ac72-52781d22f143", "value": "T1E454A50E6F228F3EF7A9877447F78E20965832D61AE1D584D1ACE5015E602CE741FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555126, "uuid": "168cd5e7-67c7-4eec-a1e5-c75eab6446cb", "value": "6144:ch65qf33Uu1ST4Bm/FQJl+hSGiHICTI1r:chrDm/FQf+hPv1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555126, "uuid": "26abb128-e48c-4468-af82-4f33b8c5c649", "value": 294348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555126, "uuid": "f4917b32-7a85-471a-827f-bc56a923d090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555126, "uuid": "594b8d2f-cba9-4f39-8794-1524ddc20beb", "value": ".m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0def0e-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767554878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554878, "uuid": "d5a227e1-c89f-4890-a137-aebe0d27efee", "comment": "Malware payload (Mirai)", "value": "ce8765bbbc172c6a1d389cd7303569a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554878, "uuid": "281dd17e-ccf0-4549-a8cd-db81153df916", "comment": "Malware payload (Mirai)", "value": "66eb708bbef6929d2ebd3c21b2c71ebcac970ab6b0f578b598f3519f658c8230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554878, "uuid": "6419a727-a870-4b58-a14e-35ecf13fbfdd", "comment": "Malware payload (Mirai)", "value": "4277046e006964ee3754b185f17e11da4edd01f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554878, "uuid": "e5ebdb12-c599-42a4-97b9-0df322525812", "comment": "Malware payload (Mirai)", "value": "4d26e30fbba3f9b8e4c8e42d517f3a40f3c2f165838f72cf134344aec67a573e302cc3c490aa8d421d9c4d76d1989a69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554878, "uuid": "4b158903-b144-44b4-baac-e4b0da3d51c1", "value": "T154930239A715BF7CD9364074EAA391B52F43920CBCA762C5794AD92B14034BCE0E9ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554878, "uuid": "e76ee030-7d0f-4cb2-8c03-69f6f7886f42", "value": "1536:5/0MqlCieKpdrbT2gvjoPvsGaPRvPflbcgFVkvtYZZ/0baC42Hqm6S+XdHccplup:5/4bH32gEPAH9bjFV8+h0bJ96Rr+mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554878, "uuid": "2f416a1a-ba6a-4453-820e-3e0ab84f386c", "value": 92264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554878, "uuid": "b758da06-a6f8-4631-a45c-0eee912387ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554878, "uuid": "e6c4c0ed-c823-4012-9d4b-e418901ad1f3", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd99db5-e99c-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767552010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552010, "uuid": "bfe5bf43-c787-4051-b7a3-1bb7095baeed", "comment": "Malware payload (CoinMiner)", "value": "bb027d84538b33927de300eb7e524095", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552010, "uuid": "b2561ca3-49a4-4a8c-91fe-2319ae0de753", "comment": "Malware payload (CoinMiner)", "value": "67ef7c95ecddd6f385897cd6c12e0017a1ea8e538009607251d5de8b7839a07d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552010, "uuid": "82c2964c-b355-42f3-b599-e26c3296f218", "comment": "Malware payload (CoinMiner)", "value": "87eab6ff4f4531d18516f416d8a94987fadbec11", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552010, "uuid": "10acfb8c-6787-421f-82f3-107d2d949f45", "comment": "Malware payload (CoinMiner)", "value": "4edb696d47623432bb30661cbdbf88998c0977c4bd8cd995df4b1c927330590fd922717cc06a971308c4179ff3d7fb12", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552010, "uuid": "ae407492-0a5e-465a-bd4e-f21f58f3e3be", "value": "T13BD62307E7B356F8C66FD03846964776BA30B89A42307E6E5A54C7321F20E605F6EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552010, "uuid": "e35c9830-634f-4514-af63-ddf34894abd8", "value": "1755cbdf5b672e9d7b715e15506ab0c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552010, "uuid": "7fb7ff53-c2f4-436a-b744-451628bbafaf", "value": "196608:6H5z5qeFmhUA/lir/heFBvg5WprNN38tcT1cPwT2Q6Xew89mLQ+f/sQ9/gRjpsl3:6Ht56B/qFWhNN3kW1pT2/XZLLJw1I3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552010, "uuid": "c0b2ba45-c3f9-4adc-b584-0c488b66f78d", "value": 12978616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552010, "uuid": "d7d1ed38-a8a6-4e62-ad93-e5efb07b22f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552010, "uuid": "cdada830-edbf-449b-87de-4b76600ab12e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77705a3b-e98d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767545425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545425, "uuid": "f2f2f518-accd-4d97-8a59-660e843a308b", "comment": "Malware payload (AsyncRAT)", "value": "195e7fa94db70407d7e454375accc1c4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545425, "uuid": "b2f887cc-4a15-4a95-9af8-373e4fd4583b", "comment": "Malware payload (AsyncRAT)", "value": "687e30ee1c9066769481f88ee8468c8a1703032268f14c84346c49641ac5b5c3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545425, "uuid": "df04eaa8-0a31-4864-80fd-b6f4263a5887", "comment": "Malware payload (AsyncRAT)", "value": "739d6637e749d4ab11eeeb408f9a8aeea42df27f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545425, "uuid": "271097b0-706f-499d-bb90-e74c7ceb94e8", "comment": "Malware payload (AsyncRAT)", "value": "351d1d9462623da3a8514e26e7eac7ff23ea8df0fa1243adee7384535a7d167e1007558283d540dd307b5c2fdc59bc5e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545425, "uuid": "06ece18d-adfa-401c-8fd2-7ea0b6c77176", "value": "T10D231B0037E8822BF2BE4F78ACF26141467AF6673603D58E1CC4519B5613FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545425, "uuid": "5b71b7c2-f8e7-4b6b-bf29-e6508c11b0de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545425, "uuid": "58831b80-ffea-43ed-8336-5311d260c03a", "value": "768:LunmVTRst9nWUbUNlmo2q9yhkJHJxOPIcPzjbcg/3i84zhhKBzbtWjCklnULBDZ1:LunmVTR602ERj3cP3bz/SbobtwdodLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545425, "uuid": "8a046662-948f-49c4-b04f-7df38298825c", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545425, "uuid": "20e3e76b-055f-4b8b-a5cc-7c2cb612a3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545425, "uuid": "5a8e1880-8c07-43a7-88f0-fe27a061e1ce", "value": "SunWin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02a5cf1-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512019, "uuid": "c172e1d1-1c9e-4e24-8dc1-9a8975a1fd68", "comment": "Malware payload (WannaCry)", "value": "9e9adbc798894f49d33d0fa9da6638d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512019, "uuid": "2f4a399e-f0e7-4ad7-9366-8ec07af25195", "comment": "Malware payload (WannaCry)", "value": "68ac87420f6c24361da7039df6d79fc3e2eb4dc47e01953caf0e854a408cf3ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512019, "uuid": "28bc5ac6-e720-472d-b124-96e625a849fe", "comment": "Malware payload (WannaCry)", "value": "0600d1720eaf2d401d9794d2c6294a3de83cd50f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512019, "uuid": "0fe21631-917e-4eef-9a11-592e293a855c", "comment": "Malware payload (WannaCry)", "value": "bd2e56c8510ecc25dced2f5cce1e82c1dace5f234e761c7fe89b6b4e11e516905986762203975c60d9606620d155b3fa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512019, "uuid": "e91231ad-ae98-4d1c-8a03-b393fbac573c", "value": "T1EB363359717CD2BCC10919B414A7CA67A7B33C6A66FE6A0F8F4089771D03B19FB90A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512019, "uuid": "63eea5a0-de99-4962-9bdd-a20df586893c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512019, "uuid": "a6a6db94-2e9a-430d-ab14-89c8eb87139f", "value": "49152:QnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:QDqPoBhz1aRxcSUDk36SAEdhvxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512019, "uuid": "92d7b4cb-d2c8-4e7f-9195-75929cef9ecd", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512019, "uuid": "a68be1c4-423f-44e9-a5de-f30ae4ff40b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512019, "uuid": "9dbfe3b8-ead5-4cfe-a345-c0f77c8a2d53", "value": "68ac87420f6c24361da7039df6d79fc3e2eb4dc47e01953caf0e854a408cf3ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ff8a39-e9b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767564402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564402, "uuid": "cb4e2716-547a-4d1a-91fc-d718cf11040b", "comment": "Malware payload", "value": "240e98f8fb7d5d41022f66dd5adb994d", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564402, "uuid": "64dd2774-104a-4e5f-9992-a472ede4684a", "comment": "Malware payload", "value": "694447b18338e6dc074603a1a149e4e470fefc78fd4bed3cd99e965df0cb44a8", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564402, "uuid": "a8ef5be0-02e5-4e63-9c3d-5240960ea3ed", "comment": "Malware payload", "value": "14291bd116a89a6fda15a8e0f9d74e3026dfae02", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564402, "uuid": "6473e676-c17d-42ff-a50f-3f28aa6ac163", "comment": "Malware payload", "value": "504909fe999310954412fb13ca103aed6ea9fa689e5ba9f38bd0e4f8563e55c1f48719bd9913fbc15be8a6d80d104a4b", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564402, "uuid": "992764bf-03e2-4121-b00e-340dd2f03baa", "value": "T1CD41FAEBC0F2207578A0201D07CE504AD4C31E8A7EA454DC7DBC99248B7E168EB75EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564402, "uuid": "93410ee7-eaf9-4bb4-ae80-0c13ab2b57d5", "value": "48:Cr6Tr6A0aoLp+LIKEBIsCiC/pC5ZybyJTT4G+XC:Cr8rhoLpPJCakyJTTh+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767564402, "uuid": "5a3947a3-506e-4ec4-a593-c7303363484a", "value": 2196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767564402, "uuid": "c8bedd94-0591-40a2-baca-a0926ab47f08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564402, "uuid": "a8cc0f88-431a-445b-8233-6678e7e112ae", "value": "694447b18338e6dc074603a1a149e4e470fefc78fd4bed3cd99e965df0cb44a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee00787b-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512123, "uuid": "77315bc8-1896-4a2f-9250-b17e7a6c59f9", "comment": "Malware payload (WannaCry)", "value": "fe8dff61d13ef95485b94956bc835e0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512123, "uuid": "8176a0b9-1dd1-4c6b-b4a6-eccb1d8b4d62", "comment": "Malware payload (WannaCry)", "value": "6948738eeab43f9a92bdd252361f58d9cc9ac86ccd5545585d56d7ae8fd15e3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512123, "uuid": "c14797cc-bfe0-4d18-a216-bebc6eb48e76", "comment": "Malware payload (WannaCry)", "value": "4a4aaeb37c666c40d49e1e3c4acb87c37b6b5c05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512123, "uuid": "6af180da-6ab8-4e8a-9716-2d8c1259fd98", "comment": "Malware payload (WannaCry)", "value": "34e85bc2541b53923a064271811f0ef49932b52400b5eb3c0ee01b11e90bf21b2c8b8e041ee5a688d1c6c93f0f7727dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512123, "uuid": "6821819e-0880-4457-ab4f-984565669fb4", "value": "T1C036235A766C90FCC10A627574634A66A6B33C9A22BD970F8F548B520D03760FF78F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512123, "uuid": "d0a7f537-9885-4a31-bae0-74b6643ce6ea", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512123, "uuid": "2444adb1-d6b5-4259-9f01-ea042d8f1fb8", "value": "12288:yebLgPlu+QhMbaI6xu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXX:zbLgddQhfpmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512123, "uuid": "5a1e2756-87d5-4330-952c-8e9df3d05a70", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512123, "uuid": "68a72c4c-3ac7-4e80-8fe0-16fc95b589e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512123, "uuid": "dd09ac2b-c7e1-4d12-a394-3278830f6c18", "value": "6948738eeab43f9a92bdd252361f58d9cc9ac86ccd5545585d56d7ae8fd15e3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfc9177-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512792, "uuid": "14ad3bcc-9aee-4101-a306-4981f5542002", "comment": "Malware payload (WannaCry)", "value": "519dea0ac010f17298000d98a04b15cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512792, "uuid": "d6b6c063-9bb7-46b0-bab7-dfa0b60f029e", "comment": "Malware payload (WannaCry)", "value": "6aa4462ebef6c7eddf40e88f082e1f5c0f9df9ee3b6a845694397d8eb678b370", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512792, "uuid": "d8a4cc50-3196-4e5a-b9c6-f245d09b1d54", "comment": "Malware payload (WannaCry)", "value": "a297471010cda4416528be6a56249ccc94159e8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512792, "uuid": "cd760068-61e5-4fda-bd66-983da546af05", "comment": "Malware payload (WannaCry)", "value": "3840c0ed20633fdfe7e3bed637cdc748d6e036db07fdcab055aac7ca315ebf0bc832219445673d621bbd4ccd2a18e029", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512792, "uuid": "8f394293-3568-4e15-ba3d-849884dbed2e", "value": "T10436E00DD7A0E43CE87334BA9325273C61ABF6B42A1BD45A2D962CD07903DD16E74D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512792, "uuid": "c17961a2-6727-4174-a95c-46027d448672", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512792, "uuid": "31240811-91de-4063-b0cc-6d6579d44df2", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvVt1yNiQ:+DqPe1Cxcxk3ZAEQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512792, "uuid": "71a3750d-faa6-4a8b-88a0-4b3063602a7f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512792, "uuid": "0c3b271e-c3c6-47a8-84df-3dcb6ab7f5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512792, "uuid": "f1527061-71e4-4bf8-a10a-a3f257c3fc6d", "value": "6aa4462ebef6c7eddf40e88f082e1f5c0f9df9ee3b6a845694397d8eb678b370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfbe1ad-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516790, "uuid": "93ba2a1e-13b9-4cbe-bf59-a54758f0ea07", "comment": "Malware payload (Mirai)", "value": "3a248d4a4f026ed4ead4988edf99e06c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516790, "uuid": "ff363ce6-b6b4-4b6d-b4c3-5b41e69eb532", "comment": "Malware payload (Mirai)", "value": "6e86ccfe3c038680f959ac32333e986ccbf5320edb86147f90e97edd5a0c35b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516790, "uuid": "e03f70f6-1042-46fe-8dee-5fe0c16301f4", "comment": "Malware payload (Mirai)", "value": "2c6e1649be37a99a75a2cde58f945cb59867d185", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516790, "uuid": "34758f4b-9516-402d-bb92-05f3c5669da4", "comment": "Malware payload (Mirai)", "value": "208b3ab2fc7e94f69c6af5d5e2f4a1b4bd23f7c28d7778776db8fa596ac9b783d680fba5d55e4967f8937bf80c185924", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516790, "uuid": "48055f92-dfd5-4d07-884f-3ce8bdea2500", "value": "T13FB33957B9929B11D5C311BBFA1E518E33130BB8D3EF72169E106F21238B96B0E7E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516790, "uuid": "3ccf94ff-daa5-451d-a085-d57b4e7bcc54", "value": "1536:oJniJsGQn48L0XoqF4kvOYRSLdi9m55D2a4GrSfVtdPIiy/CCF97w86YSL7:ts570X3mkmYYSmjD2a4FM/CCF90BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516790, "uuid": "1df5055e-911a-46ca-91d5-2c2f46df17d3", "value": 115924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516790, "uuid": "7e3c98db-e09c-418a-98dd-70b7434477f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516790, "uuid": "a716bced-ca32-4245-b6a4-f5168c202467", "value": "6e86ccfe3c038680f959ac32333e986ccbf5320edb86147f90e97edd5a0c35b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724b098b-e998-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767550141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550141, "uuid": "88fcaf79-f172-4112-b1f5-2403ae7c97e9", "comment": "Malware payload", "value": "92d8116165d6b9138b16588d4d8172ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550141, "uuid": "e1d5c4e1-c733-4dac-a6ef-ba771129e7c8", "comment": "Malware payload", "value": "6e89d09c5be3815d91a10eb478e071d7813f1a02a18741647f1c2b35af08f335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550141, "uuid": "a9141f54-4944-4b51-9446-ab1ffc79e91a", "comment": "Malware payload", "value": "d6e04f6321b15a4f709f95761d6433677b3e3adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550141, "uuid": "2b771180-9611-49a7-abfa-4f5bed47f126", "comment": "Malware payload", "value": "397dcf6ee88022e8d66aadffed93e8e0e7c397b5805229d6745fb7f891b02d0c11f1ecb7bc06e62fdf3f6540cf3ab05d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550141, "uuid": "880ad1e7-f406-40f7-979c-cf205fd76867", "value": "T1EDF733114BC8C94ED2A661BADE39F1F15106AC0F2699C88B36F66F53B2743671C60F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550141, "uuid": "d8f108e4-81ec-4cd2-bf15-43d0e8a57890", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550141, "uuid": "22c2ea7d-b812-4e71-9a26-8eb10b5e99ec", "value": "1572864:TbBAV6xfmXKpSjR5LrvTuY6ASuwtxKoOsxoB27kd:TbBAoxfuKpSjrT16ruwtxt224", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767550141, "uuid": "bb874987-50d1-4dc0-b5f1-98997fb9d810", "value": 75851007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767550141, "uuid": "46dc36b3-dcb8-4c14-a1ba-2a0961c337f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550141, "uuid": "d478aeef-e7ad-4d27-8a74-db7a2108d87b", "value": "UnifyInstaller-Setup-1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824e9c10-e9a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767554462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554462, "uuid": "c8c4326c-4a74-427c-80c6-68ad84b173da", "comment": "Malware payload (Mirai)", "value": "115f8aabe1e2fd47ff4a8bb4e7a4bcd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554462, "uuid": "9ffc554c-a1f0-4e24-ae31-7a5d362ad067", "comment": "Malware payload (Mirai)", "value": "6f0e227e059bb85a008d615ceb05c5c242a60b95cc038bf804565a17da2cc0d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554462, "uuid": "f2a87577-7f8e-4833-8b6f-b2117fee24ea", "comment": "Malware payload (Mirai)", "value": "1f8f2f015643c182114cfddb77d330c3bbb279dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554462, "uuid": "c2676262-5302-425b-afaf-07cbd1a4074a", "comment": "Malware payload (Mirai)", "value": "d02e05b7bd3fbbab637c228170daa5b902f0a69edd8faa66cd13626249def0d56f53353d35ee6efad315e21f31fb2bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554462, "uuid": "29abc52b-fc09-4a90-b375-741c40cd0384", "value": "T107A30226C10C908FE598ECBF4F1D4ECCBA531D17235329BDC595B84FA16E9067E4229E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554462, "uuid": "e959404f-e14d-45c4-a112-caf0a9b68336", "value": "1536:9cxOAL7PmhbzE80PoJzZeyiUMAHpb2J2fYXGLwdeueiLJTtevbXV37TVlw18:42uuzAvL/JOYXqwAuBLOvbVrByC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554462, "uuid": "c43f330e-ad8a-4b9d-8a9c-6853f403af1e", "value": 103640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554462, "uuid": "8b116102-14d3-4568-81ac-fd8ac4282b27", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554462, "uuid": "f4665099-8bfd-4a6f-919c-c2f321217157", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca59056-e967-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767529086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767529086, "uuid": "2d963153-f856-40c1-a632-6c9fd4f5c0c4", "comment": "Malware payload (Mirai)", "value": "8d1a7e83191cffd8f1e0a651a66ef0b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767529086, "uuid": "a92ca6c5-0c13-43bd-b4e9-2ce6bff5331f", "comment": "Malware payload (Mirai)", "value": "6f7c7d83683225754fcb1d7e86c14ba76c36ae969c3eca6b0088c7b78633b9d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767529086, "uuid": "ef04ffde-f317-413c-90b9-8685a3d3959e", "comment": "Malware payload (Mirai)", "value": "69e478d947c05fd52ed9421e3e112c5f38fc0e60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767529086, "uuid": "56a6b135-ec1a-40e1-b8fc-5670479d0d3f", "comment": "Malware payload (Mirai)", "value": "61794dada387fdba3c0d969f52441aa4970515be2eb9cad2f300a3d767906509cd407312c240cb6729ee6fbda28e53e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767529086, "uuid": "8e013bb2-c11e-4e21-8d36-9cf3a15eb479", "value": "T1CB056D1BB2B374FCD557C03443ABCAA2A935B43902216E7B65C8D6303E5BE701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767529086, "uuid": "9b9ce302-6d3a-480f-9db1-03411cd4fae1", "value": "12288:PBZnfeFMlVD4s85D/PkkV1s67qAtvcpv1rZXMCKwXwkstgKEdzuF3TmJywYrhAFK:DnGS94skkkV1scfEpdrZehkst4G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767529086, "uuid": "4509a682-58e1-49a3-976d-9260d57240f3", "value": 832240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767529086, "uuid": "c45f6b08-e415-4045-934c-0ccc82a6187e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767529086, "uuid": "8da12e60-0e5a-4a3e-be61-85605a86749a", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac59e95-e9a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767554342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554342, "uuid": "5cd676cb-6c01-4116-91f1-22d12a9b102e", "comment": "Malware payload", "value": "dc9572c447c4b068d4302558513726d1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554342, "uuid": "6cd1b48f-dbe8-4730-b270-0f7c7bb33cae", "comment": "Malware payload", "value": "6fbd1d2192865099bd3772f6b77f269ab44be19a44ae41475486dbaf52ecba72", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554342, "uuid": "65aba22e-54cc-4bd6-8c8e-13da67323413", "comment": "Malware payload", "value": "ba95e06b15ad1e0e9d43103073d41f3990238692", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554342, "uuid": "9fce0eab-1f1e-4248-aad4-bd5a78bb1bfb", "comment": "Malware payload", "value": "eb2ce8384c63f84b2de62304fa7d0cb0f4c7cee9622152787254d74937792ef6cc8b8901beba3abee64c82dcf64c0af2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554342, "uuid": "86e8ad8d-9751-4a66-81b6-18e17009ddba", "value": "T1C83395A167F9152AF6F78F783C7065968C7ABE726D61E08D4280204E08B5F95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554342, "uuid": "0f50c6b5-740e-4b12-bfde-4ecbba18752f", "value": "648be50ba47e23462fad218c8d2609da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554342, "uuid": "159a8cde-87a4-4dee-98b7-273dbaff9b41", "value": "768:mxVO8u/0vaXDiTLlGCI0App33R/U7+dEErfcqsq:MOaEiTLXA3H+idEAcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554342, "uuid": "76990c47-3102-4b30-855d-16a8f9e647d9", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554342, "uuid": "0d5cae7e-5ac7-4a07-82a3-576f15931378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554342, "uuid": "8644033e-f983-4d4b-bf6a-697820bd5cb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a7b0c3-e987-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767543066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543066, "uuid": "f25fe19b-6f56-4b72-b8cf-7d285c5ab82a", "comment": "Malware payload (AsyncRAT)", "value": "72ff6e92adfb2001ac164a4bb646903c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543066, "uuid": "5b142c9a-0678-44bb-a3ae-1b29dc839ca1", "comment": "Malware payload (AsyncRAT)", "value": "703f5d89f887e05cd6d84b29d7c344844b263b1b570d8470e05e688389320464", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543066, "uuid": "df873db7-68c1-4ae6-b02e-cf0b36c3d196", "comment": "Malware payload (AsyncRAT)", "value": "45c618198f403eeb157afe12c2d7242b0da55b13", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543066, "uuid": "4ad33fd6-0f54-4eab-8388-403de0805d29", "comment": "Malware payload (AsyncRAT)", "value": "bb67d7921c435e2221c82dca8625384edc8febd5d3b5eb65382ba0aa279e7f7890dd97afb63beff534e7b339f6149883", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543066, "uuid": "29b6e48a-fcbf-490c-8835-54cd42d863a3", "value": "T14A936B013388C925E1AD4AB4ACB745010AB6DC771105DB5F3CC63ACF6FAFBC656126EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543066, "uuid": "563201f2-463b-4bf6-9a7a-2f4717fabbac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543066, "uuid": "e3c1e6bd-31c9-46bb-b070-c6ea1548be0b", "value": "1536:WSSnAh0o9/MgGbb4w9XGnrWySWRTyMVclN:WlAh06/9Gbb4DOoTyOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767543066, "uuid": "596d49b7-00af-4655-8584-caa9c8ef56b7", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767543066, "uuid": "4524ac71-6a16-4af8-80e9-50a588463fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543066, "uuid": "b9e33dec-546a-4450-92ab-e70c6a8c2860", "value": "Internet Explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9963db8-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767516813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516813, "uuid": "dbb610ad-b79a-41a2-9499-1e6ff098ad33", "comment": "Malware payload (CoinMiner)", "value": "0cbd0588eb1124a9d35410d260e7d8ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516813, "uuid": "893eeca0-98a4-43dd-91a8-8c73e6a83fe6", "comment": "Malware payload (CoinMiner)", "value": "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516813, "uuid": "e5265d5e-c4e2-4c2b-9ebf-043f9a5266d3", "comment": "Malware payload (CoinMiner)", "value": "d2129c5018c98f29590466a5f9bbcfcab4516924", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516813, "uuid": "ae524cd1-750a-4e34-81c9-5782537a397d", "comment": "Malware payload (CoinMiner)", "value": "33a8c9e67ad86e58ed31c737de4c010bd752899a73c5bd132085c29952b6e93706fb0bfa90bfc52df24739685d03f9bc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516813, "uuid": "258d0a78-eb71-41c5-9ccb-bd5abe1e715b", "value": "T1DE34CF2AB7C0EC12C8C5197BF82B46E83B535F5CD3C5B2093D15AA3D76A709A0A7DE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516813, "uuid": "43e33088-2902-4b0d-b94a-3672602b3c73", "value": "6144:zSPOl+fNFzBfppUvxTZKI386tHw+aDJcW3nvKN4j4Qtz1Szp:2PYBvzKIpjaSW3nCeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516813, "uuid": "c1e69e79-6f90-41c0-861d-e64bc97b68b2", "value": 231196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516813, "uuid": "eb8c05ee-a4b6-49d5-a634-810ed3b2a0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516813, "uuid": "4af202c2-2e3d-4fa1-9650-3828fa5dec2c", "value": "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a844dba-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511500, "uuid": "b31048ab-be40-4cd5-b6f4-82db7df0f6d5", "comment": "Malware payload (WannaCry)", "value": "de1643b8652772de82dc122346da2b7a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511500, "uuid": "f7da7fc8-9fda-4483-9283-51a53a3e37e4", "comment": "Malware payload (WannaCry)", "value": "72095ecf72409880f803e21fcd3304bc5ce85c9355fd165532db6c289cbf9759", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511500, "uuid": "0c4660ab-9660-41d9-9e5c-b0bf7b65f41a", "comment": "Malware payload (WannaCry)", "value": "89313167e1bd23aac0ef2eb3bddf25ea09a22303", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511500, "uuid": "9b13569b-f8d2-495d-b3ac-e25417016b60", "comment": "Malware payload (WannaCry)", "value": "a4d3cd89cbd6274e087bfce03e85cbb3b5ff87ccad63c77a0f131bebf37bf4a07328060868d7fa4242de4a92bf3c2684", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511500, "uuid": "d9839bf2-237d-4641-948d-3af83be24f8f", "value": "T17236239A35ACA0FCD50567B4A4778A26A6F73C5A22BD970F9F4087610C03794FFA4B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511500, "uuid": "fb9bc73d-6309-4d3a-9725-4ce800cdc67f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511500, "uuid": "7cb127f0-1368-4bfd-b0ee-758231f3720a", "value": "24576:nbLgd3gQhfdmMSirYbcMNgef0QeQjG/D8kIqRY:nnVQqMSPbcBVQej/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511500, "uuid": "759e2310-c5e8-4ee4-a0f7-f17d2db9e8af", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511500, "uuid": "4a764a6a-e4f4-4023-adf2-4360a9b64016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511500, "uuid": "04a39a3f-c279-4659-ae71-fe372dd70680", "value": "72095ecf72409880f803e21fcd3304bc5ce85c9355fd165532db6c289cbf9759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054ad045-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512591, "uuid": "96fc740b-5e63-444e-be4e-6a6c0f56f810", "comment": "Malware payload (WannaCry)", "value": "20ef171731af9752a83cece44d65a2eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512591, "uuid": "dec8d572-5e1f-43fd-82ef-7a86d9562119", "comment": "Malware payload (WannaCry)", "value": "72beedaed8ef9d2d5eb1d9a8410276fee83f4da5de7e9d4c8bef4e7fbeb3be1d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512591, "uuid": "88d17854-5bc1-422a-a653-aa16af30e5d5", "comment": "Malware payload (WannaCry)", "value": "8464301c80afbff7638b92c6bcbdd45774be6a97", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512591, "uuid": "31175cc7-06d6-4499-af50-37ae1e841b31", "comment": "Malware payload (WannaCry)", "value": "e8112d0f20125ee243d823ae34312d7d04ae6fe8f4163543a47fc417b121998009432a28f6820b3b5eb8d95db070412a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512591, "uuid": "7c7afc49-f684-4080-91bf-dd31311a89ff", "value": "T13936236A756CA1FCC116237564778E2696B77C5A22BD970F8F408B620C03764FFA8B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512591, "uuid": "5219fd7e-54f0-4ec3-8ca6-eb7434a0b13a", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512591, "uuid": "d1da400c-40eb-440d-a082-f52467b2e3cd", "value": "24576:zbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYo:znAQqMSPbcBVQej/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512591, "uuid": "6dc5aa04-66de-4f9d-8ed0-478633d1306e", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512591, "uuid": "e6b5ef4e-5362-4db5-adf6-fa69235b58c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512591, "uuid": "80dc5413-b7e4-4b68-a4d6-f74e23ea6cc0", "value": "72beedaed8ef9d2d5eb1d9a8410276fee83f4da5de7e9d4c8bef4e7fbeb3be1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5439b6f2-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512294, "uuid": "df00cc1c-e987-45b3-8452-b136dd69c94e", "comment": "Malware payload (WannaCry)", "value": "f0b0714d21283cbb8429edae07962291", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512294, "uuid": "bfcee55a-a0c9-42a4-bcb2-9da5b1ef8787", "comment": "Malware payload (WannaCry)", "value": "72c16fb052a842a29ab7077e2fb32bda4a1fd344872cbc762ab2ab3c4fc35bb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512294, "uuid": "17c15d8a-824a-411f-bf8b-def983afb4d5", "comment": "Malware payload (WannaCry)", "value": "6df6cd4885c71b5ebb9c4ee0750a9361770d9059", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512294, "uuid": "15d75a0b-c640-4b99-ae4a-d1f4ba8e48a9", "comment": "Malware payload (WannaCry)", "value": "f25f6f5198dcef844c1d4bec5bb8f80f822be8764b8bb4219887d5b0bca4911087c98b7f3f0f38247584e37a3bc9031b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512294, "uuid": "c0615006-107c-40ef-af57-ddbd5d6750c8", "value": "T19736236531A8C0B4D107157044E7CB62F6B67C3A17BA694FAF804E7E2E63B96E311B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512294, "uuid": "a8d22cea-d6a0-4fb1-af99-844b698090a1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512294, "uuid": "e5fd1a08-071d-4624-be9d-1f18debba0a7", "value": "49152:RnpaSPbcBVQ7/1UNRx+TSqTdX1HkQo6SAARdhnv:1pJoB81mRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512294, "uuid": "bf0bb7e2-4a47-49a4-9651-45a450cb33c8", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512294, "uuid": "159b0512-ee8f-42ae-842c-8774ae3555b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512294, "uuid": "18287d88-c152-4ed9-a60a-affc00c2dd89", "value": "72c16fb052a842a29ab7077e2fb32bda4a1fd344872cbc762ab2ab3c4fc35bb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d5badc-e943-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767513690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513690, "uuid": "aee7b067-9ef3-4c40-b895-187e754b076c", "comment": "Malware payload (Mirai)", "value": "5d65f901163a09315d091e7dc194785b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513690, "uuid": "acb10181-a2b3-40c1-8964-efb8df199779", "comment": "Malware payload (Mirai)", "value": "73406d8eadcbde8f10aec314da9b3db03e2ca249f7762a4425ceda5462097626", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513690, "uuid": "a4643fc8-ebbb-4457-8d71-e2fb94b76d0b", "comment": "Malware payload (Mirai)", "value": "4855c712df1e74c25d1f518f48ce7b1f9d25c5d7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513690, "uuid": "9cb61ed0-a9af-4e6d-aeb6-d59b035c5074", "comment": "Malware payload (Mirai)", "value": "5068f3ba9750bbcb2b195c7aaa4cb683d53a8cb092dafd333388b4f89c9b2b6dce9e0a2f780e26918c56627d3dea6c1e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513690, "uuid": "60a1031d-1c84-4882-88d2-1a5cd7abc614", "value": "T1D52182D851F455B7DAC8AD09B1B6C79D504EC8C73EE394E1E8DC08A2EB83090F5E671A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513690, "uuid": "645e5a8d-db2c-4897-b83a-2cca7b72f7c8", "value": "24:ZxyBLBnBw0BNw8BhvsoBH3Bm78BD20Bkm13BgK3BjP3B2o3BZi:Zw1Bw41hzRKQDR9rxlpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513690, "uuid": "f24458df-6951-4b28-af72-60d3c16f328f", "value": 1379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513690, "uuid": "bc0709d5-8a59-478a-a96a-c93e7cdf577c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513690, "uuid": "0faa3f4a-d1b0-4f7f-8a7a-2b9f94f894c3", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3eecf5f-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517689, "uuid": "03ccb489-19b8-4f1a-a9a6-f1d2aea883c7", "comment": "Malware payload (Mirai)", "value": "a907e7b7672df9ac7e866c7406939aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517689, "uuid": "631e5ba3-1a33-4810-b90b-f32fc30ffffa", "comment": "Malware payload (Mirai)", "value": "73ed2c3b85a3b6805b6ec88cb67bf2141b2a3bb41792ebc2df9659771e437e54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517689, "uuid": "c4a0f6aa-38f3-4bcd-9ffd-fa6d0337f2f8", "comment": "Malware payload (Mirai)", "value": "fee2e11ee1a3ca7aedd38250fc05d0ae3ae0ad9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517689, "uuid": "667efe59-60e2-418a-a1b7-0129dab33a5a", "comment": "Malware payload (Mirai)", "value": "f4426adbfd5f76cd978a9bbb22daad59f0aca1e8b5cd8d52cb14b8a3daffbb091a0fa766dc4e2c92a2ba7edebc0ac7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517689, "uuid": "a4d8339d-882a-4743-9dad-03717fd1652f", "value": "T154E3290379C1CEFFC497D1F44BEAA522CD32F82A1935715A37A47EA61F49ED02B19620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517689, "uuid": "96009fd7-3118-4939-9903-1c28f10e9ee7", "value": "3072:VOLTCmZ5pQ/jH5RfKhAqTng1cRDxEW6Vpo00ocuDvSwy/:V+TFuZUHCc1x4prq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517689, "uuid": "32adcc0c-81ce-40bb-83df-c7a820a3ba0e", "value": 146448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517689, "uuid": "ae39bbda-f06f-4490-98c3-d1f9fc01c8ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517689, "uuid": "095d5777-650c-44f8-985a-e9a93265e47b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e814ee-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567167, "uuid": "5abd07ce-c84c-4a3b-a5a9-cab28d1836b2", "comment": "Malware payload (Mirai)", "value": "219a57a98d27581eb51a79a92e03b82b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567167, "uuid": "957e36af-0f72-4ffd-a195-1860f1048605", "comment": "Malware payload (Mirai)", "value": "741314250a98c779bdc434c738fad84b27ccf51fcb1f43c280aced722563e031", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567167, "uuid": "54d8c549-1b4c-4b82-a1cf-a5d9a7372953", "comment": "Malware payload (Mirai)", "value": "520ed4482dcf11c2517d4cd33caa57c6d80164c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567167, "uuid": "351d04f3-b468-479f-9602-2125eb65bca5", "comment": "Malware payload (Mirai)", "value": "e1d1f7f9f525ef63593a1e63ec38ebb3242613c0247000c351d7a55fcfa09e4d458686faf136a4273856ce3541b42b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567167, "uuid": "fe5c4701-69d1-48ea-a8a0-f830bd68da26", "value": "T1EE638C67C92A6E08D115A6F0B0B19B391B63D56081CB0FF96666C779D083ECCF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567167, "uuid": "3695e90e-e561-4c55-b5fb-a4f9b21d8542", "value": "1536:DuLdvs9GYx1KYx7QHsmICCMBsv7cingFHi1:tJeYfmICFspgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567167, "uuid": "7348c28f-698b-4b59-88a5-25dcbb18edf2", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567167, "uuid": "de4bf9df-e94f-47f6-bf08-f1e149d6c960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567167, "uuid": "539ec7a1-b60f-4327-bd38-499f89fe0139", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdb17ed-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517683, "uuid": "ec67ce7e-d8c1-402d-8e13-6035eb484d74", "comment": "Malware payload (Mirai)", "value": "a527aafa684d6ec70f69eb35c1a96476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517683, "uuid": "4840ec9b-12b0-4efe-b135-a306cfced481", "comment": "Malware payload (Mirai)", "value": "74a23663f3be463fa62e0a38ddca5041b3a0da3d07f88da4ea9a12720216d1b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517683, "uuid": "71347690-03a2-4f77-a490-8eb1b73fba55", "comment": "Malware payload (Mirai)", "value": "376b14fcb541cb3ef654e89248cf7bf60bf28e06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517683, "uuid": "5705b742-a2e3-4fde-8bf9-723225a684a5", "comment": "Malware payload (Mirai)", "value": "eba5e33012ca50baf927989c7b5e3a97694b0ceb0c6ee50ae2a01d59014596c4796ed1456f3ddb6e42570f0072db4575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517683, "uuid": "e3a39432-6ede-4c54-ab55-52a4247a6b5b", "value": "T1ADD3E842BD418F13C5C321F7FB9E429C7A267B6DD7FA71029925BFA0378A4D60A36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517683, "uuid": "a98269b0-a36b-4c44-b765-0e2b2312cdf8", "value": "1536:mzxfRnd6SRPTPldyG2WG2LvfY74VefSTZgSNQ2MeO5RtpFSFR0Nb4Dl/1wyw6/QC:kpcMPzlj2WGl4USNgSH+iRQb0/VMrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517683, "uuid": "887b5fb7-67bf-4a2d-adbf-38d78212fe41", "value": 136804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517683, "uuid": "fceb97c0-455d-493e-94f9-c9b0467ea1e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517683, "uuid": "7ecdf11b-b7eb-4c55-ad38-8e301fe92b61", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf71926d-e999-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1767550726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550726, "uuid": "dc83ce25-0e56-4e4e-8de3-73a280fb37de", "comment": "Malware payload (Phorpiex)", "value": "9d26d4f8e18131084bee00d99a755dfa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550726, "uuid": "0c1cb46c-bf01-4917-84f5-b01fced57124", "comment": "Malware payload (Phorpiex)", "value": "75e5535a7b6aa384097fcb990c3ea85f8cbd1db87593dbf4f3d7fe7a619ba3ca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550726, "uuid": "e658c642-6c11-4435-b690-f7838300013e", "comment": "Malware payload (Phorpiex)", "value": "450338dd3634df424b777389552764b74b69ceb5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550726, "uuid": "b8260963-939c-463e-8f36-34ff272fa3c7", "comment": "Malware payload (Phorpiex)", "value": "afe266d2036ea19c3f639da48c328583bd0b6dec988a32e9e3ae927f74070b4b4a3d247af06256fc0a8526389aa2dfed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550726, "uuid": "12ff8f01-2865-4fc9-918f-a6a753b63a8d", "value": "T120824B0BBC50413DE4C144F85232AA7E8DB958BA378169EBF3C045CD89785D2F83A92F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550726, "uuid": "b22acdbe-2d16-485a-8ee7-8b620b88b968", "value": "51c161c9913a4b650517329371c6046d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550726, "uuid": "e26b0242-131e-48d9-9bb1-967f62d1b19b", "value": "192:m7wioLPXbeng7GQxN/vy4zTP6DcVD5xYQEZeaymJr1KUSh+zwzwUSJxTopHB9ctS:l5X/NScT3D5xlE4ayou+slScpHB9c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767550726, "uuid": "7d49e7f5-9a5c-4e19-9be2-c89a582fa1bb", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767550726, "uuid": "29932c2e-65e3-4cb7-a2e3-ec2dfdebfcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550726, "uuid": "5ab54cfb-3b6e-4978-8e67-647ae5c6d59a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b96617-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567160, "uuid": "0d3ece5f-b0d5-46ee-8aa0-58a75bfc9590", "comment": "Malware payload (Mirai)", "value": "3942bdf4fcdf7785835d374bd75087b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567160, "uuid": "2d4bb367-4266-4669-a521-164559a1e46c", "comment": "Malware payload (Mirai)", "value": "7720750a19073e4567d2cadf84bac8b7cbfc2ea89d9b5b32bb9e8af311dac236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567160, "uuid": "7e2fa1f9-ba9d-4c8a-a367-40209235005f", "comment": "Malware payload (Mirai)", "value": "f96bf3879130b5232b7ebbf7b61fea516ffa576e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567160, "uuid": "901693c2-74dc-4d18-ac41-2f01b0ae72cb", "comment": "Malware payload (Mirai)", "value": "67931daf217b5c90c03379bd3590588ca21307ccf8c104cb18a27f49c04957655c8d16d5a9bc709a551fddd935c84fae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567160, "uuid": "24c6c258-8299-48b5-aaf5-246bcd48dee2", "value": "T1D4C34B46EA808B13C4D5177ABAEF42453323D754D3DB73069928AFB43F86BAE4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567160, "uuid": "cf86538d-6f08-4d17-943c-0f2068676190", "value": "3072:+UCN2rRf8CuwiEn8BPPYsdeJLl1mz/QLM/9Su2U7:+UCafZRiEn8BPwMelSz/AM/9SPU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567160, "uuid": "ddd885d4-0fbd-430b-8c9d-281df68a12c2", "value": 126751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567160, "uuid": "1b87c73e-01b3-42b6-b66e-05ff442969af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567160, "uuid": "4ef148c0-af5a-4416-9b62-ed1ee511973a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd64a2-e983-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767541196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541196, "uuid": "5b9652a9-edf1-4080-97cf-3ac795385c90", "comment": "Malware payload (SalatStealer)", "value": "a7948e4813c32bf548f866d2ab6e44a9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541196, "uuid": "71adaead-4e87-48b2-a84e-50615eb52e7e", "comment": "Malware payload (SalatStealer)", "value": "78dabf87fa776fc41cbe743b86784961010c9e1db5c6a33c14a1363875341d17", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541196, "uuid": "94a0a94d-b071-423a-97a3-82c7b79c0bcb", "comment": "Malware payload (SalatStealer)", "value": "7732fcb75e758c4adfa35f2dee5b99158a5446c1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541196, "uuid": "a4015738-006b-43c0-84c8-3829af2798e9", "comment": "Malware payload (SalatStealer)", "value": "ddfce14b96213994f78c022e62badd25cdf2b1e900bc927bc9eb455c1a1fda6a17ea94c541886090c2d412bac90994ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541196, "uuid": "2a04aae7-2af3-427f-8838-138d2f89b11b", "value": "T14A17333EB60B2752B25C892B9131F01299611E1DC73E7D5AA8594835B97EC7C38E383F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541196, "uuid": "8b29565a-ed00-46ac-80a0-ef27f1a59289", "value": "393216:+W92s1gum++psyNbxSFmVzjrpHc0UGZ9gX159qksr:59r1fvyBXjFHc0XZ9gX1qksr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767541196, "uuid": "dac2f343-dcd2-49ba-842c-bf9446f3c8a8", "value": 18577832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767541196, "uuid": "21541503-ed52-4012-add8-843acacadaad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541196, "uuid": "e628f509-7cd1-4698-92f0-f91b0d820a80", "value": "Ambani.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a713c3a-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567173, "uuid": "abad4927-5e76-414c-94a4-0fa85f268eb6", "comment": "Malware payload (Mirai)", "value": "9814f2397b4c1372bb030490047f2975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567173, "uuid": "be5a122c-c4cd-435f-a815-c139789890b3", "comment": "Malware payload (Mirai)", "value": "7952e9d84cfbdf3f8772ab767e6646047278e02549fa4b109c47887ec0c9ab89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567173, "uuid": "607bc970-9338-4400-8bc2-e6b3b5fdea46", "comment": "Malware payload (Mirai)", "value": "6114e33cb8e5db65c530a670b5ec3b7d772181a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567173, "uuid": "5f195d75-3143-4606-9a17-b07903f82a02", "comment": "Malware payload (Mirai)", "value": "27c0a6ed469e3617dfd308a27dc3e841d6ee43763665b0d9001840fffad16111d91ddf82388b9001e79011998d08ce5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567173, "uuid": "3828a041-6905-46b6-b951-e64f8745d0d2", "value": "T192736C17F4C090FDC99DE2745BAEA326E93770391134B22E27C4EE267E9DE211E5E250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567173, "uuid": "39212260-c437-4ed6-85a9-d11105d7f221", "value": "1536:pj8pRVwzKCu2l/laVwi+/nurTg53qcRu:URVwzY2pl9i+0TgJ9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567173, "uuid": "27a2ed57-f0eb-4be8-9579-cfc797605437", "value": 76520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567173, "uuid": "b422d20c-1ec3-4cd2-8e18-b379c79f8fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567173, "uuid": "45d79be4-6f62-4a70-84ba-6172f8034543", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db6d041-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512606, "uuid": "af627d6f-10ec-45fb-9221-b0f2fc0fb1ac", "comment": "Malware payload (WannaCry)", "value": "08857a433940296f4561a74708f9158a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512606, "uuid": "4883136d-176a-4450-8faa-f503e9f6b659", "comment": "Malware payload (WannaCry)", "value": "7a2bb7bc9812abab5851d3e8d8e7408170109ca3a0fe7a163ec5f952e17187a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512606, "uuid": "7fc72474-22e5-410b-97dd-98e1e4906f79", "comment": "Malware payload (WannaCry)", "value": "071153c905252b1d43c6cb1b9374e8117eac24be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512606, "uuid": "3f92efa0-ddb3-404b-ac10-f998a40957bf", "comment": "Malware payload (WannaCry)", "value": "68214fce9a61d71c01d9d538d2fd3e7b089992814553129aa92962651d0bc5ca1e2dae6cc12eacc4f94f606a4a7da1b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512606, "uuid": "d19fb85f-0af4-4a5d-8d86-1b8a241e23eb", "value": "T13A3633A4B26C91FCE1050D78489BC663A7F73CA65AFE650F9F9046370D53B2A7B60903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512606, "uuid": "a60e70d1-d457-4b76-9c62-0d5a33cd67d1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512606, "uuid": "23cd93a2-8c77-4ff8-b3e0-4e30764d1005", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9mbdWOC:TDqPe1Cxcxk3ZAEUacbd3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512606, "uuid": "23742c3b-04c9-4433-a09a-41ba9d8e329a", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512606, "uuid": "ca2ab36e-1148-450d-8df2-8bde2e4c5d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512606, "uuid": "e330a845-db7c-44a4-b9d6-d95a2c6bb453", "value": "7a2bb7bc9812abab5851d3e8d8e7408170109ca3a0fe7a163ec5f952e17187a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d8d3e2-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511656, "uuid": "cf4d368d-3d2d-49cf-ba61-57f065ca81ec", "comment": "Malware payload (WannaCry)", "value": "914266c9e51d777f9ace110e7672716e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511656, "uuid": "97ec96d0-c1de-440d-b727-1f2655f1411d", "comment": "Malware payload (WannaCry)", "value": "7b00afcfdc739f377a90681e34603d18f0aaf5b94735a45e9847451cbf392dff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511656, "uuid": "e7741a15-6e85-4a0a-8239-8271e3fceca9", "comment": "Malware payload (WannaCry)", "value": "e5ab17eb8775b8c6833b2ecd9bede34d0f10baf5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511656, "uuid": "cad593d9-d868-4644-b8da-9ce01302bc33", "comment": "Malware payload (WannaCry)", "value": "b9e5a96f2167f9a0ded035019ce87df7a034e4c0cf86a0cb3e980e74ba966f7446b2a3385719f9a76f0c66f697d1efa3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511656, "uuid": "1f4c2d20-e146-4a83-912b-ce250f4100d9", "value": "T11B363398613CA1FCF1450EB44463896BB7B33C697BBA5E1F9B8086660D03F5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511656, "uuid": "3d5cf5c7-8b0f-46a2-ba8f-7cbb21261100", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511656, "uuid": "5abf7a6d-249d-42d4-b14f-7282cf0e8e9b", "value": "98304:5hqPoBhz1aRxcSUDk36SAEdhvxWa9P5PR8yAVp2H:5hqPe1Cxcxk3ZAEUadVR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511656, "uuid": "897c9ade-4b49-4640-9453-b716c15c804e", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511656, "uuid": "ad156eaf-762f-40e5-9129-d04fb8c874c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511656, "uuid": "58d52e8b-bfa5-44bc-a5ea-ed5df136dd01", "value": "7b00afcfdc739f377a90681e34603d18f0aaf5b94735a45e9847451cbf392dff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4eb689-e9a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767553595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553595, "uuid": "b6457962-9df5-4bd2-b0a3-181188128e3c", "comment": "Malware payload (Stealc)", "value": "2df6951b9ef238bfb1c879e18221db30", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553595, "uuid": "6b4a10ab-11ce-4f66-9010-d5712e2610bb", "comment": "Malware payload (Stealc)", "value": "7b2620cf008268fa8eff18c136ca020fa948634e646f7301ab48a5dd936033fd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553595, "uuid": "f7f88183-5852-42ba-919d-0ada71776b62", "comment": "Malware payload (Stealc)", "value": "c019d8c7cb1760958f44c7e3dcdd5b040ddf517e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553595, "uuid": "75dcf788-32d5-4483-b3a2-08323e29481c", "comment": "Malware payload (Stealc)", "value": "b035465cb471e853e21c2dd106186bce2dddab0ef6139f0fb172c8d4530ff70caffd99c597ae2d52e236f90dd7635039", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XSS", "colour": "#CFEC52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553595, "uuid": "fc7fdced-4840-488f-ad67-ddc72aa8f9ca", "value": "T1D3759E55B2B400FCD167C178C9475A0BEBB278061770EADF57908A6A6F23FE11A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553595, "uuid": "c9f8e30a-3aeb-4cd1-ae5f-756dcb41d07b", "value": "14c00cd98c6c67089f15befbbc9b5dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553595, "uuid": "99c88456-a497-413a-b09c-62e327c003a9", "value": "24576:402+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSqlOqrXtd0RlgbCpS:+Q8FDjWJAfPVHCpheENnd75r03gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553595, "uuid": "c839d8f8-5024-42f5-8107-87a915ba4d35", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553595, "uuid": "33992678-9166-4047-b8c4-9b8e95b1c161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553595, "uuid": "026c0037-1ad3-4de8-b9ca-db90e6f5e09f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187bac77-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567170, "uuid": "2030225b-5b41-42a7-92d6-9ba1c061d7c5", "comment": "Malware payload (Mirai)", "value": "a13a783a4cf65973730a3818c07e1f98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567170, "uuid": "6bb0d74b-5a86-4510-ac84-c2192a31e65d", "comment": "Malware payload (Mirai)", "value": "7b4cd6f806b64a6023c19812cc733869df8ecfd69359004fb39f2e7058047c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567170, "uuid": "ca392b12-a9ae-4fb7-8fe7-817c04f5f4fc", "comment": "Malware payload (Mirai)", "value": "1ed528a1f681a603ea118dc5fea1a78e310b5c12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567170, "uuid": "c735f156-0d0a-4691-86b0-91f19ca95dd2", "comment": "Malware payload (Mirai)", "value": "4e32a80bd3d0574351aec5e886a66d82dac3c6ac9204336a51254f5b9b9f66ddbeaf67a53120d1f1aec26aab32b52fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567170, "uuid": "d3df5722-81e5-4156-bf51-c699e1f14813", "value": "T167234BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567170, "uuid": "9ae6894a-6754-41c9-985f-8f92857a0eea", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZjoZFEwaK3g+ZdG:c8/MjSNW4GBz3ELFdNYe6ZRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567170, "uuid": "8adda49f-823e-41e1-813f-7d7a9413da6c", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567170, "uuid": "4edd43d6-d48f-4381-a728-69528ff9d027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567170, "uuid": "9777727b-434e-42ae-bf69-ac3ec6c6d850", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38897729-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513107, "uuid": "83aa107e-9f79-493d-9b54-cce04463c7e8", "comment": "Malware payload (WannaCry)", "value": "c780695e67460a79b2f51ff3fe1e2b63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513107, "uuid": "95fb48f3-55e1-4438-a3cb-4955d780aa5b", "comment": "Malware payload (WannaCry)", "value": "7b83e2b619cf6fcc242e066415bf3631c4aa87144e0d595f118f1ee97c156a6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513107, "uuid": "7c5c6c9b-69e7-43da-a0e9-f15fb57aa05c", "comment": "Malware payload (WannaCry)", "value": "3e6971f31861aa47feba4fdc83a47b2b7a312385", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513107, "uuid": "732b8c1b-8632-4bb7-b883-b38713235fe5", "comment": "Malware payload (WannaCry)", "value": "baeabb75c81f8c3efcd9d86f974937838c18c249f6fbfd0d0a512786e7690102b62da6c90a1787ec29bf46908a017aed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513107, "uuid": "4e4cbc77-9557-4046-abf3-ac2399c84fcd", "value": "T146363394612CB2BDE0401DF4C463892AB7B37CE566BA4B1F97C0756E0C73B67ABD0942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513107, "uuid": "ee3ffb77-1bc5-42fa-a9b7-8fa47d7244e9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513107, "uuid": "824b2ad8-4c93-44ed-858e-5e333b862ac9", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVpNZH:TDqPe1Cxcxk3ZAEUadzR8ycPZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513107, "uuid": "6a388911-b0e9-4f1e-9e7d-92b0b72fcbf9", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513107, "uuid": "d3b68864-2035-4920-8392-89d244c8504f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513107, "uuid": "a1e2d70a-5843-48ed-bf25-0dcc597910d8", "value": "7b83e2b619cf6fcc242e066415bf3631c4aa87144e0d595f118f1ee97c156a6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746d7dee-e935-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767507624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "23a00341-8db3-4966-9af3-ff8efbf32019", "comment": "Malware payload (Mirai)", "value": "aa815409644f5fe353c8442b754d018e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "e8de9ed5-21c4-464d-b7e4-9effe796cb1f", "comment": "Malware payload (Mirai)", "value": "7c8bc6bc95064b806330a42d00b75c451c37a3627a1bcd66d40de239fa38f926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "f5fbfd4d-a713-491c-995f-b6e1da9faccb", "comment": "Malware payload (Mirai)", "value": "af00e729bf0f7cb812a4029dc6c1d022d816182d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "6e911bdc-cf1d-4312-94fb-821bc78057c4", "comment": "Malware payload (Mirai)", "value": "8c23c908999c2a757dcc16590a45bd2adeb439ba59b33762d8d9b93ef7ef83459145904191399721db03d3618b1e3d71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507624, "uuid": "e4356ac0-faef-4e55-ad19-e9b68a561e01", "value": "T176630298C710D9CBCEDB6DF80E587BF1A2326E08E67215D27678C38027E6E0A415EDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507624, "uuid": "6ba3bdc0-310a-4b74-9520-026c604b63b5", "value": "1536:VjT9TY4ATMQiJ9LEf2q33MSwnI/FPZ7TKMMkqsLfZCklMa4u+qgw09Q:HY4bLPLEf933Dt/RZ7TNZea4u+qgwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507624, "uuid": "72397e07-22b5-4643-9adc-963ec0d59e2f", "value": 67684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507624, "uuid": "6acce585-07f0-490e-9655-5a4cb1c685f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507624, "uuid": "085b00a7-1277-4800-bf92-aabd075fe57a", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d92040-e9ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767564808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564808, "uuid": "7cb55011-56cc-4734-b7dd-ad3c15d4e61c", "comment": "Malware payload (Mirai)", "value": "d92dc0245792addfffa9baa535cf5f07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564808, "uuid": "22a552c6-dd9e-4f8f-bffa-36134b28e748", "comment": "Malware payload (Mirai)", "value": "7ccda16154dbc83b22f48b0e19f7e9f8df3de4f633c9987d5e5fbc993e6ada96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564808, "uuid": "6245612e-11f0-470a-90b1-3d63d770df08", "comment": "Malware payload (Mirai)", "value": "44a2dd13f9c6009b730bc776a50acbf4aa27181e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564808, "uuid": "afceaaba-9116-47be-a088-3c6aeefdf3d0", "comment": "Malware payload (Mirai)", "value": "5cebc6cdd8c83cfad388665d33911142243270bfe3ec07ca8e724d52d21bfe43891372240575dd8cf95f1fe989690056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564808, "uuid": "2c75ab60-4a01-408f-b850-ef16242c3ce6", "value": "T1CF530A45BC81D616C6D462BBFA1E42CC332663E8E1DE7207DD21AF157B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564808, "uuid": "d2dd1845-7476-486e-8548-cffea3bbc4ea", "value": "1536:/BTC0SHyzJhIC+zmdZlVhu9eoMi4Gu+7R:/BTC0TdPrnitu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767564808, "uuid": "e10ab4e8-2e46-4c25-9233-082712fccd21", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767564808, "uuid": "30a0b137-e7a3-424d-bf11-97e552aec82c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564808, "uuid": "5c9df80e-ca1e-428c-b59b-865d897736c8", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba3dfa4-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509435, "uuid": "2edfc639-64a9-456e-9908-5f004df31b91", "comment": "Malware payload (CoinMiner)", "value": "60a893d8972581ab740bb962ed65d82a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509435, "uuid": "1bb16e91-6283-44a1-b268-370ac1f4f0a5", "comment": "Malware payload (CoinMiner)", "value": "7cd1dd1fe034a90aef69389bea943e522ccc052dc1a2556393a7cc2f038dfeb1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509435, "uuid": "2b013d3b-3299-4ca0-ab41-39908e8174bc", "comment": "Malware payload (CoinMiner)", "value": "9e2e070c77a7f7e8215dbdb887e5e16e1e698bf9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509435, "uuid": "ff956864-8776-4618-8926-a6e5908c8780", "comment": "Malware payload (CoinMiner)", "value": "dfb413662946d94507b89384e2ace42e53f6a7638b1b544036ebec6c5aa3f43a3bddb2d7b43803f0bc8d4c6bd1c5cde4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509435, "uuid": "f6e36c44-d4eb-473d-a053-db4496edd400", "value": "T112F5336101CBFCFF5981D46484ECBF320E6A51F19A6C9665FE69041ABC25EE3007B72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509435, "uuid": "4b11f846-a822-4c6d-8e80-bee4b2707212", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vH43vwX:G3LG658+S8YrCpHy2dUu4KrCf43vwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509435, "uuid": "efb6c0e0-240f-4cd8-ab13-76e7d483dc62", "value": 3518464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509435, "uuid": "f187a7f4-6026-4f48-87a0-5a77d0b002d0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509435, "uuid": "25d3ad84-f8dd-4c39-b1e9-c8e5023fadc6", "value": "7cd1dd1fe034a90aef69389bea943e522ccc052dc1a2556393a7cc2f038dfeb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e33709-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511512, "uuid": "1556ff8f-4365-46c5-8ac6-3ab1ceb212ec", "comment": "Malware payload (WannaCry)", "value": "831e8a827985b4e3eb991495cbedb297", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511512, "uuid": "bb3206a1-3ee1-4b70-98f0-623007a49205", "comment": "Malware payload (WannaCry)", "value": "7e1df58e6f7f3f3fd062815a0a4e77e96f9d537846a81d7a29e6e5481fc3b13e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511512, "uuid": "6143a671-dcf0-4f02-80df-7e5762b00f4f", "comment": "Malware payload (WannaCry)", "value": "634ff381e971e3a6793f08eea39cfdeedee9b3de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511512, "uuid": "f4a98403-23dd-4e6e-a96b-403bb3a00ca8", "comment": "Malware payload (WannaCry)", "value": "02afe3f7636e58416d859933ccc469c83709e8531eaf55e5410c8e0c81327fb614600368bc34c6811797719cac73c514", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511512, "uuid": "337a0629-af75-4947-be24-03aa80024671", "value": "T1493612067245C1A4D0180A39CC67CAFD66A3BC95FE6D910B7ED17F0F7D73A86AA41B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511512, "uuid": "fb5ff8f0-f0b2-455a-bcd0-94a2b0b6a5c5", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511512, "uuid": "473d2934-94e8-47bb-89f8-0176c7daaf6e", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P5wk2H:d8qPe1Cxcxk3ZAEUadKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511512, "uuid": "c309aa36-cbb4-47b6-8633-50209dbce99c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511512, "uuid": "80c3621c-4bc9-4213-86af-e017574cffcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511512, "uuid": "8b2c94cb-0a48-4a78-8c4c-218708d4bfde", "value": "7e1df58e6f7f3f3fd062815a0a4e77e96f9d537846a81d7a29e6e5481fc3b13e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcabea7-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513119, "uuid": "9cf3c7d0-ba66-45f3-8391-b6f001b2eaaf", "comment": "Malware payload (WannaCry)", "value": "38dfaea8b45c03991326549863c323c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513119, "uuid": "38201c16-dc20-4e35-94b5-bd17c2d35127", "comment": "Malware payload (WannaCry)", "value": "7e23bc917a20d06704a1647965dc8d9e57c71915486615a9a28cb321727b9a10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513119, "uuid": "5d09d299-14ee-495c-9830-cd49dde4ad9a", "comment": "Malware payload (WannaCry)", "value": "3e7a8c8716e83e555b9060d983d89c479cc7994b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513119, "uuid": "c12a3abb-b83c-49da-8743-661944044b2a", "comment": "Malware payload (WannaCry)", "value": "3b7b832d3ff1143fdb6def35d2c068ef095d0337c177ca8b1fe43095f83bcec71f849fa483d2bd822bcfac795bab18bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513119, "uuid": "f38f0f7b-3be6-4413-a60c-917073922c8e", "value": "T192363364B72CD1FCE10A057444638539A6777CA656BE870FCBA4CA220D13B65FBB4F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513119, "uuid": "15b335c1-c0b3-4764-bf44-6b31dc8b2b43", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513119, "uuid": "b50f3494-8d46-456e-9e26-d56ed760038c", "value": "49152:rnjQqMSPbcBVz6SAARdhnvxJM0H9PAME:78qPoBp6SAEdhvxWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513119, "uuid": "5bc249f3-b9a2-41a4-8eb5-b68cfe9ed734", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513119, "uuid": "d1eec683-287c-48e8-b3b8-e9d24fc83b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513119, "uuid": "7501cc88-8e29-4ebd-8fca-22b095644c16", "value": "7e23bc917a20d06704a1647965dc8d9e57c71915486615a9a28cb321727b9a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f968e8ce-e97e-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1767539200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539200, "uuid": "0544850b-2623-42f3-b827-17a85ffef027", "comment": "Malware payload (GenesisStealer)", "value": "79b0e3a3e726c6fc1106f98d16903584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539200, "uuid": "d8a5735a-74c4-4edf-aca7-978828024b30", "comment": "Malware payload (GenesisStealer)", "value": "802f9297ee90fab24e1ab18bf74787a03b3e6ddf681677feb066383038a4f188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539200, "uuid": "7202860c-cc7d-46b2-a70c-b37e8d322a0d", "comment": "Malware payload (GenesisStealer)", "value": "4c8c6ce4fe5700f3aa2869ee97d7a7ce525cbc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539200, "uuid": "72873897-ca17-4cc0-bcc3-61d26cbf6e1d", "comment": "Malware payload (GenesisStealer)", "value": "519c77cabb506f54544baf2225c45a70604e99791ec931646933013774bb563094a1ebf900cc6175688d7f1f827db901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539200, "uuid": "3b0603dd-2859-4f7a-bc46-8e51839c679c", "value": "T1C71833307FC7B91AC46D723D9EBA13640CDA644748A0B7EF14ABCD5EADBC9246324067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539200, "uuid": "f64f3bfe-46c3-498c-a198-d44cdddfc003", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539200, "uuid": "cf0a1c3b-40a0-4487-8d50-58f443d3bbf4", "value": "1572864:VH+BWMFDe45kXuKuH3X6hDRVOlAcdT2LR7BHITe7o9z8bx/SSb9Nb9d7rB:VeBFle45BNHahDRVuAET2LRV7o9U6Sb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767539200, "uuid": "4f0869cb-5204-4e61-931a-88041d8a4c9c", "value": 88479126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767539200, "uuid": "ffb18b46-05ff-4ea6-8e37-61d0e6d76050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539200, "uuid": "63b9aa3d-cd76-49af-b3a6-06c8436350bf", "value": "PinkCraft Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30787bd9-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519965, "uuid": "ab16b676-d473-42f7-be1a-039074af843a", "comment": "Malware payload (Mirai)", "value": "74093d43541f8b64cb7dd373dc16bed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519965, "uuid": "a8319412-90c4-4c5a-90f5-4625d77bc881", "comment": "Malware payload (Mirai)", "value": "804e20d744e3386d694159696ad16a9a1809449e4651d5f0871ebc1bf9be3761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519965, "uuid": "41925877-5bd7-4052-b516-611200707ba9", "comment": "Malware payload (Mirai)", "value": "f170fa1c6c91cdb16ecba5cb31328ef183dd207c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519965, "uuid": "3001f8f3-ed76-4e1c-9028-48cc4289d2a7", "comment": "Malware payload (Mirai)", "value": "a6b792af7d2ee10289d2431b03e80e7bcc8f0206a73f003d11e148299ab15234aa604ec5faea3467ca0e68ea22554a30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519965, "uuid": "48e326e8-1963-4d3b-8c3a-126f7c0eeedc", "value": "T1F0931986BC419E21C5C51377FE2F108E3312A7A8E1DE73228D145FA4778AC6F0E6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519965, "uuid": "8bb8920f-2b8d-4fdb-9558-444ed1705006", "value": "1536:dsFnUQxgKMqPJrSg3nndOKum0Snkld+U31MxXa/tB/0auybOBbzhIwiN/jg1XH:dDQWUrvXn4KXZAd+21Mxq/tFwyd/jg1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519965, "uuid": "0035499c-b8b9-4872-adf8-9bfbdce94349", "value": 91448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519965, "uuid": "48a1418d-576a-43e0-902d-f2fd4366f2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519965, "uuid": "19592d1d-e01b-4a19-97e6-d2e165b742ca", "value": "Fantazy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6bd9ca-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512843, "uuid": "c368c53a-a786-47df-885d-8860c574a9f4", "comment": "Malware payload (WannaCry)", "value": "b5a289e26a38745aa0df305a30c46f35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512843, "uuid": "df0e4443-0940-406c-8306-cfb7836ff3e1", "comment": "Malware payload (WannaCry)", "value": "80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512843, "uuid": "8cce178d-806b-41f0-a1e4-efd5182ec693", "comment": "Malware payload (WannaCry)", "value": "a288d2b7429659220f33b6ba63febe4eef5a0a81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512843, "uuid": "acfcf89f-23ee-46e9-8084-21f121617511", "comment": "Malware payload (WannaCry)", "value": "dc84b762419faf23f50decd9474cb70d0e0bf8f12fa75dcb83a742eadcedaf713a58bb6fe3d3cc61df9dbe8eed6ec6d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512843, "uuid": "85f6dc37-1b01-4984-97a4-92f2aa734083", "value": "T11136BF01D1E41A60D5F24AF72AB9DB10933ABE46995B9A6E1222410F0C73F1DDDE6F3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512843, "uuid": "39fa08bf-52eb-4edf-99f3-f3a6fceaf082", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512843, "uuid": "1b09fa2e-d511-4a73-b94b-63acf8b188ec", "value": "49152:TnjQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:z8RoBhz1aRxcSUDk36SAEdhvxWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512843, "uuid": "b9f147bf-dd2a-45f3-9edf-ddf922283e6d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512843, "uuid": "ac1853e6-88c9-45b6-b5eb-eca355bdefb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512843, "uuid": "c3f8c0e0-d4c6-4f4d-89e0-93f1d0fabd59", "value": "80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbc3d26-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519961, "uuid": "6241c85e-e802-4e76-b5a3-ed26129bdf3c", "comment": "Malware payload (Mirai)", "value": "3960fe1366f9bbefab396c92013b68c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519961, "uuid": "035ba0b6-0b6c-4ac5-933a-4714032aaf51", "comment": "Malware payload (Mirai)", "value": "80d861f704833e98ec956d78c29f5a7a34806b0460552f426444e4c6fbf61c07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519961, "uuid": "07d22870-3861-4447-ae37-115398d8517d", "comment": "Malware payload (Mirai)", "value": "f34e0d920080af765f09575469f6f12a95384d9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519961, "uuid": "9fea3f93-5516-4eb4-a22c-532091f5eb9e", "comment": "Malware payload (Mirai)", "value": "691d1837adb6ba46004d32d98faf56233f318ab67d1cf3a80a5eae209c4a894274182cb9f51890da95dc83e267f60097", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519961, "uuid": "a7375d10-d8b9-426b-8f44-d4c44b59e8e7", "value": "T107730682FC40AA26C7C01677FE6F108E3315A7D8E1DA32029D256FA47B8ED2B0D67755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519961, "uuid": "7297d625-41ef-4cfb-8cf1-15c3cb7cea43", "value": "768:whJyZUNILL0Fy2cz9SOIuJca/TtXk679zpX4I4BYA7u0hkermbANacd8UYyCQZyD:qJwKGLKn8SOZXkMVrKY3fU2/J7fBGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519961, "uuid": "632c9676-3e11-4fc1-8299-160485e8be7b", "value": 80348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519961, "uuid": "f035799b-98e7-45ce-97d9-2f6d92b84dbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519961, "uuid": "85d4b1a7-50b3-474b-9a18-1f382b91d74e", "value": "Fantazy.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb49f6f-e97a-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1767537250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537250, "uuid": "c68c6d4c-c6ee-44ab-acff-5d2d3ab1f917", "comment": "Malware payload (SpyNote)", "value": "1e71680219b4082efe21796f04b4755c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537250, "uuid": "8f4e1824-38cc-4705-b7c9-e2ea0c2a6290", "comment": "Malware payload (SpyNote)", "value": "8127c09ea8b0e40aa49f9f1cbf52be0ed7323720792a528d4e12746b91f9766b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537250, "uuid": "603a6e4f-88b0-40a9-9537-1d96deb4d03a", "comment": "Malware payload (SpyNote)", "value": "5f8e24c5c624d9685cf3d378a88b6308bde53555", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767537250, "uuid": "8aeba188-d874-4bb3-bd6d-a415a1c800c5", "comment": "Malware payload (SpyNote)", "value": "c9fc0ec40885e8bb3537730d168576328ecec8c59bc491a3b170c9a444ef4ddb06b840acee1b986747bd39c9fb43ff78", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537250, "uuid": "788fbeab-29cd-4e3d-b923-2b48570103b8", "value": "T16F96F117FA44CBC3C06D93F57A530FA82E371F4881816ADB08543A9E2E762D24ED69DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537250, "uuid": "15fb1643-8d8f-4bdd-943a-3eda93b1daef", "value": "49152:d41pQ3bktkNMkvVklNyEBtO/WmsJBVumzbzdGGnQTODvUzYqp0cggNykO:d4vSesMkvGGErfBYmzbzBQTJ0tg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767537250, "uuid": "d5976fa7-94f5-4973-b88a-a0ff2ad3f0f0", "value": 8907440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767537250, "uuid": "64899582-9570-488e-a2ab-c785ac69f81d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767537250, "uuid": "2aa6bd87-35a2-433c-a6d4-5c15818ffc1e", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711a920a-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512343, "uuid": "b68cef4a-eedd-41ad-88f0-6820529f41c0", "comment": "Malware payload (WannaCry)", "value": "8d7094d83a003ead8727587948eae6e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512343, "uuid": "7cd45a8e-a8cb-4ccb-8390-b0e6e74f44a0", "comment": "Malware payload (WannaCry)", "value": "8159e1c8b3e45ea36950e85af225c2db00120546f59c3e0fb6cef49e452478cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512343, "uuid": "4d115753-db73-4067-93a4-36e6ce1ab184", "comment": "Malware payload (WannaCry)", "value": "cd1e6dd351219424a0bf45d873ca04404288fa3e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512343, "uuid": "257a42b2-390f-4954-9422-e97f7c318bc6", "comment": "Malware payload (WannaCry)", "value": "da4f1a004d9d28f60b1fdc58ffb5b704d27ddb11d1f705bc1910651f5f82b1a5c950a403cb89af2ba944b6efc4769321", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512343, "uuid": "45b8ab48-647a-4f96-a25e-46c0744807eb", "value": "T1CB36F1ECEEE440A4D234587289B2059522EA7D85A685BB0B4270FA1D2C393F0DFF75DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512343, "uuid": "fd41511c-b68c-4376-a791-e0ea79da35d9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512343, "uuid": "760ca65f-6bff-41e4-b136-d25780007f28", "value": "98304:MWCPoBhz1aRxcSUDk36SAEdh+3R8yAVp2H:MWCPe1Cxcxk3ZAEUR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512343, "uuid": "228f1eb5-e5a3-44e8-93b1-5df695e44c65", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512343, "uuid": "0fb2f56e-3f4b-4228-9a75-fe304f937a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512343, "uuid": "a5e6ae7b-a12b-425e-be64-22ef2d883cbe", "value": "8159e1c8b3e45ea36950e85af225c2db00120546f59c3e0fb6cef49e452478cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db95d379-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512951, "uuid": "e19ab36e-78ea-4057-bf90-30e943f5f879", "comment": "Malware payload (WannaCry)", "value": "cb9dd2299e923e7eee1b20847655de1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512951, "uuid": "afe9c436-02d1-4b0d-b452-17f618461a28", "comment": "Malware payload (WannaCry)", "value": "8267cab48eacfc8b7366646a4c37af86dade85591bfeef1fa4d59d2f7218e079", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512951, "uuid": "816477c9-bd34-4c8f-a429-be7521f32261", "comment": "Malware payload (WannaCry)", "value": "52db02a72807ec87a14dc8269900271f21d8c521", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512951, "uuid": "bbb2b10a-26f0-4f61-9175-fd7c14950435", "comment": "Malware payload (WannaCry)", "value": "871081b3f7ccbe884a7d3f9818c0bd6c6102a41022d1ac6e33631f127d1db1717200f7b91c5b2edd44f99bc84c40910d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512951, "uuid": "fd067e14-750c-4c07-8c80-47fd2b44ea8a", "value": "T1C5362908DFCEBFB9DD2B3B309356A63D5B15A13D496DCF9BD461D050A827E805A20F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512951, "uuid": "360eb9b9-0564-4904-a4d7-b8ab5e338548", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512951, "uuid": "15feef94-2e5d-4c2c-a6d9-9751403b0095", "value": "49152:SnAQR13/OcXiq+Ru96l9iBjSqVOUbAlS7HH1VD9:+DR13/OVJRvl9iBWuOpl2HVVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512951, "uuid": "18dbfb9b-d430-4520-a561-76ba2492ef02", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512951, "uuid": "7b9a6c0d-f105-45e8-82e6-639b5edad4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512951, "uuid": "8261368d-f528-4fe3-9b6a-60ab83e819f9", "value": "8267cab48eacfc8b7366646a4c37af86dade85591bfeef1fa4d59d2f7218e079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b783bc99-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512031, "uuid": "94cd877d-2ea4-4641-805b-0ef5ed21660e", "comment": "Malware payload (WannaCry)", "value": "8fa0e5dd92185799b73cbfab3da3e919", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512031, "uuid": "6bc8a8a3-0520-436c-919f-0cd470cba92f", "comment": "Malware payload (WannaCry)", "value": "82be7312055ea06867784fd3fa9483133f6ae2abb0a16903c701283646ac7eab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512031, "uuid": "f7289c68-7297-45d9-bc74-6039412906fb", "comment": "Malware payload (WannaCry)", "value": "f7ef4a029a5563e85c14ffdf74437cef17d50c5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512031, "uuid": "fb7a2534-b0f1-46c4-a1d6-5ffb7455ac98", "comment": "Malware payload (WannaCry)", "value": "0b8975a384c7b094f4f01fc00c6282e6562a23a240ab3c5327804c71adb54b4ca040a27915d78cf91f2676bcec699232", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512031, "uuid": "89646962-4e7c-48fe-93a2-c9d2fb6b4628", "value": "T10E36BF01D9E41B54D6B28BB6697B8710537A7E848D47960E0758B02A1C33F1CEEE2FED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512031, "uuid": "a32471c0-a970-4de3-999d-8e0c9ae38b65", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512031, "uuid": "de1b744a-0360-4261-a8a1-be4955fc18a1", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512031, "uuid": "efefcf32-12ed-4ca6-b1cf-b9b728c1a5cf", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512031, "uuid": "ee858791-80db-4459-a79d-dccf64a498b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512031, "uuid": "66315c76-5c5c-4193-9a87-2cefbb34e718", "value": "82be7312055ea06867784fd3fa9483133f6ae2abb0a16903c701283646ac7eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4016c965-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567236, "uuid": "42fc5531-3ea5-4162-b66d-7d92a1258042", "comment": "Malware payload (Mirai)", "value": "8c950b23edce0ee8067afff52befcf1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567236, "uuid": "864fd1d5-876b-49cf-bd31-b89bc2f2bb32", "comment": "Malware payload (Mirai)", "value": "8329c4657e816beeb1b0d1eb3b0083e690b6ca07c9d839d79c60ab0b706c3366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567236, "uuid": "8afb45d5-2fd1-4a96-af9a-6ffb59782eee", "comment": "Malware payload (Mirai)", "value": "809b21d1805bbbf766f4a434a1cebe3697a0100f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567236, "uuid": "e6b1b3db-2f42-45f9-b75c-ac23c7430b74", "comment": "Malware payload (Mirai)", "value": "eea7923690e16290f9e700bb1a49edb9762f13ff6f2832612d392a4f457154476e81e1619ef8b3556d3bd00cb41f12db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567236, "uuid": "803c73ba-ba51-4f9a-843f-d1e13d4c0328", "value": "T1DE73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567236, "uuid": "01f8bc0a-e347-4019-9f28-6f50fe5a5e9a", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStP:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567236, "uuid": "bbab2d1e-c871-41d7-861e-734a9f25d6de", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567236, "uuid": "ba2a7847-ff9b-4863-8041-f7a2b0663e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567236, "uuid": "062bdbff-fcd0-4725-8c0d-620fd4d86a4c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc35a2f-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567259, "uuid": "5b0d7727-af6e-4b8f-aebe-7759983f1711", "comment": "Malware payload (Mirai)", "value": "da36d08ea0a983e2d8ffb2e7c7ff7e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567259, "uuid": "809b872c-7415-49f3-acd5-3748e86142c4", "comment": "Malware payload (Mirai)", "value": "8382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567259, "uuid": "76232f75-c42f-42c3-b8ab-65b97952ee32", "comment": "Malware payload (Mirai)", "value": "cd7301af7f0b9d2574d8bce98d37243d47dcaca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567259, "uuid": "f1485f75-eec2-409e-a3af-92e6496d5782", "comment": "Malware payload (Mirai)", "value": "a90188576d8c8d04e4d9ece5269659d92798b985cbe6cf283f7cb82ee5a0ae0d7847a2a6c8bc5cd7f20851fd12b94d03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567259, "uuid": "8bf92c4c-95fe-4393-ac58-b7cddd473f49", "value": "T1D5331895B8819A16C2D453BBFB2E41CC372663B8E2DF3207DD216F14778A82F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567259, "uuid": "4904f9bf-ec19-4877-af3f-f841cf261226", "value": "768:IV+SWC+1bjRe/v7bWEEAb9W012S7Caluo9I8xTcSP1t5m/NPYBN5eazB:pSH++bWENc01mal/dxTca1t5mGBHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567259, "uuid": "823632a7-615b-4a07-b2a2-b03dc9dd4699", "value": 52964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567259, "uuid": "9ac1173d-99ea-43a1-bae9-22aac0aa3814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567259, "uuid": "3c8f6dc6-d80e-465a-82c3-5c2cf19b25dc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c48bd80-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555741, "uuid": "075f2e4e-f314-4f90-bf1f-d67bd370baf4", "comment": "Malware payload (Mirai)", "value": "a578d94f97a36091c0e576b62cab0037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555741, "uuid": "960601b7-9c67-454e-b7c0-2807ca11c7a3", "comment": "Malware payload (Mirai)", "value": "83f334b3f20c9cff8aee7dc373ed8ff5c73f3805b4e631bbf8493edc4ade08c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555741, "uuid": "c513d82a-c921-4334-a484-f1e0d26cbb25", "comment": "Malware payload (Mirai)", "value": "b47f1110de7693493133975007e639348024e10c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555741, "uuid": "390056d8-d94f-4afb-a91c-0b43e943284d", "comment": "Malware payload (Mirai)", "value": "644eae7d3ac739c83bb523d4ca8bf4fd09a6953ba19850f0a72aa5e3466fdc617964b9ef20918a6d3eb633b4b31a3f1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555741, "uuid": "d3549bad-a599-4fd8-94dc-d17b3a584baa", "value": "T13E24085DE4508B3AC7D1267AFB95028D33334F68EBEA730589356B343BD66299D3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555741, "uuid": "2052bf36-4029-436c-9d2a-b06c6bd6e5f0", "value": "3072:L4ez+8mg8fgUa8fwp9+QoLS8tmu9BaoJphmbOiXKS+jWdzWI:L4edmt31fo9+Qo28tmsmbOS+jWdzWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555741, "uuid": "20237222-04e9-4601-847a-0795a589815c", "value": 227304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555741, "uuid": "32591935-1408-4c2a-96af-e4e6c5de21e7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555741, "uuid": "6001afa0-2e9b-4603-965e-4439afa2583d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f14aba-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767512059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512059, "uuid": "8764f0b8-6630-434e-9b9e-88626a919e6a", "comment": "Malware payload (Mirai)", "value": "2c86f45de0335c6a2650dca9999f8d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512059, "uuid": "04b481d1-1b8e-4ab3-a1f4-edd93b715b09", "comment": "Malware payload (Mirai)", "value": "84370ddef0af2efe60bfc623367f3dd925f671793133c0fcfedf62ef07016c01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512059, "uuid": "65b86329-8290-441f-b7b4-8ca67044d39e", "comment": "Malware payload (Mirai)", "value": "c0ebd0ece2c78d95a6e663341cec22ccb66f330d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512059, "uuid": "81d2c118-1e71-4708-a279-ee74fdd062c9", "comment": "Malware payload (Mirai)", "value": "59cbf0acf32e70bca03b8252c33f580ec5972feae922808662df17b0b08d604a95ea4656f660336a9163e00d6b21d571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512059, "uuid": "04031f62-86f4-4a1f-972d-8be35b4cf3a5", "value": "T1D1F46C1BA2B374BCD557D03443EBCAA3A935B43902216E7B51C8DA303E1BE60175EB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512059, "uuid": "b8f7c8a2-a2fb-4fa9-ba9d-ce702228613e", "value": "12288:PBZnfeFMlVD4s85D/PkkV1s67qAtvcpv1rZXMCKwXwkstgKEdzuF3TmJywYrhA7:DnGS94skkkV1scfEpdrZehkst4G9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512059, "uuid": "a6436210-4471-4d9a-ac9f-fd72c6b8b8be", "value": 784966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512059, "uuid": "97f1515e-5d95-4ac4-ac08-c528f5213a7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512059, "uuid": "ca14781c-07d4-4bc5-a6ab-54c73f35c115", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2949d36c-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509216, "uuid": "bdd86421-6bfb-43b2-b967-42c550b34833", "comment": "Malware payload (CoinMiner)", "value": "c49ecce34ec4ffa6129cac126c47b02c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509216, "uuid": "8ffc1285-a13d-433b-98e6-ab693279a8ea", "comment": "Malware payload (CoinMiner)", "value": "843f0198c34714916270cdc31d71cef8b58dc377ebd8d5cc98e82b649623a35d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509216, "uuid": "f296acc2-2550-4642-b9bc-d4cc4ec2f889", "comment": "Malware payload (CoinMiner)", "value": "0c298b5df6239da08b9d2ec744766c6b4ae4aedc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509216, "uuid": "24066f7a-a9ae-4539-b0dd-da1b8b520fc0", "comment": "Malware payload (CoinMiner)", "value": "a65dc549db4401efaf089e800e4237e0fb4af68c524ddf9e40bad63ea9401f4119bd0f0d58dc94c88b7c3126b2694e56", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509216, "uuid": "80087b23-a1a1-4408-9390-8792d347d00d", "value": "T13906336202CBFCFF5981D47858FCBB320E5651F19E6C9125F9290829BC26EE3407A727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509216, "uuid": "27cffa74-c1e9-40ce-8b46-3bb543ee56fb", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQ/:CC65sr3KrCfsYiZQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509216, "uuid": "51d5e48a-4dd9-4154-a8c3-1c4d8596de7d", "value": 3829760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509216, "uuid": "6f5399fc-d653-4e53-b347-6f0c965ad4c0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509216, "uuid": "e010f804-2abb-442e-8638-8374b1268ef6", "value": "843f0198c34714916270cdc31d71cef8b58dc377ebd8d5cc98e82b649623a35d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1469ea81-e992-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767547406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547406, "uuid": "125fb9a3-7c21-440a-8834-afb99cb0059b", "comment": "Malware payload", "value": "3d97d5b552ca2aea1f28a452d7f164e1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547406, "uuid": "4cea176c-64ac-4663-9a33-cf2cddd9b552", "comment": "Malware payload", "value": "855e9dd4d5b58fc42ce594a79d9b8a94173f6b71a1176df388f353900791f8a5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547406, "uuid": "651324e3-ac0b-46da-baaf-0f13099c6c04", "comment": "Malware payload", "value": "6ec358618f721f18f5e616f9daaa0886d87d08a7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547406, "uuid": "547f82ad-bda8-428d-adf3-dfa7d39f7303", "comment": "Malware payload", "value": "f2c5648f2e36efb247273715e7df7febc33a814c975af302cf01202c8a0476dc26f32cd3292690c081caaa6ad68f541b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547406, "uuid": "146cd43f-75e3-40df-9363-5c1e6f8eb296", "value": "T13AF39D0A63E421B6E4F657B499F202435A31BCB15B7892FF22C4D57E1E336C0A936B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547406, "uuid": "1cd935f5-9dc2-41bc-8c99-5068596ec46e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547406, "uuid": "b346be39-4706-4f1a-90a7-bad3d5b39ede", "value": "3072:zahKyd2n3125GWp1icKAArDZz4N9GhbkrNEk1MaB0FT:zahOWp0yN90QExaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767547406, "uuid": "38b34335-5a2f-4a85-a501-c362d4402a47", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767547406, "uuid": "deaa095d-7f47-462e-990b-e17422724a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547406, "uuid": "ca1faa89-d560-4533-8cbe-b86d03994079", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4424f55d-e98d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767545339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545339, "uuid": "8e48c231-b7c1-4a2c-9def-ac0fd7c81111", "comment": "Malware payload (AsyncRAT)", "value": "eafa8a7c070c4d5f7efcfe00a5644c02", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545339, "uuid": "b2bc7f2f-c89a-45d3-90e9-2d980c631e3c", "comment": "Malware payload (AsyncRAT)", "value": "857e010d97ee77f3f2829ac77e754a32993de7c325d5d40eb064dee62ff7c9e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545339, "uuid": "99e7cd32-32fe-4ca2-803c-14c293d735e1", "comment": "Malware payload (AsyncRAT)", "value": "c19e582334b6441f82895f37fb88f0a332e31f46", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545339, "uuid": "443d9fc4-cddb-4d16-a289-0f67274797d7", "comment": "Malware payload (AsyncRAT)", "value": "e024dd8d7a9f2a545361afaf3c60ba4dfcba7dd3939c6e32c965c19c41bc2a10ecf0e835c5ceeaea2e9cb2331a28c77a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545339, "uuid": "d0bfceae-d74a-4d27-abed-6ee0523b3186", "value": "T193232B003BE9812BF2BE4F78ADF25245867AB5633603D54E2CC4519B1613BC69643BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545339, "uuid": "dca6c6b3-6f9a-4e99-ba0f-8f051b8ecb6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545339, "uuid": "02faf8e8-70e2-469b-b016-43b6bec0a096", "value": "768:1uW01Towx/9WU9mp+Xmo2qzPCSwTMjPIuMjb3gX3i8h8zvKqFOBDZAZ:1uW01ToqEO2Wg1u8bQXSjZAdAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545339, "uuid": "de01c6fc-6abf-4df4-bea6-035c79b39265", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545339, "uuid": "8586db1d-d441-44f1-bae8-b81e84992675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545339, "uuid": "be27f72e-2ab0-4f84-971c-98899a98ab6f", "value": "Luck88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d2be2a-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509130, "uuid": "39351c36-14d2-46fa-b098-84b687b82541", "comment": "Malware payload (CoinMiner)", "value": "5b9b1f686e78101a75161a5f1165a3e2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509130, "uuid": "e19d4be7-090c-4df7-9e25-a3b8b2d1fd70", "comment": "Malware payload (CoinMiner)", "value": "85cf5637ddd7d74c747ffc9567dc5e7e1e8535800011e6ecb8873b9a01391bb4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509130, "uuid": "7a74a9f1-8b49-42f9-8456-fc50e84a3a3a", "comment": "Malware payload (CoinMiner)", "value": "f2f676878c754c370a4c2b7462b488cd17b78f8f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509130, "uuid": "c2ebb64c-bdf4-43cb-b80e-bbb42d8be821", "comment": "Malware payload (CoinMiner)", "value": "070fa30c42f3ec7fa833b1e42c9a61a7fec6a4f6cb919ef0f68b901ff8cffe456a3090c8500010fedc61ebc3918f40ef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509130, "uuid": "b66e51bf-a03a-4a8a-ab7d-a7b6eff57320", "value": "T12816336512C7FDFE6489D86898F8FB374E9560E29E7C4121F92908247C26DE7407B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509130, "uuid": "8897766b-a961-4f18-8ebf-5a7c2a502496", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgK:CC65sr3KrCfsYiZQgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509130, "uuid": "e2cf9081-4b40-47b2-a939-a62647b39176", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509130, "uuid": "885a8729-3d75-41af-a149-a3252e53d9e8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509130, "uuid": "da166bf0-f42e-42fb-89f5-9e351494c1a2", "value": "85cf5637ddd7d74c747ffc9567dc5e7e1e8535800011e6ecb8873b9a01391bb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f3323f-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567164, "uuid": "aa22ad39-fa73-4b99-8ee7-0f7c97d37779", "comment": "Malware payload (Mirai)", "value": "b1d12fbc35b161a378f2bc3193ebd79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567164, "uuid": "cb7b58c7-1166-4872-8b60-1237d0d25b84", "comment": "Malware payload (Mirai)", "value": "860a6e9b910ffba540f90b9bf492819b24fd104e62ce53b25dbe0b0428e68ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567164, "uuid": "fa05105b-40f8-43b4-9be3-9aa865698094", "comment": "Malware payload (Mirai)", "value": "3291363350ddc86121b84677934d626f3961c2b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567164, "uuid": "de090ae6-4ba1-497f-bf66-340ff4df5dae", "comment": "Malware payload (Mirai)", "value": "755afe3732ca7c3a348f5fc12f946030235bfe096f1651641ab1f824af1a34a788798977dcd81035aaabb6e0bf270e52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567164, "uuid": "8619cd7a-23b0-484f-bc4b-7bdbec7134da", "value": "T109230271890E9EF124303C76EBD9E393B6F12971C6673027D6290A382F75A131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567164, "uuid": "5f18da6c-02c1-40cc-ba53-74455a5f0354", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3/9q3UELbUXfi6nVMQHI4vcGpvn:DECFd+A6YHAxuLRQZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567164, "uuid": "5fd53c29-218a-4321-9b74-e9607fcebbeb", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567164, "uuid": "93291168-3ef1-453d-9d0d-da8bda449c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567164, "uuid": "425c9863-d89b-4733-8311-fcfa2759a0f8", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbf6a31-e99d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767552197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552197, "uuid": "f31e5c26-c915-4b56-9a82-9c3d38ea0966", "comment": "Malware payload (Mirai)", "value": "2ca5b52e4984a3893d1759f61cdcb580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552197, "uuid": "066384e1-0190-4027-8380-846e4186a7b4", "comment": "Malware payload (Mirai)", "value": "8640f5d044ddd18b9d43149cb46b2605038499b990a1ef31d27c01fe2ae07eb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552197, "uuid": "a0ce2385-8b78-4ed4-abae-23c5b501571e", "comment": "Malware payload (Mirai)", "value": "d753a739619927e4ed0ce833394a2be42f110646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552197, "uuid": "696648d9-9631-4d57-91c3-801274cb197e", "comment": "Malware payload (Mirai)", "value": "5653df614424139766f07e58fa2398e94a36f840232a84593a62d12d8904a76c02ab8fcc1c71b233279c1e357c21852b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552197, "uuid": "4ebc67e9-24c6-489a-bb75-894b0c7928d5", "value": "T19124085DE4908B3AC7C1257AFA55428E33734F24EFEA731989345B343BE66295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552197, "uuid": "91c7403e-bb9c-4e4d-bd90-4aa43ebda2c8", "value": "6144:DmOH8mqcmIQ8MdwMV5+Oe3HMCuuas6zE0:DcmqHQMVIzTgzE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552197, "uuid": "abcf629a-48fc-4b2b-a5fe-e00c14b529f0", "value": 213892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552197, "uuid": "5f96853e-afb9-4ee5-ab0d-25cccf5daa2b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552197, "uuid": "fd93c7bb-1b98-4224-8e75-f287234f33e6", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cbea6f-e965-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767528135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767528135, "uuid": "7c48dd18-4cc2-4239-868a-2e5c3c1fb0f6", "comment": "Malware payload", "value": "824195f2d5d6b4c388407531137475a2", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767528135, "uuid": "96038f04-081c-47be-8134-fba2f10d843a", "comment": "Malware payload", "value": "8788eb207bf21cffb42de45c9288cea520648193b7ea06088bd6b8569f0cafbf", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767528135, "uuid": "bf371a82-0ea1-4615-921b-3682328529f9", "comment": "Malware payload", "value": "1651702228de3ec695a5569e82b49afa2c0257e3", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767528135, "uuid": "9ed03390-cc38-452c-90b1-6213ffa86b84", "comment": "Malware payload", "value": "68645aa46dc2f9d80afd6beffd53b8b52719ad1231ab37291ef95e5fe4341608d7a058422ec0d7a07bda036ceb8d4512", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767528135, "uuid": "268cda57-b560-4358-8e2d-1abeca698595", "value": "T1AA65224267F8C962F9F61F7458FA9EC31A2AFCA11C24C34F9A61515EA932640ED30377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767528135, "uuid": "72912c6d-0caf-4f5f-8812-914d61cb780e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767528135, "uuid": "dd71e4c8-7b69-479a-99a4-ee48ef01091f", "value": "24576:8iZfkvmrIKx1rUHZXJ9FePZhlPSk6yqCLbpaQj1LcGKUrfcewt:+olAHrWRUmagJKSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767528135, "uuid": "687e7802-9db7-433c-b68c-9b66bce77b5e", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767528135, "uuid": "e6f268f3-ce20-41c9-8442-690278bede88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767528135, "uuid": "6e591b03-d9cd-4df0-982b-6640740fac43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1281e5-e90e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767490804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490804, "uuid": "a8cf6065-45a0-48c0-b960-410a95384757", "comment": "Malware payload (Mirai)", "value": "084532aa5ce8a4334b735d177328fa0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490804, "uuid": "2c62f788-54d5-4740-8240-369a41ab7aa8", "comment": "Malware payload (Mirai)", "value": "87b5360fc1a9b326ab7cdece074614eb30e23bd0ff7b179cb121e29aac0edb31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490804, "uuid": "2b7e7be6-a7fc-4bbe-8752-f7badbe88da2", "comment": "Malware payload (Mirai)", "value": "ba8f9211b42b291de2faac8c69a628c2f96f6d82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767490804, "uuid": "523dec51-b346-4b26-a78e-7164dc6b4887", "comment": "Malware payload (Mirai)", "value": "0ac58f7ad0b6db002cc40a50f105b9009f33a8955beec5c6c8aa4d853b66252f3c38c8358cbe5c640f115eb9aab4156f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767490804, "uuid": "5a5f4cda-731a-4894-8e65-cccd5ea44be3", "value": "T193C3AE61C8AD5BC9E22985B070F9EE3A4B73D18455872EBF2EDAC61D1083ED4F1163B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767490804, "uuid": "4a8012a3-f0cf-4605-b149-6bcc2848aebe", "value": "1536:P1Q/rFbdl6ymHmQCv9p6M2ppS+qQK02vZ+P7JP5QuGHCP8DIxdyacr:STFGyPvv9pn+1q30E8P7QuGHtD2zcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767490804, "uuid": "eb1a28ad-b69a-459f-85ca-46a658c53338", "value": 118704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767490804, "uuid": "7e3c9f72-cdee-46fb-ae60-cf9f484ee0c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767490804, "uuid": "8b5d3fca-a616-4c91-8670-dce2a2ab2ea9", "value": "rondo.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf483c64-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509494, "uuid": "3f067e05-c53e-4368-a530-4e682af2e65e", "comment": "Malware payload (CoinMiner)", "value": "a05a83f0c6d13286a2c4ff7cc6f0468c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509494, "uuid": "17cf6105-7f15-4cad-83f5-e3ada5aa12d3", "comment": "Malware payload (CoinMiner)", "value": "87c1bcd53ca2711b78dbf1029d153a2939bf5c929b8c08ffb6f8b2014196add8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509494, "uuid": "0a3622c9-43af-4a58-b57f-47cc97bda09a", "comment": "Malware payload (CoinMiner)", "value": "38c47c41d67f4553150bfa48dc3a9fefc1ec34f3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509494, "uuid": "65ed3f21-ab60-4ef2-8971-76aa4aeeb78d", "comment": "Malware payload (CoinMiner)", "value": "6e008425c1ad9aa6455975a712d8b4b5856dc619ea4071855f4d57502113d209bc6e0bfafd8a970d014733ffeba4f7dc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509494, "uuid": "138c4125-9584-4486-8826-f670e32e9f6e", "value": "T136E5335100C3FDBE95C9D9D418FCBF320E6B11F0A7685622FE760425BC26EE641AB61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509494, "uuid": "17c16c1d-d8b2-470b-8f39-b4b524d91299", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9h:G3LG658+S8YrCpHy2dUu4Krh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509494, "uuid": "41303cf4-a7fe-4801-9d31-35fc1258dafd", "value": 3121152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509494, "uuid": "170fb73f-0dda-4e89-9890-484883d3db27", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509494, "uuid": "46730784-f688-4ed0-9aa9-b24a71c1b6ce", "value": "87c1bcd53ca2711b78dbf1029d153a2939bf5c929b8c08ffb6f8b2014196add8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e31c2c1-e972-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1767533840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533840, "uuid": "5613ac35-c26c-487e-868a-5462de08e9d5", "comment": "Malware payload (GoProxy)", "value": "0e46195ce63d6fc33471bf3e3883863c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533840, "uuid": "239033e5-c786-4449-b71c-08dbdf841b5f", "comment": "Malware payload (GoProxy)", "value": "8828efa807d196dd3302a9b1bced089ed407ff13d5e28bfc2df9b884d57913ab", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533840, "uuid": "baa4226f-e691-4922-9b22-3e1a6b48c8a8", "comment": "Malware payload (GoProxy)", "value": "2d3d8f79a6b0972bb6b3056992f616db4d18fed0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533840, "uuid": "15514c07-aa36-4313-9b85-1bb7ea6e38b7", "comment": "Malware payload (GoProxy)", "value": "170c25472a56f75bed4167a0054bc32d7fa349f54e97da820b1dea19d36665b90f0caf0ad788134d1cec0d77cfc11b3a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533840, "uuid": "ae50507a-0fca-4a09-85ff-5ed56361b941", "value": "T1C5664A03ECA545E9C0BAE2358A669252BB717C481B3123D32F90F7386F76BD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533840, "uuid": "30de06a6-8f90-43fb-8376-630c91356cce", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533840, "uuid": "1e572e2f-070c-49c3-a561-a1964dd04ce5", "value": "49152:kB1Lv3iJjE/LSzoQxzWGQZFO+xHBMSmdHEuOE2ygBvPhwxm2PtrOj4/9eU/wfKiS:krxQxaxdkE7ZywBwdLkfb7DEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767533840, "uuid": "03244a7f-c534-4aa9-9521-c54e445d578a", "value": 6650736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767533840, "uuid": "f0697124-5459-49cd-851c-0641d0d0ac29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533840, "uuid": "38de16bb-143c-4430-a27f-042617bb9a0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9015ad11-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767508959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508959, "uuid": "bd7ddb0f-16a6-4bda-93c8-abd37b2918a6", "comment": "Malware payload (CoinMiner)", "value": "f1a180a45ea589bda898b475553dd10f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508959, "uuid": "70cda6da-464a-4f2a-8092-39605870852d", "comment": "Malware payload (CoinMiner)", "value": "8860960d7edfc8ccebd00e72f4fbd5f5e328c4a1045bbe766c423a24bdafd158", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508959, "uuid": "8ed8fac8-514b-4ae2-9ba1-aa042cb0053a", "comment": "Malware payload (CoinMiner)", "value": "629ca9097d86641e11a6cfa1b990842229c54f73", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508959, "uuid": "06a2899d-48bb-48e7-a810-bb85fd188a25", "comment": "Malware payload (CoinMiner)", "value": "bad6595c556885ee0aef5105f575b5077c6a4b6ee6b482ee8bccd57a59be447a1c019a4070979ba650d83414df7a9c33", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508959, "uuid": "2f51868b-1048-46b4-aac7-00cab6c736a4", "value": "T1FA96333511CBFDBA7589C964ADF4E7314EA925E29D784005FC2908287CA1EE6407B73F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508959, "uuid": "cadfe6fa-afda-438b-b1b1-eff77bb4053d", "value": "196608:n5XZQpMDRbGePkqOISkM8xl5vu4rCfsYiZQgzJF:n5iAxOISUxumCfsXQkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508959, "uuid": "eeb94a0f-7136-4dd7-ad09-29f9efb65e48", "value": 8911446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508959, "uuid": "ba868e0c-01b7-4b47-8d92-81e695d9be81", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508959, "uuid": "534fafa7-0b61-42b1-9f28-602d8415acb9", "value": "7ffc919098512b16c4f15b8867b67830a8ab130aa3f6f39fef10f1e5a3e28210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368e3580-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555194, "uuid": "aebc42d2-9ec8-43ba-8b09-b262e7ad6ccf", "comment": "Malware payload (Mirai)", "value": "bcf6046da200f82f8bd10549f8399ea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555194, "uuid": "00e47de4-286b-47f2-a6c8-1638b21c408c", "comment": "Malware payload (Mirai)", "value": "886e0f4d1274f3072ef6fe0d8f7a995b461c3544135f17501695947eb6ad20a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555194, "uuid": "ea03de66-86cb-4017-b691-fa0cd798aab6", "comment": "Malware payload (Mirai)", "value": "8bba8095f021c1505b13c0459ac8c59f8648f521", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555194, "uuid": "1c826495-18c9-4ec5-9a3c-7055b772b8fc", "comment": "Malware payload (Mirai)", "value": "05aabf4e5683ec60da940bf4ec89381fa7de85ce5af5c98592ebdd9468d069a9de3ee52714544ef1030b8bee18d33e0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555194, "uuid": "bc808101-6e2d-4815-9681-4a700c05b068", "value": "T1DE240846BD918F13C5C122F6FBAE418D371A67A9D2EB3102DD216F60378A89B0E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555194, "uuid": "be4b5c3f-3cb2-4e7a-bb80-9f6fdfed57f9", "value": "6144:g/MFyy0JatHI+rybrjC8tVpu4Dn4MSbkPP8Vy:g/8yZYtHIE83/Bu4D4rbkX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555194, "uuid": "a2086f2b-b059-4d0e-8ad0-9e264984a30c", "value": 225056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555194, "uuid": "15861cca-61b1-4c9e-8505-d3e2dae6ff24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555194, "uuid": "b08d700a-09d5-48e3-944f-a00e887de00c", "value": ".5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4f7f8c-e9a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767554558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554558, "uuid": "45a87c54-84b9-48b6-8c4c-3975e6832e06", "comment": "Malware payload", "value": "d7dfe932bc5a9b7bb2de43c32445a9b0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554558, "uuid": "595e662a-3807-4db0-8624-95002cff18a2", "comment": "Malware payload", "value": "88b3579ba6526ef26b12052a6df48cd825419b646d0ddd44333f75c9faf00b13", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554558, "uuid": "aaad83a5-f8a1-4ce2-8d24-49956d6dca30", "comment": "Malware payload", "value": "3401d1c6aff3a64c6f241c20c6993ade9cdb3078", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554558, "uuid": "f35eff79-ebda-464c-aba1-4b47e54d4b8f", "comment": "Malware payload", "value": "1b67d8436695535cf6abd602364de361ea170b7b5d4c296d7d8a5dc3882a5991ee8edc7df5f5f575e16657782a9093df", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554558, "uuid": "79d80d68-c121-4d71-8c3e-682236035cb7", "value": "T130F2CE71C76C40803EBEACBA9FCD89515B4EE4FCBB8AD78EC02634745F6E2A71186051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554558, "uuid": "83433469-b437-406e-b047-31b096ee77bf", "value": "384:7rgpjFeTzKfdzyXZJF1wKMd22n4z4LloqJ4KBrSDPGZUyn5TqDN:7EGmfdzSHFKtY24UxogBrSQn5WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554558, "uuid": "3f8b3109-f617-458e-a8a7-fee838e63eea", "value": 37400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554558, "uuid": "13bd050e-6085-4701-90df-1be8e2a70e23", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554558, "uuid": "cb060e6f-acfa-437d-9ea4-5dce33c4e4b2", "value": "48_AUB_571.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d384f41-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509706, "uuid": "6a8a720e-2780-43b9-b175-0b4e41548a36", "comment": "Malware payload (CoinMiner)", "value": "8a73f54c177249761b4a8c8bddadea0b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509706, "uuid": "fb726b98-e9c9-4fc5-816c-c81b47aab62c", "comment": "Malware payload (CoinMiner)", "value": "88f731f71c1d9bfc1f23c71810aec54fd354177cc07f35c0bdc254687e82073a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509706, "uuid": "c0401024-f5d1-4e7a-993e-c754472c8421", "comment": "Malware payload (CoinMiner)", "value": "be10e1430ec4ea4ede953543cf00bd6aff17d764", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509706, "uuid": "3c126f03-192b-4e0e-ae32-3805dff418dc", "comment": "Malware payload (CoinMiner)", "value": "b6b8dc6e2fea44610498405600bcfa4862363247650a6edf12c8b83dd415dd2492367024928b8ce4447b980d4281e9b9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509706, "uuid": "db585a6b-e3af-4040-aa07-655aaf3e5eb4", "value": "T155B5335202C3FA7FA09DE9C4A8FC7B311E6650F167281A52785E0C5ABC71FF901B791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509706, "uuid": "20b97859-1ad0-4597-a7b7-1445cfe30e49", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuwi:G3LG658+S8YrCpHy2dUuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509706, "uuid": "f339548f-657a-41fe-8929-035e90d6dc0b", "value": 2273280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509706, "uuid": "dc56fafe-4b41-4420-ba30-9660f6fcd0cc", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509706, "uuid": "3116ea2f-828b-4c7b-a856-cefbfd329169", "value": "88f731f71c1d9bfc1f23c71810aec54fd354177cc07f35c0bdc254687e82073a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d5eee9-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512963, "uuid": "200dd4c7-7d9b-411d-9c97-17774eb5cebe", "comment": "Malware payload (WannaCry)", "value": "abf42da16e0971ff966687c6e7d21987", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512963, "uuid": "a5a8295d-6b03-4b9d-bfe7-1792dac5d203", "comment": "Malware payload (WannaCry)", "value": "8937e88d1d22ccdd28a2215fd229df47d390c78392cc24c7c0eacc603b02d277", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512963, "uuid": "14ca4dbe-b5f7-4970-a0c8-0a0e07f15aa3", "comment": "Malware payload (WannaCry)", "value": "e51f968e9f126352765ecbacf4368f07ce69a4fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512963, "uuid": "b8a930ab-2501-4fa6-850a-fc4d19521128", "comment": "Malware payload (WannaCry)", "value": "800184058f8b38a7d60b8d4311b5a42845900a6400f3076fd6e6d43597d22813c4863b511ad5c3a0e8f50609739a900a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512963, "uuid": "387191b4-dbc1-4989-aed0-f98163c3311c", "value": "T15F3623A674AC80B4E106253594A7CF22F6B6BC3921BA6E4FAF804D311E53F97E714743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512963, "uuid": "e75393b8-475f-4d2d-b986-6fb2722ce970", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512963, "uuid": "16ecfc54-75a0-4667-90c5-b459c4bf9ed2", "value": "24576:RbLguriIZMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6627X6SASk+RdhAdmv:RnPMSPbcBVQej/1INRp6SAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512963, "uuid": "2c21b75b-ff42-47a0-99e5-9ac4aa55f246", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512963, "uuid": "2539b9dc-1b59-426b-85c9-fe6ef78ea9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512963, "uuid": "845f9cde-33d2-4f25-90b2-4200b64b1084", "value": "8937e88d1d22ccdd28a2215fd229df47d390c78392cc24c7c0eacc603b02d277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c92aef-e959-11f0-a129-42010a9c0007", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1767522905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522905, "uuid": "dc3983f3-9479-4061-ae4d-8f53f0541e9c", "comment": "Malware payload (RemoteManipulator)", "value": "005d6af0cadfb7196e5b97a9cd3d5e00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522905, "uuid": "48c8df73-00a1-4c86-898b-6ad9de0f9e7f", "comment": "Malware payload (RemoteManipulator)", "value": "8a9e3f85d6290f95204daf8aed93e511b8ed2b5bce5a498a43d52e0b729c049d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522905, "uuid": "2d609bf0-32a4-4417-b93b-67ff46dbf95d", "comment": "Malware payload (RemoteManipulator)", "value": "b984f4f42ecc0f7e1a17d116a317075f67439b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522905, "uuid": "85261721-986a-4fe9-b964-18c9ee7c23af", "comment": "Malware payload (RemoteManipulator)", "value": "b9c264a2919beb3733e44b50f43c5e9188e2af679b7802c2eb3f04318a1c2bfef9c0d049bea397cbb39d72d318f2f5ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522905, "uuid": "1be23e27-3fbc-4029-8f53-96766b9a19a4", "value": "T1A6270127F384793EC4AF1A3645779654893BBB6379028E5E6BF41C0C8F356803A3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522905, "uuid": "b5541bad-3fe9-4f0c-be5e-765ab2d75ad5", "value": "c1da5e020a55ba61f627c26e326fd353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522905, "uuid": "6389e205-fc3c-4652-beb5-2d0d2046a400", "value": "393216:3KFupMZUZBeHJbmAbU7EhjklyUM0bS7/Py7ef32i:6FeI5bU7ggxHa/PfGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767522905, "uuid": "f24c656b-351a-4bc1-b10a-07602df71a1e", "value": 21983344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767522905, "uuid": "4c4ae91e-defe-4be8-8f66-39eaa47d5dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522905, "uuid": "5cd1e556-1236-4249-8a69-98eaeac9522b", "value": "005d6af0cadfb7196e5b97a9cd3d5e00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e252be-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509799, "uuid": "400e6bd3-320f-42c1-9cb0-434462d0c79b", "comment": "Malware payload (CoinMiner)", "value": "2f99f98de3cb9d79ec718ec51f23aeb4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509799, "uuid": "4c39b841-b916-42fe-88d3-40aa9e60c856", "comment": "Malware payload (CoinMiner)", "value": "8aaa53218cd72e9d22376e214349fbc53c1ff992801d7ab0f05c46deef4657ee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509799, "uuid": "30678e8c-9961-49f7-83d8-b1cbba09b01c", "comment": "Malware payload (CoinMiner)", "value": "d95a057b276ad16787e24770d4a3e6755105cbd5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509799, "uuid": "4db4f69b-8fe9-46f2-8513-f3cb43780e7f", "comment": "Malware payload (CoinMiner)", "value": "7eb481164f42878587b66607a027654c56430679a280efa2a71990d5fd7d84ee0af456b77c613e545b3364344709ecbd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509799, "uuid": "c342d1c1-0f56-4734-8e9f-3dd0c6eba9a7", "value": "T191A5335102C3FB3F919EEAC4A4F8B7311D6555F02B291B52B81E0C5BBC32FE901A791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509799, "uuid": "1d48cdd2-1f74-4da0-9329-afe867f1467c", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1V:G3LG658+S8YrCpHy2dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509799, "uuid": "12ec3732-9997-4499-a655-e01d4fb65744", "value": 2166784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509799, "uuid": "a4445c20-f7f6-4116-a1b8-88d7cb6f4ce4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509799, "uuid": "a97e8840-6461-450b-9e1c-f0155e12fc76", "value": "8aaa53218cd72e9d22376e214349fbc53c1ff992801d7ab0f05c46deef4657ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f86481c-e995-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767548874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767548874, "uuid": "f3cae3f8-9689-4294-899f-96946dbf9cbf", "comment": "Malware payload", "value": "8ec16c140b4c08b4ccd033ea07c035c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767548874, "uuid": "887d5344-f950-4bef-b2b8-eb26898f24e9", "comment": "Malware payload", "value": "8b1927be1f50284c778b6ef8f0150440b4b1b75c59429b9d00c20fc746537ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767548874, "uuid": "d6f33daa-9a51-41f9-91da-2a5e501b3a3a", "comment": "Malware payload", "value": "393497a0a9def63fc3a097e024e0c98d95628cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767548874, "uuid": "460516de-7839-4bc6-936d-802622f682a7", "comment": "Malware payload", "value": "17e4884a09402db56dccd1354383cbc92ea8777b2f6eefa177a97b1118d1ac97fcb5be20b7f0f4c1c384cd157404b7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767548874, "uuid": "49f0e4a6-3425-4a5c-9485-a4efe6b46622", "value": "T12F086B4262EA04C4F9F7DA759AE66617C673BC162F30C5CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767548874, "uuid": "9e6256a9-dc3b-45db-94f7-9bafd0300258", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767548874, "uuid": "38484591-2164-4f13-8e51-2ade48140b6e", "value": "393216:WkmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNy:W5NmdsJY62A0y8Xy5rs3wbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767548874, "uuid": "09963342-59e5-40c3-bd7a-7616b80f46f1", "value": 82125885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767548874, "uuid": "a52afb6e-d37a-45bd-baa0-528f3beca108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767548874, "uuid": "21350d1c-0d29-4054-b3e8-0e76134274a6", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1211ceba-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567159, "uuid": "c92e05cf-b0c3-4b31-98af-8494e250a17c", "comment": "Malware payload (Mirai)", "value": "1aded9dcb797395687bdbbddf52bbfde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567159, "uuid": "6d02969f-478c-4e11-b46b-4b9d203d9b3d", "comment": "Malware payload (Mirai)", "value": "8c72c34890470866a1117b6600a51bef35a6b6e9f05114e71fe58d4579e87865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567159, "uuid": "c62d5b19-1212-40a8-918d-2e83164d44df", "comment": "Malware payload (Mirai)", "value": "6d6052b8423502efb9028f06fbf4b172667fdc3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567159, "uuid": "31b45102-fa9d-485c-bb0c-4bbe5f3e918b", "comment": "Malware payload (Mirai)", "value": "438373069d817f682a03d3a2e621814c1cfa87b0d1a1679821eaf67478674d7473e6a53f09785827c138aefabd7f7e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567159, "uuid": "b52970d9-a281-4623-946d-b97f90ff5e7f", "value": "T170A2E015BF2C828BC832793855E9E6D22252FCA1F2DCCC5D2540D15BF5A33A92834E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567159, "uuid": "d8fa4db6-74f4-42ea-a6d0-d6d1d3b2619b", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT4:M98o08kxofBE+ZkXaITbp2F2TWul0c5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567159, "uuid": "fe2ef45e-8c90-48b2-984c-b6c4937e4704", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567159, "uuid": "2a19fc94-3bd6-46b2-a3d7-0b456c975e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567159, "uuid": "28d5626f-ec32-4744-8057-588b5633901b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82789cd-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555439, "uuid": "ae174aa2-800c-40cb-a69d-8b305e33a5dd", "comment": "Malware payload (Mirai)", "value": "c9414e163db29bc41bf2815b23061464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555439, "uuid": "9dbbaba7-f793-40b7-81ed-7b7aeb26ceae", "comment": "Malware payload (Mirai)", "value": "8ca9b19c9f40d51e981cce5be0e02d062c914197ab5d1ca4d822714b50576ea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555439, "uuid": "cfa95573-3713-42e5-a4ca-850f4f684e4b", "comment": "Malware payload (Mirai)", "value": "130b525a188c8f35cd4d69f9d190a8ae890c97ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555439, "uuid": "e9ab312a-821a-4160-b912-bbcab37b2abf", "comment": "Malware payload (Mirai)", "value": "fa4865da2ccac1fb51c59a34a30441a13dd3adfba59709a0668697eb3386cc40737a8896680edc7e9a0325d73f735851", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555439, "uuid": "9850c66c-f236-4c76-afd5-3f110f33118a", "value": "T1C97312EE276280CBDCA15B7DDC89862F5E09336F79547D32E67482CF16A00BDB427416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555439, "uuid": "7474a623-761b-4bd0-9d9c-2622744b7817", "value": "1536:s0CeJz2Wl/QZOc5DQYMLTt6CtfPJ/RATJG+Fa7tIA50t9QpV:BJJSPOgD9MLTtHPZRATCuHQpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555439, "uuid": "172e38a6-f48a-46e0-b9a7-4466ff0fb26d", "value": 79192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555439, "uuid": "73e39614-b486-419e-af5f-454f3d48e381", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555439, "uuid": "93e11ca8-246f-45c0-a833-319ba0e014f5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58a8352-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516753, "uuid": "c31303cc-0734-42b6-84fa-fa37eadeec30", "comment": "Malware payload (Mirai)", "value": "299b862a3db3a3c7d3a2e22b7cdd4015", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516753, "uuid": "1a9372df-494a-4833-82d9-207ec4b793d9", "comment": "Malware payload (Mirai)", "value": "8d013995974a2a95ebd0ad67562d100151ba289fce5167ff362514f69c8830c8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516753, "uuid": "25d6cf01-eb7e-4cd7-8451-c4a61fecc784", "comment": "Malware payload (Mirai)", "value": "e74cc912e17fd3a736374806e5067b6ab8389570", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516753, "uuid": "67b0b892-9ce2-489c-8b2e-e5f29132b70d", "comment": "Malware payload (Mirai)", "value": "fbf817cc62ecaf4214701fa06dfbf4b57fe96ac1640e6edc8e149a577b5cf90aaa6feee83abeca3f4e041710c193aa09", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516753, "uuid": "edd445cc-10fc-4dea-b94d-462a1faaa180", "value": "T17F34F80ABFA14FF7E86FDC3752EA0B45218C940622692FB77574E918F54E24B0AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516753, "uuid": "f9b41f23-64d8-4083-92ce-9ade5bd35e1f", "value": "3072:7+1Zd+lJLW01cxzOL2OxJJFYvdyK+E2+UK8E/xZwHnwAekMMIy:7Ad+zLh1+zOLzJLYvdyXE/xZ2nE2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516753, "uuid": "22851caf-2f40-4387-9344-03afa58c5b2e", "value": 249160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516753, "uuid": "662f9566-1b9a-4275-b390-d081bff06b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516753, "uuid": "462b0175-0c02-4970-a3e0-296ed5a1c72d", "value": "8d013995974a2a95ebd0ad67562d100151ba289fce5167ff362514f69c8830c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe20dc6e-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511720, "uuid": "a10ff9ff-82be-48c4-ac50-6bc05169c523", "comment": "Malware payload (WannaCry)", "value": "1996db5555f0983938ed05e746514ece", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511720, "uuid": "2787d623-4cce-42ae-98c3-2cbc63172791", "comment": "Malware payload (WannaCry)", "value": "8d82a65637d38082eaa7486c63d7323fbf85952e10eaca012b304c789be1851c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511720, "uuid": "9ecc6f30-cd43-46da-871a-4350df0c23d8", "comment": "Malware payload (WannaCry)", "value": "d615c4fcf425c0c92cc62f7a08125e7dce7acc65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511720, "uuid": "bf2e0d2f-e575-4be7-a9ac-4210473f6e66", "comment": "Malware payload (WannaCry)", "value": "143f2aca7bac6c461753ab1f1af3c3259cc78767561cdcf7aafdee2fe4a39215d54fffac206f7d909f14703df66f2b46", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511720, "uuid": "3cdc82c6-8cfb-4bb9-a11c-d0659c74d484", "value": "T12336F1977250DA14C5481BB2897332FD50F37C128AE453AB1255F92F17B9E38A6BC3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511720, "uuid": "5ebc7009-e3a1-42f2-882f-d1c09bb5a07d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511720, "uuid": "a88614e0-4efe-4b15-be1e-4240d8267408", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511720, "uuid": "1e8db2a7-dff9-4828-9a07-83d5176109e1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511720, "uuid": "e3dd2ca6-581f-47fa-9db3-a48b4d024232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511720, "uuid": "47af041b-c54a-407b-affd-2b38fa3c24e2", "value": "8d82a65637d38082eaa7486c63d7323fbf85952e10eaca012b304c789be1851c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ea37c-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517688, "uuid": "1dc47168-dea5-40f6-99ef-0c2a648c836c", "comment": "Malware payload (Mirai)", "value": "9c38c5a4f2f65842edf4069c9227f556", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517688, "uuid": "9b4743a9-c346-48c3-b0d1-bcec15765ae2", "comment": "Malware payload (Mirai)", "value": "8daf89d2c311cefa32868c089b50aa43da6f1a9a579232219cba5660181f5420", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517688, "uuid": "44c84d65-301a-45d6-b389-a63243276610", "comment": "Malware payload (Mirai)", "value": "b184b7fe30a51b5903d35a188f2b132721eac2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517688, "uuid": "cf205e36-50c1-4cb8-9c34-b3b287cde65a", "comment": "Malware payload (Mirai)", "value": "e02233ed96db3708cb6e4c1c7bc2eb76844af5eac3168a1ab4050d438c32d4ae9f65b00219c3f6bdb2ba5d3e8b892017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517688, "uuid": "0216579c-90b8-45c1-892c-b486df7d9410", "value": "T106D3F602770D0F03D1633DF0277B2BE1979AFD5228B4A680B41EBEC992719F22545EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517688, "uuid": "4653392b-3877-4842-9ec7-7a7f5b9c57bd", "value": "1536:sAt3i78bhN5OxXRX1c3oV4S4QRm9qcSqR+rvAHLyVbSa4v9PrxBbqBu22cg:53iwbhN5Ox3D+SVRRcMsHr3/cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517688, "uuid": "0747bacc-c684-43c5-ab64-50fcc8d2b499", "value": 142584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517688, "uuid": "690cd6e5-34bd-4724-ad60-6bd4d2601778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517688, "uuid": "12469249-ceff-499a-b55b-f05568fb3f54", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed6985e-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511077, "uuid": "6084a008-e258-44a9-91b5-3cf1700f9b2e", "comment": "Malware payload (WannaCry)", "value": "e5b3bab0d7cd0de253c666622295582a", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511077, "uuid": "f744996d-84e1-4d51-b234-f80f6382b7f5", "comment": "Malware payload (WannaCry)", "value": "8dd1b7a4b3ea0e429e050ffe2849aa4790da278671dba35aa8e4ad60f84027f1", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511077, "uuid": "e0194b38-c95c-4a49-8daf-6a25cc7beca3", "comment": "Malware payload (WannaCry)", "value": "536d242a8014854c306422196e64212ea1cfc659", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511077, "uuid": "1f97c388-93a6-4646-af9d-f630fee1b1f6", "comment": "Malware payload (WannaCry)", "value": "139dad60d4c5c00f3e2953e48b53e375a85228cee1c9bbe8db95b450e36488f95664f005142f952e9777e7a83748dd60", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511077, "uuid": "c7a9659d-fcbf-4cff-807f-ed88f27d8a28", "value": "T15636232234A9C030D5035130C4A54B25AABABC3927755B4FBFD48F6E6F237E1E726B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511077, "uuid": "d6f19e3c-c78d-47f6-b7d8-d66c9bf33be9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511077, "uuid": "f904e192-17af-4f2a-bbc8-e657fe1d528f", "value": "49152:RnpEKvnEEeZezw2uvgyd7+KnT2becwT6DGMIBHuLZy:1pqi9ywKSbevWSdOLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511077, "uuid": "95b7e807-a4dc-49fa-93ed-efcea218d858", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511077, "uuid": "3c07cd85-6262-4feb-9f2c-7f4ada5a5c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511077, "uuid": "6f474832-b982-4fd8-ba10-d1829296ee66", "value": "8dd1b7a4b3ea0e429e050ffe2849aa4790da278671dba35aa8e4ad60f84027f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a88497d-e984-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767541538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541538, "uuid": "f539b4b6-2de0-45a1-8b56-12822c481147", "comment": "Malware payload (SalatStealer)", "value": "bb60da31df8e364e159aadbfd6e7358c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541538, "uuid": "8ef197b6-ed30-47d3-9e88-4e11a292087b", "comment": "Malware payload (SalatStealer)", "value": "8e4a1591d0b035190fc27ea619690e017ff123379cc417a374fcc3b760c0150f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541538, "uuid": "31ae5819-66f6-4cc2-997e-117666d0d542", "comment": "Malware payload (SalatStealer)", "value": "6d0e7e71b4dbb1daa4e8bd1548438d226976cd22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541538, "uuid": "715cc72c-626c-433d-b627-ac9e6273efa6", "comment": "Malware payload (SalatStealer)", "value": "485cda1d89f7aa7b7019075c05a0340fff9430d94b0819814fcff87381a3ab4b44f90eea52f04cfcf2184040854d9574", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541538, "uuid": "f2c03373-6725-4188-874a-f5d793e8342b", "value": "T13EC65A11FA8B54F6E9071831815BB33F67315D048B28DBDBEB543B6EFC77A81582A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541538, "uuid": "3c26ff09-910b-4ccc-b63c-4722251473c5", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541538, "uuid": "98b8e52e-679f-4198-9161-d5982654897a", "value": "49152:FVW2Zp5SPq9kJhop5Vf9B8TEtuJt+Hpu6HF2wkgXuUSTMe6NP4k530MBPx8lVW5b:LnZ/SthM8ywqA0cx82VS8WokgDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767541538, "uuid": "165b2ad9-e30f-4616-8660-79067e90ef2c", "value": 11664384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767541538, "uuid": "068da289-f539-42c9-b00f-6f7ecdc340f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541538, "uuid": "d80e91a8-67ec-4804-b1b4-4ad25a72e86b", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb8d588-e9ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767558243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558243, "uuid": "bc76101c-13a9-468c-90f4-ede4b2fb0a24", "comment": "Malware payload (Mirai)", "value": "4c90ec3f8d96a86d8fc6aaf663a9859d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558243, "uuid": "94b031bc-1c75-424b-82df-df14b5a03155", "comment": "Malware payload (Mirai)", "value": "8f81eede8f4ffc867b15912d5405ad04eef0ed2dee54f9d0b03144f1344f95c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558243, "uuid": "bc922dc6-9dda-4f2e-ac82-08bfc932a67b", "comment": "Malware payload (Mirai)", "value": "d9509d2bbb839897f8421cd46397e6c3cfb2f2b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558243, "uuid": "1cffe987-da77-4526-afea-06b84cacbbce", "comment": "Malware payload (Mirai)", "value": "3718a2bb66237b51e63b73cdb412ed6025395a87cf194ea282a51f2a140663548a24dac53c0e4e41d736510917684369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558243, "uuid": "7115cc27-079f-4f5e-8ab8-1c3d12400f07", "value": "T1AA056D1BB2B374FCD557C03443ABCAA2A935B43502216E7B65C8D6303E6BE701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558243, "uuid": "a992a0a4-6328-4d15-a0ca-8f6166fdf71c", "value": "12288:PUVnfeFMlVD4s85D/PkkV1s67qAtvcpv1rZXMCKwXwkstgKEdzuF3TmJywsrhAFK:0nGS94skkkV1scfEpdrZehkst469", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767558243, "uuid": "799926e9-75e7-4fa4-9dbe-6be1a9287c15", "value": 832240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767558243, "uuid": "8e03d458-ff1e-4a4b-b017-6ec55cd2ce89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558243, "uuid": "9ac14928-a21e-4256-841f-6a52ed8497b2", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a7d64b-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512569, "uuid": "32e3ca4c-2808-4278-b145-3613672cfc1e", "comment": "Malware payload (WannaCry)", "value": "5d5b6d2eab88e20a44a9121186a0c602", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512569, "uuid": "3481d5ac-e434-4735-8414-a4a1fcd3a2f8", "comment": "Malware payload (WannaCry)", "value": "8fa6625344fd996992d45a71beaa9a9467e0a17807299d057e0567272778b645", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512569, "uuid": "a12b17bf-85f1-4e8a-b91b-b355702599a2", "comment": "Malware payload (WannaCry)", "value": "efb0237f891d462d6c7fb2ecbded44d46b6d4a3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512569, "uuid": "fe4b13d7-dcbf-4e41-8d6e-fb50ff27edc0", "comment": "Malware payload (WannaCry)", "value": "44aad25f265ad3d1da823990099560359a0431f269c0b01c9c72e392cc4d060ad0e1f1a443314af345abd69d7cf31990", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512569, "uuid": "fd107456-f99b-47ef-8555-809dd04d39f9", "value": "T19A363394622CB1BCF0440EB44473895BB7B33C69A7BA5E1F9BC0866A0D53F5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512569, "uuid": "bb6d9abe-1313-48e0-8105-70da7748b89e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512569, "uuid": "5ad9a896-2c35-48af-9669-04ececfce4cd", "value": "98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hq:dDqPe1Cxcxk3ZAEUadzR8yc4Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512569, "uuid": "f1a5bbca-2140-4a37-b7f5-456329a9a83f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512569, "uuid": "f939f377-2976-4794-a2fc-a810d45f493d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512569, "uuid": "738c3d05-63b6-49cf-bccc-54bbfd96419c", "value": "8fa6625344fd996992d45a71beaa9a9467e0a17807299d057e0567272778b645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e303f83-e943-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767513519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513519, "uuid": "d38ba242-a513-4b62-bffd-d16139eefdcb", "comment": "Malware payload (Mirai)", "value": "1504da4e2f8861fadaf106de4c22a59d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513519, "uuid": "181195ba-26ce-4300-bcfc-5e7c5621485b", "comment": "Malware payload (Mirai)", "value": "8fe9fc772c299089606e19f5dbd06fa0e42bf3caa7537a09593baad2c05c5e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513519, "uuid": "1a4322ed-f1e4-4233-adbe-b4befc42781e", "comment": "Malware payload (Mirai)", "value": "126ea2e3d15a347dece5c0f6896a4ec5544f9607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513519, "uuid": "1ba9d08f-14e9-4cac-a14f-48c98a8140d9", "comment": "Malware payload (Mirai)", "value": "89ab226737249cfc6e6dee2b7fab37b816a1c8be7f80aba50bd313022f916ac56ae3e96593fd7a1e4d0aef333784bf73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513519, "uuid": "187c35e0-7274-4662-8acc-c66caac89b49", "value": "T136F2E174667F30A4EB72A5737028CB6CE34659E6A1F4737B2C805A7891D100EBD7A247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513519, "uuid": "a96d0374-546d-4da5-9402-0637ba74674b", "value": "768:8pxQBX9ACn0tmkFXL7Lfa0ZlafgEOIGr2PLF+kKLimlis3UozM0d:8rQDAztmk/sfg5jracHLphz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513519, "uuid": "d1f92a5d-10cb-400a-b80b-afd051ddf12a", "value": 34600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513519, "uuid": "a9a3d40e-c993-4295-a237-1a1038d437b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513519, "uuid": "82c0efeb-1cf7-476e-8eac-ee1471150c90", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60c7b5e-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509023, "uuid": "211b2b4b-5c00-4b0a-98bf-853aa5e2e16f", "comment": "Malware payload (CoinMiner)", "value": "f33c698ace534fcdf488a572d8cbc3b6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509023, "uuid": "831ac3cf-4d9e-42a4-9315-daf1fa8eb0b9", "comment": "Malware payload (CoinMiner)", "value": "8feccc9c4499135901993737b5add1933167f640df30582cc42f4d3770b33cbf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509023, "uuid": "34a52e52-0fa2-4b72-8a62-988f70eb601c", "comment": "Malware payload (CoinMiner)", "value": "b4552561b4a32fcbdd0bd68a707ac4391200dfdf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509023, "uuid": "890384e9-d395-4c95-9e4e-449063b4939b", "comment": "Malware payload (CoinMiner)", "value": "0dbae388480966a8b6802ab4517d74e535027cb3f4a37b17f7d83f72c36eae08a49717aa6b975d47d0d7c2aac36976f6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509023, "uuid": "2e6b38c7-e873-4b6b-8aa1-b572de12a659", "value": "T17A16332511CBBDBE7589C8649DF8FB324F9A25E29D784105F83A0428BC65DE2407B72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509023, "uuid": "38891d00-18f4-4921-9e51-3cd8823f12db", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhF:CC65sr3KrCfsYiZQgzJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509023, "uuid": "d7700aa4-3b04-4701-bf68-3e0b7c881b01", "value": 4337664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509023, "uuid": "74317bb0-3ebd-42bb-ae3e-34593e604cd6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509023, "uuid": "d130ffc6-85ad-4dbb-b60e-105e017efdb8", "value": "8feccc9c4499135901993737b5add1933167f640df30582cc42f4d3770b33cbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adafa7d4-e944-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767514162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514162, "uuid": "088af07b-7baa-466b-a26c-8193d0821366", "comment": "Malware payload (Mirai)", "value": "d4d9b778f997d820e69fe187efbc6033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514162, "uuid": "359e281c-98cb-46fc-8689-e204b5faa10c", "comment": "Malware payload (Mirai)", "value": "90287fa30096bca74e587bb09fb207ba97732f7dee1a983c098ac74c6df12a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514162, "uuid": "a72a2566-66bb-49d6-8d46-d7a41d136fb7", "comment": "Malware payload (Mirai)", "value": "1540ed9a3643afd693bfadc17b331a2249fede6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767514162, "uuid": "4e8d246d-61d4-4afa-b52b-4ba3356d1ab8", "comment": "Malware payload (Mirai)", "value": "214d48ae86eb4e8268e71ae4448a2c402495f6c9657e360d1c2dcefd038ad6f9b7ba898e15487948ca377b2de92f2bf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514162, "uuid": "7f3e108e-ced0-4e09-94eb-9ff44e3f9b7b", "value": "T1C2E3388CF58FC1F6DA0788308066F7BFCB31A4254076D68EEF95AF35DA275829216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514162, "uuid": "00beff36-a8bd-4eca-9cea-36bf2df9d592", "value": "3072:Tr+UdlptN9Xr4QfJThvz4y6wSPd+qMgXR8/Oj+:eUdlp/9MSThrSl2Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767514162, "uuid": "22d7ac12-77c4-4892-a972-7e9ff2304a2b", "value": 151084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767514162, "uuid": "7fe7d1b6-4b9c-4940-b948-74008bcde4ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767514162, "uuid": "21a19368-9172-48c7-973d-3f9443447a4b", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db31543-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512686, "uuid": "d254f4bb-9f1a-4ba2-a4c7-8417d74b29f2", "comment": "Malware payload (WannaCry)", "value": "2879713529a88cd6ab1070c6e87b2e9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512686, "uuid": "c057457f-6322-42cb-959d-22107ad53085", "comment": "Malware payload (WannaCry)", "value": "912fd8e260cae57fe019412486e26040d4a49a5af4283a4b2e9d3ea7dfaa273c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512686, "uuid": "884b9aca-3bf1-48c9-a291-121fb9965ad1", "comment": "Malware payload (WannaCry)", "value": "ddbb7dea5ead942f59e16c43936d866224848156", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512686, "uuid": "3d0d3fec-9ac6-42e7-a16a-29dabcdb6ee9", "comment": "Malware payload (WannaCry)", "value": "ea4e2dc9b2bfb1d0e9cd1c7adb08c7444c683ce6abe348629e8bcb9118ad868df572e42faf15d2d7fd9a7db513ddd6ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512686, "uuid": "06122e42-02c1-4247-b45e-bb8f6882319e", "value": "T1473633AA70AC80F8D209297484BB8E17F2B63C7A21FA690FEF4049752D53F56F750742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512686, "uuid": "629f62a9-026c-4e46-b4b7-533fa37dcefe", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512686, "uuid": "c21b2eae-d47f-43eb-a217-0dfcf4bef354", "value": "49152:SnvMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:+vPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512686, "uuid": "0ddaeb08-d07c-4871-8d62-7dd22bc83981", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512686, "uuid": "01c0995e-d94d-4443-85e1-4f454b0a1196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512686, "uuid": "627fe242-a823-46da-840c-5da1e72942dc", "value": "912fd8e260cae57fe019412486e26040d4a49a5af4283a4b2e9d3ea7dfaa273c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f4b36b-e97f-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1767539223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539223, "uuid": "c808d486-0a54-47d3-b3a6-04171dcc8ecb", "comment": "Malware payload (GenesisStealer)", "value": "c87de11b1a08b56acdf0d81dcd2cdf90", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539223, "uuid": "3e7cf1b1-d510-4690-9a19-300dc59f47ed", "comment": "Malware payload (GenesisStealer)", "value": "9199e4c283f7fadcfaf319a51d26b4cb6a4d1abf8bd248b83908cc2fbaa2a0da", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539223, "uuid": "18a75d0f-e6e3-41eb-a733-2bd07c8a1865", "comment": "Malware payload (GenesisStealer)", "value": "774919df66c559275049c2dcf50ff86ce6cba1b4", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539223, "uuid": "bf18b3be-a765-47d4-8b3f-bba93a7d0159", "comment": "Malware payload (GenesisStealer)", "value": "5c26b1297b9454f8d7af0eb88e759bfd73b35472d2e81230d31b8f83132671e21c7d39bc4676f867c1f7510804b9e3f8", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539223, "uuid": "5cdb1659-a40b-4a56-a4c4-19eb331608a1", "value": "T191E4F02894D6C8EDB984F54E05AA49C47BFC71B04184BFF306D9EA4F659060EE0A6DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539223, "uuid": "f5c84d67-66a1-4826-b49d-04e39d07afd1", "value": "12288:7eXwzfol9fc7Hv5zCNIgphopyvVDKPY3MbrC3iVaOBVHvgnqnIMN3g8uYTEe:UwzofcFztgpKpyvdKPY8PCdOBOqIgj71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767539223, "uuid": "0de106d1-2bcf-4f0f-88b5-3ced76892a6c", "value": 712208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767539223, "uuid": "dac1f64b-7fb3-4b9d-af72-f767355fbf2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539223, "uuid": "a1b4e22a-7fe2-4de0-a30e-d9bb942281d8", "value": "f3784f4792b472a8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab8c494-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511044, "uuid": "4e7b71ef-996e-4383-a742-6de6f8b25e8a", "comment": "Malware payload (WannaCry)", "value": "59b5090fad3d62f05572470f0c79c9a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511044, "uuid": "1b3c41ff-1a36-410e-add3-30d3714ca59e", "comment": "Malware payload (WannaCry)", "value": "91ff9ef066c28fea00b124573868af71654ea2de7d54d0e927f3e281544d20ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511044, "uuid": "3620b7ea-3aa1-47e2-8d51-d1d547603600", "comment": "Malware payload (WannaCry)", "value": "e9d0dce04a3506f432f3ab4b280070422865b8a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511044, "uuid": "58f88fe6-fb0b-4053-8df3-241142ae3950", "comment": "Malware payload (WannaCry)", "value": "a42984667f5af848c6e4988fc20fafdd752709c188f20ffbfc4906547facfc835be0309076de468ea971f4c37c70a106", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511044, "uuid": "f34d96fd-fdbd-4bd3-9c6e-34e39c045dda", "value": "T15A36A611A5E86B14E7F35EF626BA9710463A7E898857D25E0225710F0C33F1CDEA2F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511044, "uuid": "9094a2c5-db7b-441a-a980-0cd56fe2196d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511044, "uuid": "b9305cf7-c8b5-443b-9f5b-4d60fb38811e", "value": "24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/Gs:SnAQqMSPbcBVQej/1INRAW+Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511044, "uuid": "0d85bd0a-36fb-4940-9408-acc2e0e1e08c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511044, "uuid": "61004a38-9d71-449f-9dfa-ef4db62264ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511044, "uuid": "5718027e-bfbf-43b8-beda-365784ff3767", "value": "91ff9ef066c28fea00b124573868af71654ea2de7d54d0e927f3e281544d20ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52c3822-e9a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767554226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554226, "uuid": "1275861c-4fc2-43de-bed0-8f456016614f", "comment": "Malware payload (Mirai)", "value": "1e3dbc14bc715b0eadcbd0b489ab4c9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554226, "uuid": "53442347-47ae-4bd5-9042-e0f7ddd33fd5", "comment": "Malware payload (Mirai)", "value": "92228faa0dda2e732311d6f5425a1a681ebfd0077675e4d9bb6dacb693c31119", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554226, "uuid": "2dc9b75f-ba20-492d-8934-68791ca93b8d", "comment": "Malware payload (Mirai)", "value": "5e66c7e69bdf3e6a59038ff8a4fba199471c8613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554226, "uuid": "9402f2a2-4c22-4bf6-a254-4d3ff7a814ce", "comment": "Malware payload (Mirai)", "value": "a9c0e7044463e5db8510c27413e49ec6d0e23108241e044e33a9b37215ee560ee26c1c7ccc4863745e7e5a31f71f1b4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554226, "uuid": "b20cda6d-d41e-46b5-8e16-0ced9ceae5de", "value": "T102342C46B8918F12C5C112BAFE6E418D33136BB8D2EE7102DD245F64778A8EF0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554226, "uuid": "335a8e94-4677-428d-becf-f574737847d8", "value": "6144:NyLtHMCJNt0rGlMOVd/p/qHlffCLXWq/ap6W1R+TrMBwX:YLZJNt0rGlMOVd/pCH1gXZ/at1g8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554226, "uuid": "926843f8-54d6-442f-a610-8d13fe476b1a", "value": 237524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554226, "uuid": "f061e3ce-ba78-4a9a-ac6c-260f42ae6367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554226, "uuid": "0101ae01-1a25-4b0f-b0a7-b291740d0ac5", "value": ".7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db82c42-e936-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767508096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508096, "uuid": "ee304165-0e81-4b96-a066-e7a78e405ca7", "comment": "Malware payload (Mirai)", "value": "c24e1fd8c0b8d711609d6af439175c19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508096, "uuid": "6f7574a8-f145-4c3b-931c-d5591dac6002", "comment": "Malware payload (Mirai)", "value": "9267d72329f90eb536293356097a511cfa6535f13148fc3b7ea9e9f4b8b169da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508096, "uuid": "dd7c603d-dc6d-48d0-a51b-e9773074b88f", "comment": "Malware payload (Mirai)", "value": "7b21da626c9bac383a6b5dbec606e72f5d2e7ace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508096, "uuid": "8700df90-ce4e-42c1-89a6-24d8f5213ddc", "comment": "Malware payload (Mirai)", "value": "a54c6afa7c4adc031eea0e0f3956a252521291dcb2f59914bdf9df4b4fd9838e86effd71304f6cbf20cde58f1c9dcedb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508096, "uuid": "ae8d6eaf-4ff3-44ce-9b0a-558a11175a8b", "value": "T1B8D36CC4E64FD0F6E91211352176B7269A72FD3A113EDE83C3A89B62AC939C0D61735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508096, "uuid": "60646fc5-009a-4e1c-b9d4-b5e882f20c1e", "value": "3072:SS3mvDmaFrp0nvT6jr9abt5O0Ju/LmXt:V3mbmaIhykCLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508096, "uuid": "74e819e5-029c-45c8-b444-31c1d61c969f", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508096, "uuid": "f8a1526d-6c6b-471b-99d2-32a2570fac64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508096, "uuid": "3fdc7990-034f-4211-93c9-ab89f4c66fcd", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcd7e93-e992-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767547395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547395, "uuid": "55c09057-7b0a-477c-83f5-844db9a5d278", "comment": "Malware payload", "value": "43e3102c26998937162b884711769a96", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547395, "uuid": "9e84b2e2-1d47-4e73-ae4d-e8fda0d2e173", "comment": "Malware payload", "value": "9271e883e23b923bbd2d23230e8db91ff707c26f6140f5f81f2695b66e7bc434", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547395, "uuid": "fab28ed1-849e-477d-bf5c-c0a6b436bbc5", "comment": "Malware payload", "value": "dbcf658ef18013f3cc0cd1f6256eed9f6dca5fbd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547395, "uuid": "dcaa5ee1-b8bc-4a7d-a7cb-e1b3397eb40d", "comment": "Malware payload", "value": "aebecac20688d39be5a797de51055c87c8c3efea261eb4ea0654943729374e3e8cae4bec4bdc9ec1a373628506f8bc5f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547395, "uuid": "6bc7386c-9222-41c1-b2c4-49684bb0426c", "value": "T1CE8529376CA109EAC4AA533248AA2291BFB1BC370F31D3D32A5072793E767E48D74755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547395, "uuid": "d050605e-f652-4b3f-b977-3081a668b657", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547395, "uuid": "3f77889b-209d-4705-958c-a622114a8e6d", "value": "24576:MmSWRc1BhCGDuLxrFdz31Ne+5ZCu1A/NBele5yK2whYke:Mm1RaBHDu1rjbfCu1TWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767547395, "uuid": "d5ff5e36-6c77-477d-989e-63e46502d063", "value": 1748992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767547395, "uuid": "9f69529c-6a58-402b-b275-a4d4307ab9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547395, "uuid": "7b67bf0a-b15c-4b99-bfe9-c62a66329d62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f516e14-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511347, "uuid": "e20b4baa-a64b-43c4-8293-fde6f4c01bf0", "comment": "Malware payload (WannaCry)", "value": "ce223b231f2862124386c585e9b95ca1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511347, "uuid": "3edcca05-ea3a-4c23-b33c-7fe5b6e1ee14", "comment": "Malware payload (WannaCry)", "value": "92bc02116a72b13d359ba88e0984ea09d2eb230fbf711d92a0c961e08274a09e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511347, "uuid": "00a73de0-53f9-4375-9d6b-4c9fea0b862f", "comment": "Malware payload (WannaCry)", "value": "61673e2be7e3479a818eb98339692bc7e4a5b79c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511347, "uuid": "b7e8b548-224b-407f-8981-2bafc46b0bb4", "comment": "Malware payload (WannaCry)", "value": "1912287e7fd5f9f3791f343b23a0a4ce2299c03bbd4c4d8879c309b03141e3fca40a0e74797a1e10b87702fe38d1ef9e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511347, "uuid": "e8419f83-b6e9-4f11-8511-71210b9cb8a1", "value": "T1CD36235A766C91FCC10A627574634926E6B73C5A22BD960F8F908B520C137A0FF78F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511347, "uuid": "e8c6b7c3-b75d-4c28-a18f-067a73a5fba1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511347, "uuid": "a2a0f9f3-c4cf-454e-88a7-00e15ab83fdb", "value": "12288:TQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:MbLguVQhfdmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511347, "uuid": "9ef038eb-0785-46c3-9a4d-4124619fc5e1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511347, "uuid": "650f5b26-6fec-4bb8-85dc-9eb9d6a3cc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511347, "uuid": "1c06e9b1-1748-4b07-a8b5-bfc29e36d9a1", "value": "92bc02116a72b13d359ba88e0984ea09d2eb230fbf711d92a0c961e08274a09e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2786b91a-e949-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767516085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516085, "uuid": "757f3daa-ada2-4b13-b8fb-cb89090a6ec6", "comment": "Malware payload (CoinMiner)", "value": "192d0a6fd796240f8aecab93bf041066", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516085, "uuid": "bb54d23b-b9b8-4150-ac46-9a33d7e5c008", "comment": "Malware payload (CoinMiner)", "value": "92c78d8e8b9af5aa15a9dfc7028fc25e9f1aaaff9886c220c13d8fde263609f1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516085, "uuid": "beeb4d80-73c9-4cd5-836c-63af97ebbf92", "comment": "Malware payload (CoinMiner)", "value": "56845292d2921ce22f0e815c87025f21af4d89e1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516085, "uuid": "ad39b5b0-e3d3-4a24-870a-fcc2bb6b1ed9", "comment": "Malware payload (CoinMiner)", "value": "220627654c583286fca2b347fd80f50870e9ab85bd47be4ae08e1b351494c496155951d4f7f7ed3858307afeab2e89e3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516085, "uuid": "6ecb1120-caaf-4a4c-9bd1-dd62152ccc29", "value": "T1E56423971085A8BE9264978C2BD40BBC0DB5F5B4AF61FF864C0B5B6CBC90F411EC6752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516085, "uuid": "bf3763d1-55b8-46f2-b912-5f871373794d", "value": "6144:nG/zrOmINqLS5iD8/kEX288IgP+jXaIdVRKhs2gpVj7ZSwYOtw:G/zrOhy568XwZR17jlSwYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516085, "uuid": "688ff540-5b80-412f-8bfe-9d931bc6b900", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516085, "uuid": "eac503f9-e2c9-4c46-a216-2e929bce1631", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516085, "uuid": "89f4194d-36d7-4a52-b5a3-edc66d0cf37a", "value": "92c78d8e8b9af5aa15a9dfc7028fc25e9f1aaaff9886c220c13d8fde263609f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118d57dd-e950-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519054, "uuid": "92e9055e-1186-4c24-94e8-2fdda4d73c5f", "comment": "Malware payload (Mirai)", "value": "b813a14f9590d7040786443adcfc0e7d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519054, "uuid": "28824fc0-fa66-4d5a-9d95-0824228cf0bd", "comment": "Malware payload (Mirai)", "value": "930eb4dfc92775f778f86ab656f903b8b85299529421fe9d5ddb0f5c44369acf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519054, "uuid": "0ba1bcff-96f5-4cb1-a08a-84fc1f847baf", "comment": "Malware payload (Mirai)", "value": "b175820e2a1be7dda0e33807725fad475241ed89", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519054, "uuid": "e8b9c32f-79a2-41a5-9a77-1d329bb92aac", "comment": "Malware payload (Mirai)", "value": "be00105d513be52482c5af630fa4adf149fe2bbf3e905b240934cf59243b8de04930cc70cebc09fd2b73b72d7a0238a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519054, "uuid": "da38884f-685c-4a17-a1d1-6093daf23bbc", "value": "T1B72122CF2064B96A504CCF4030AA16857AE9CBE1F1748E17598478F388C8603B7B8FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519054, "uuid": "c60d49f6-8357-4ae8-a1b7-0f42c0ffc3db", "value": "24:6j+E54VEczLNIZEtqDEVKT5CEHU/EO99S0P3E3eMCbEKP3eEz6gE19mdEkrxn:QanvQZajSgEetPXAqrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519054, "uuid": "054d8872-3360-43ca-9c21-05a842dfa8ee", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519054, "uuid": "5ec05f46-2262-4338-9c22-8c8ed7cabd85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519054, "uuid": "92c4400f-ded6-4a94-ba6f-cb881bea1de1", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741cfac3-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513207, "uuid": "441c21b1-cfa2-4d9b-bdac-b510fd2bf1a2", "comment": "Malware payload (WannaCry)", "value": "ebaf4de7ec5324a5abe73fdb45e6fff4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513207, "uuid": "d88ff35c-0b89-4476-908c-8a6764cb4120", "comment": "Malware payload (WannaCry)", "value": "9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513207, "uuid": "919bc5db-8f5a-464b-b4e3-3c51ff71c57b", "comment": "Malware payload (WannaCry)", "value": "9a7c9ec13d6ae505bf1e230300d0b5c27dcaa61a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513207, "uuid": "cd07388a-ad74-471a-bda0-72cacaf116cf", "comment": "Malware payload (WannaCry)", "value": "049a7d6dfaab54e1dc2619dec6229edc69937dd211907c7ce6c47a6a52ace26f36114f18163e9413d04a5171204368e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513207, "uuid": "85136673-6364-4c33-a76e-071f46faee9e", "value": "T159363359717CD6FCD10919B404A7CA67A3B33C6A16FE6A0F8F4089661D13B19FBA0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513207, "uuid": "bd6b818a-c721-4e5d-ba5f-1270f8822004", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513207, "uuid": "4b2717e8-8a16-40cf-b8ce-e3fa4cf6a4c9", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:d8qPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513207, "uuid": "cd3b7051-75ed-42a7-a98f-ad7fbb502239", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513207, "uuid": "5dc2af49-177f-4658-8e7f-d3dcf78be571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513207, "uuid": "7b93864b-7dad-4cf3-8356-2640169f4152", "value": "9395b8f1ef8bd964b349b320a5079816bae8b676caa2d8df17a69d41009eab1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f703f41b-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512997, "uuid": "2bd4b02a-62c8-4459-9c14-9ca09e091e8c", "comment": "Malware payload (WannaCry)", "value": "7823636f9ce01306178c1ee7772ad831", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512997, "uuid": "fb32dc2f-a2ed-40fb-a137-15a7f64e74b6", "comment": "Malware payload (WannaCry)", "value": "9443b99b4839e7df78a09682c686ff54464d3edd9635bd05cf3c5e6211215c85", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512997, "uuid": "5382b7a4-fb04-4bd4-9cef-229c7d081b00", "comment": "Malware payload (WannaCry)", "value": "8895257915c33299a6bc30b064267d5959aa4440", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512997, "uuid": "dc53f071-495b-4608-a063-74333157271f", "comment": "Malware payload (WannaCry)", "value": "34a991f58573e0dbce684d863c838bcef68f634a3099a5ef80f957843129a01831747e964f5eb10c220808d8836d459b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512997, "uuid": "0e4fd9b1-84d3-41b8-a02c-8cf97dc7102b", "value": "T139360251A618A77BC21F913490F34D2AC5A37C5A1176527FB77CCA0B8F173A0EB68B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512997, "uuid": "7badc3af-83bf-48c5-9405-38cc75263862", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512997, "uuid": "6ac84eea-e3d0-460e-b8d2-727165c5b16e", "value": "12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DWe:SbLgddQhfdmMSirYbcMNgef0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512997, "uuid": "9096f31c-4d85-43ac-9d15-a44f0d6cbef4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512997, "uuid": "4adce896-2118-4a86-af2f-db3a9958e55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512997, "uuid": "30733f4d-223f-4b27-a0fa-a1048e855070", "value": "9443b99b4839e7df78a09682c686ff54464d3edd9635bd05cf3c5e6211215c85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c5d4a4-e9ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767564795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564795, "uuid": "fd8905b9-823c-4fc9-b817-3d98f3b770f4", "comment": "Malware payload (Mirai)", "value": "8936750f863bb957f9545c03c0a3f485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564795, "uuid": "581f8b06-3b8b-4ff9-816f-31e2cca333f8", "comment": "Malware payload (Mirai)", "value": "9459c83416b00160e2d1dfaeb9b58cce0bd00d1c0d2ad0767f7ddd36343341cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564795, "uuid": "4e3de605-8711-40bb-bde0-5b22f089d16a", "comment": "Malware payload (Mirai)", "value": "cf3684274a0bfd2897bc4651ace64700c0996506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564795, "uuid": "b2ff1b8a-9d1e-4ec6-9a7e-a6bd92457c8f", "comment": "Malware payload (Mirai)", "value": "d47c3240ef928c564a9db4926cd2152cdb7a2ee820139ac6f646a2b557c0ae044757a493a854496e0b17b77299959e96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564795, "uuid": "72e037ed-996b-4bf7-baf2-ab9bcaac5aec", "value": "T12CD33A46FA414B13C0D60779BAAF624A3322A7D5A3DB730659249BB43F867DB0D23F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564795, "uuid": "059f8ed6-4f83-42ea-93bb-8b4c8d323f8e", "value": "3072:5Jz9ot9292TuRoZubwxCyUWB/J1YnrHVfdM/9h5ZIiT:5Jz9ot9292Tu2ZubwxChWBhKnrH3M/9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767564795, "uuid": "9e1e2c96-a39b-4181-9722-e4a48ab0b025", "value": 133893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767564795, "uuid": "db84e245-c214-45ed-a433-81e724e3a258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564795, "uuid": "fb310b0a-f13f-4dd3-abf1-18d81f212184", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec36c70-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511560, "uuid": "8a0c117e-5e41-42cb-80ff-6b25eb425a80", "comment": "Malware payload (WannaCry)", "value": "3399db0d39ecdcaf2060d7d5b53e449a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511560, "uuid": "ebdf6a11-1578-4b4e-ad98-ab38c040bc1e", "comment": "Malware payload (WannaCry)", "value": "948e7fee5b3bb40a121561addf2b57d69db8d8ced25c1fa3fbce7aa040a6ae74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511560, "uuid": "4310e4e6-399b-4815-a492-caa8b6f7ab11", "comment": "Malware payload (WannaCry)", "value": "9294cfdfd682211ab1f2c867a22a99408d3359d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511560, "uuid": "205ded89-873e-4704-9e18-7ee3d1d4a167", "comment": "Malware payload (WannaCry)", "value": "a3b3490b92bec79c7a6e4bb08e69100225f279971ed1391a0241b4d1721a41d650719e65d52663fe4706f9c6738a1391", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511560, "uuid": "03c5edb5-0dad-4739-b785-dd0d2f340aab", "value": "T133363359717CD2FCD10A19B410A78963A7B33C6A26FE5A0F8F4089661D13B59FFA0B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511560, "uuid": "cafa9ee8-ed3c-4c67-8605-771694766748", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511560, "uuid": "6864be0b-f7b5-4f8f-a079-603629f785f3", "value": "49152:MnFQqMSPbcBVQej/hINRi+TSqTdX1HkQo6SAARdhnv:seqPoBhzhaRicSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511560, "uuid": "d52fb15b-f759-4998-b7cd-b62f51dbff5d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511560, "uuid": "d5008c0d-6f5e-45e5-8a13-1d2100eb6565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511560, "uuid": "4f00d5b6-4028-4c08-a517-5f1f93fd5c19", "value": "948e7fee5b3bb40a121561addf2b57d69db8d8ced25c1fa3fbce7aa040a6ae74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c2e213-e99f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767553024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553024, "uuid": "76351d88-ffb3-4914-8ce8-18e4a58bae3e", "comment": "Malware payload (Mirai)", "value": "3f7fb9a1a5d1de028c4623f84473496f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553024, "uuid": "d9225c23-5cb6-4b96-9323-6df5133ffb38", "comment": "Malware payload (Mirai)", "value": "958b12be9d9a505661a548098d956122f435b468832480de80c39b5efb0e86c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553024, "uuid": "31528f63-8535-4311-9563-57c4797f2604", "comment": "Malware payload (Mirai)", "value": "5f0b52e9042f55265b9297deb63530deacde278c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553024, "uuid": "077bc3d5-bc9b-473f-8e99-4caccf8616fe", "comment": "Malware payload (Mirai)", "value": "e6ddcef6bd29f7d8ed0cf15d1ba95cc79bc44a7c3f1d4969f457fc0556733ad5957be0676fda1f43989e3241741cc2c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553024, "uuid": "48c3255d-8202-4f16-8855-9f7e463e3f81", "value": "T115D31268BD2F80E0F3418C338E847BDD339CF4AF4A29274124D2DAD885A8767967595B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553024, "uuid": "502f2c8c-f521-4d8d-af55-df11e497b77f", "value": "3072:G1/+3il/GaAI0xuImr/EafV4J8xABj1tvx8XhQlVJqNt:GCil/GY0xtGpfVDxAl3ZCQlVcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553024, "uuid": "bc93e04b-53d0-430e-89ce-7c2692c873cc", "value": 131568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553024, "uuid": "8d330bbc-7afc-487a-a2eb-92a0c95e2ac2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553024, "uuid": "1117323c-f034-43b5-8886-7e05f192cdf4", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1ff3da-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567178, "uuid": "8440d519-9f25-4598-8fac-095e5da0cab6", "comment": "Malware payload (Mirai)", "value": "b54f676ee339367abacf81d833a08553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567178, "uuid": "8f6ccd3f-8b2a-4806-ae82-aa20b0447c9a", "comment": "Malware payload (Mirai)", "value": "961a5826580df2bd7e9f5ba2f800369637aae808a4517999a59d71b981e4478d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567178, "uuid": "2986cd55-c7f2-43b4-9705-7e22b682a60f", "comment": "Malware payload (Mirai)", "value": "20a4458aa40559407d19a7e99d7fc3b722550e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567178, "uuid": "7c03fe29-9fbb-4eca-9835-c3f7a265ca23", "comment": "Malware payload (Mirai)", "value": "39e879ea7ebb2dcb0a79893e92e31ece33cae30cbe118861dadb1a7bb57807429b75fb725aa804bebaf0e67ac5461827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567178, "uuid": "07b87d2f-7857-4a43-bd6b-c40416555870", "value": "T15B833B02B71D0943D1672EF03A3B33E5E39FEAD011B4E684265EBA8591B1A335187EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567178, "uuid": "86a7f4ca-6d48-4823-8153-5fc4283a653c", "value": "1536:ZLuvNrwAM/WAGQ9fcwMujypgJQ10JO3X2wiZYIn6Q1KZT+iMQlF7:Mp3MuBUjJjwiZ+QQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567178, "uuid": "efd3c4d2-fcc9-4229-9add-ca2de1f353df", "value": 80840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567178, "uuid": "6cca8942-f064-4ca0-861b-a014dbfc697b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567178, "uuid": "eba6947f-715c-4f46-ad27-c5384b1adb97", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fd8bcb-e916-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767494475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767494475, "uuid": "a87c1049-283d-4cc7-a9b4-723d263d0301", "comment": "Malware payload", "value": "1e5a9f16c3c9e935ba5f481df638210f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767494475, "uuid": "3bd2827e-2b4b-40c3-ad1d-2c080bc22200", "comment": "Malware payload", "value": "963e16ff4543d1621f353634b426a64189edbfda7216b1244d3b486d17d22d1b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767494475, "uuid": "70bec12e-789a-4529-bf24-67a90b8ecbd6", "comment": "Malware payload", "value": "12b389f351a83cdfe258142685261b9d88f2e354", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767494475, "uuid": "82bcdd03-6e00-4cb3-8c08-215c3866d878", "comment": "Malware payload", "value": "4194e37072a2bf14258c7577251288eedd26327c8c024e6d5a4cccdfc171711946d83674bf6a58bb7d0455c43e04e6d9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767494475, "uuid": "836a9b32-1e90-494f-842c-cae7bbde010f", "value": "T1BA65224267F8C962F9F51F7458FA9EC31A3ABCA11C24874F9A21525EA932740ED30377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767494475, "uuid": "bf1c3956-44a9-4fd0-93d7-3d60cc70741a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767494475, "uuid": "8518c437-0a97-48ab-bc49-0931a3fcb29d", "value": "24576:0iZfkvmrIKx1rUHZXJ9FePZhlPSk6yqCLbpaQj1LcGKUrfcewtU:molAHrWRUmagJKSf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767494475, "uuid": "a6af0e6f-2b76-4226-a951-963a7b2b264c", "value": 1504872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767494475, "uuid": "5758a0fb-000e-4f84-b05e-6501147630e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767494475, "uuid": "1050967a-ba3c-444b-bca7-0d214723988d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c784c000-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516783, "uuid": "3a5525f2-80d9-4f1c-b007-ee30cc2e7ced", "comment": "Malware payload (Mirai)", "value": "a977646064d04bb58f3b9d156e8aaa6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516783, "uuid": "81224447-fff1-49ff-a9d3-42b1c5b39a5c", "comment": "Malware payload (Mirai)", "value": "9670b7aa2c68e38c9a4a109266f730e10809b835710886642e39e6e5556529e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516783, "uuid": "66aba581-4b32-4e5a-9901-8ec5fd38386f", "comment": "Malware payload (Mirai)", "value": "efb86a0120c9bd39488b158ff7834cb08656c09b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516783, "uuid": "a0b75386-e7b5-4fc4-b180-a6f3927f3b35", "comment": "Malware payload (Mirai)", "value": "92dc30e2ec1bd2a81856a3bf4c72a6703eb468a1057de80c9987c8feb81cfad2ae36fdc424177079746492b4874df14b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516783, "uuid": "4b29641f-1d93-46e7-809e-cff1590807f9", "value": "T134D3C75D7E315F6DF268C23447B38F21A74827D627E1D681E2ACD5142E6038D682FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516783, "uuid": "901f9319-0713-42df-b1dd-133547421561", "value": "3072:O64/ZMlchf8hSXsk0N8ntgXJs01FhIt2Cjrl:ZBNWtgdnh3Cjrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516783, "uuid": "d03ad3d0-4a1e-45ae-bc9a-4356d9f941cd", "value": 133480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516783, "uuid": "d1ef13db-cf84-40b9-acf8-66347e34d905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516783, "uuid": "e1feb63c-cf6d-42ec-8ba5-b79503c46353", "value": "9670b7aa2c68e38c9a4a109266f730e10809b835710886642e39e6e5556529e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcf59b9-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567175, "uuid": "e4afcce9-851e-4f5f-8aef-fb05720286fe", "comment": "Malware payload (Mirai)", "value": "13374e5b5447b95dd6e7677f8a4487b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567175, "uuid": "e02ba9b3-608c-4f17-94f9-fc6396e2e785", "comment": "Malware payload (Mirai)", "value": "96df91caba7818ea8855dfceb2a0c0d308d87c6895592401a6cee26e8f760599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567175, "uuid": "92427a31-f89c-4923-bb57-e90e71a7b552", "comment": "Malware payload (Mirai)", "value": "17412104b00009481c941a5b8680ac236b86cbcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567175, "uuid": "42d6623f-2f2d-4a53-8843-54cdcb8dd2c6", "comment": "Malware payload (Mirai)", "value": "271f2687bc0aee752f40c2177d25e75e2c2ba7a1901730c5c757cfea5d888664695ea6ee8910289140bd9f711329183e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567175, "uuid": "74bc13e8-322b-4602-9509-eb691bdce63e", "value": "T1D6B2C0CC61843084CA8D7C7C178D4A564FACA1D0BAED9B25E350CDD8B3BEA4F3859478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567175, "uuid": "f78e455e-28a7-4591-80f4-3881b142b452", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpnZqSWv9:4QlS07FUXqIYSXQKquZql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567175, "uuid": "f6f3c330-a47a-41fa-97c6-c8f9bcbc70bf", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567175, "uuid": "c686b7f1-bd8c-40e1-9abc-cb9b3b7f43ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567175, "uuid": "28b9f117-53ee-484c-8576-48347d5bc70d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c005a318-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512046, "uuid": "80b9e3fe-e8bb-45c7-8b1d-76102b8e587e", "comment": "Malware payload (WannaCry)", "value": "c2b8b099bb55f52e094d22266b6d7b34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512046, "uuid": "3be78a40-f2e9-43ae-84f9-6e164e637034", "comment": "Malware payload (WannaCry)", "value": "97071a42de7b359d9250feb08cac443933a95e9bbfbd7760435f8bda9c1aa00b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512046, "uuid": "568c8dc4-3785-4e48-92a5-483965da110f", "comment": "Malware payload (WannaCry)", "value": "655511b0af0ccfeaea514ff1eb419902707b3e21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512046, "uuid": "31aa17d6-9500-4713-b058-a1bac455a128", "comment": "Malware payload (WannaCry)", "value": "62f10dfa731e5ef1997704227d636b844ed4db20c2a6891c11748ee5ea7f8d07de54e8b52b413c0cebcb69ffa6a39390", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512046, "uuid": "c360b631-b25c-4eb3-9161-78657f35add3", "value": "T1A33623D971BC91FCD20576B494BB8A13E6F23C6D22FD6A0F9B804AB50D03B55BB50A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512046, "uuid": "74eaef9b-e615-4d3d-b901-1251a17d8b93", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512046, "uuid": "073e2e0e-a6fa-4b93-ad82-4f1c5c6677b4", "value": "24576:RbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTPVXmiHkO:RnsEMSPbcBVQej/1INRx+TSqTdX1HkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512046, "uuid": "bc5da0e2-06d7-42bd-bcc1-bf63fa2dcc22", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512046, "uuid": "25d804af-cfd3-4060-a79b-064b9ca64070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512046, "uuid": "fb8d6fe6-620b-43ab-a227-9f8cf7f05d32", "value": "97071a42de7b359d9250feb08cac443933a95e9bbfbd7760435f8bda9c1aa00b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6493a554-e9a8-11f0-a129-42010a9c0007", "comment": "Malware payload (PythonStealer)", "timestamp": 1767556989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556989, "uuid": "c4081095-d5f6-483a-8b8b-26f7f73d1c66", "comment": "Malware payload (PythonStealer)", "value": "51caf6ad492b597acd3ad85f13ccd02f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556989, "uuid": "da1528ee-bda7-42c3-bf18-3c609c9c7bda", "comment": "Malware payload (PythonStealer)", "value": "975ce7324577087376ddd373fce39f064422acc4a4555f64c34c743fd0a44cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556989, "uuid": "369fa4d9-da6c-4de3-9b52-9659c1674857", "comment": "Malware payload (PythonStealer)", "value": "f3c131c7b5994bec29b9b32601d8fd9c599cd6f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556989, "uuid": "7ef4d913-5fad-4c0f-b277-b8d3866723c2", "comment": "Malware payload (PythonStealer)", "value": "cddde5cb47fc428d6b5db6f50bd91dbcb0951c2038364193678d954cf120e25750f39a73236a8969839ea69043089c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556989, "uuid": "851336f5-0227-4156-bad5-7608d6faf8d7", "value": "T10AF63329D86720CCCB8FE1B5BDAFBAF27420BD195570905F424CF5F01F628934B96A98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556989, "uuid": "b2e39916-c691-41cf-841c-60feec8d662d", "value": "fc3b0de2e7f988c46ed9c8e46a804071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556989, "uuid": "3d0d4c1e-8aa9-468f-a13a-d9b81f4fabb4", "value": "393216:Hgp0pTOztQwq03L4vhqdlvMUjIYwrgljHGLDsUA:HgapizKU74vOMUj2+jmLDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767556989, "uuid": "bf2d8f62-5b7d-4cbf-afc5-ea2280fa545c", "value": 16308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767556989, "uuid": "756c5b08-7d10-4e8a-b742-031215851961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556989, "uuid": "6abf690a-5d0f-4738-b39e-fc3d53e516f0", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e67ee0e-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511989, "uuid": "1006d9c1-fb59-405d-a83c-c76e17d1dbd2", "comment": "Malware payload (WannaCry)", "value": "1a3b567978c8e68f7376e3ccc0983b91", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511989, "uuid": "1457f1e0-9f41-45a6-bef7-83ef110c2881", "comment": "Malware payload (WannaCry)", "value": "97e3b68b8ecf46d1aa1b11f5791f60025768700b7b2e789b99d539ed70552e11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511989, "uuid": "44b17250-d233-448b-8b67-a9e03fb3fd45", "comment": "Malware payload (WannaCry)", "value": "1415ec3defbd4f136a147c921179af3da2e281a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511989, "uuid": "932501be-12c9-4234-bf34-b5f3a0ab11c5", "comment": "Malware payload (WannaCry)", "value": "08872d842837df05cb63e5aae8b332c06c858243592b12ad05c97c78307f7d102495afa971d593b8ee9131c566ead19d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511989, "uuid": "ac356de0-d0bf-402f-b356-0b1d1b17ac4b", "value": "T1F936D3838007156CE46DCA71D2ED1BA0C92B5EA57A6CB08D6F13BA4A27F31D3F596D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511989, "uuid": "7f0bd75a-2c81-4b58-9568-851c0d625e9a", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511989, "uuid": "55525ee4-148b-4e24-a43c-4334cbd7cac6", "value": "98304:+DqPoBhz1aRxcSULpAvzUs6Q5GksluAQLeFo:+DqPe1CxckXd5r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511989, "uuid": "845b0eeb-5390-4b6b-bf5d-ca839857cb73", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511989, "uuid": "68f53dd5-0e19-46f4-a243-9c8e8de9d204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511989, "uuid": "0db34d79-7643-4310-944e-7f3ee039eaf2", "value": "97e3b68b8ecf46d1aa1b11f5791f60025768700b7b2e789b99d539ed70552e11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c60aaa-e99f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767553207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553207, "uuid": "514067ca-58d2-4a08-be8a-826b974b5010", "comment": "Malware payload", "value": "44e8e74df386a9e677bac64307ea4e96", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553207, "uuid": "27e54a9a-9bcf-4c72-80ca-7d08d7aaaae4", "comment": "Malware payload", "value": "9a66c80566dfc22aec3c2656cafb1a0a545282960804dad987a92775b4733029", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553207, "uuid": "7c4ef33f-0314-4c55-83ae-11ee846fe1ec", "comment": "Malware payload", "value": "9642dc8b9081ffd23a0e1a92b5f0fd8adf8875ae", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553207, "uuid": "47569091-3d9e-4ba3-bfbc-2733c8b64243", "comment": "Malware payload", "value": "eff2adb035cf96b93120785dc42bfd2df2bf4fa1e41ed372e206ce85acfd2ca6f96ba82fbc4274136d3a906c74d474eb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553207, "uuid": "b6436227-23d8-4170-8c96-8847c3c219d6", "value": "T1297733DE90F24B66FD6F4936CA38DA5807933F858342CD9B76547A4146B7E80E87E08C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553207, "uuid": "fec5774f-fa5c-424f-b00c-8d7c7ef3fb9b", "value": "786432:o555F/oAAxvVlp6a4J5G51JijK6mfDftLEiW6p2HrekJMlH4XFvl+SI5:K55Wddlpp4LGRcMFL5zGrekJlFvl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553207, "uuid": "34272040-8480-4078-a5af-017b2920556b", "value": 35721216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553207, "uuid": "c48d8099-2f01-4b48-bc21-cd45e270392a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553207, "uuid": "e78a8970-716a-42ab-8b0c-5ec635320532", "value": "Launcher.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9cb803-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567232, "uuid": "1d09218f-d901-429e-a2c8-605c94e4e7e7", "comment": "Malware payload (Mirai)", "value": "927d8f642e048aabff9501226f6a8905", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567232, "uuid": "b039cf84-c438-438d-98d4-c0178fe80618", "comment": "Malware payload (Mirai)", "value": "9a74b7cc1cdf5d532538f04e7f50295625eaec8b477937e416cb877baeee6ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567232, "uuid": "b25cbbec-375f-4d32-b39c-22969b1d242b", "comment": "Malware payload (Mirai)", "value": "2dd73eda4ae98e0a5b646416cc3e8b8d93600d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567232, "uuid": "275459c5-83ef-489d-8ebf-26b38a853282", "comment": "Malware payload (Mirai)", "value": "e57942d20eb36f076d5cd9455b7799590321b9db86ccb2c6f243a391b7f1bbc7c8670ba5988977bb77e6e0ef2a129840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567232, "uuid": "9a17ae82-68f2-45cf-ada3-89030aad4a14", "value": "T139431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567232, "uuid": "e5d189ac-5756-4197-abb2-8773a1eac1d5", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567232, "uuid": "051e0af8-82a8-4a07-8fae-0b990dc979dd", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567232, "uuid": "214cf8e2-02e3-4341-8365-9ecff769f041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567232, "uuid": "878007a3-281d-43f1-924e-d85232d71900", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791cdf56-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767520087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520087, "uuid": "dc2d6de0-ea66-41b9-89cc-76ad02e5249e", "comment": "Malware payload (Mirai)", "value": "5f6446ebdb26575bfc3057187c3a2f76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520087, "uuid": "543fa9e0-568e-49e1-9121-9e7e2e1d2607", "comment": "Malware payload (Mirai)", "value": "9b492cadd1638eafb59a865169671bb00a912dc4e675d08ac2fe039f1cc712b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520087, "uuid": "be760f14-7152-47a0-9e36-267167bc16fd", "comment": "Malware payload (Mirai)", "value": "63ed9c7f5086efaef74175d72e5b6f8f8122eebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520087, "uuid": "2bb10317-ef1b-4d69-a889-08d9ae161bc6", "comment": "Malware payload (Mirai)", "value": "37e58f34004de21e64a6df3c36812df1dc266f3d8e638ebdd79b7bd7743008c312066a81dc39efba51d238b71895f495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520087, "uuid": "82c4b867-2abd-49a0-9f8f-5e3462cbc154", "value": "T1A4A3614D7E215F7DFFAC813997B75B20924933D626E1C484C1ACEE011E7028A752FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520087, "uuid": "e0e6b3c8-d7ce-4cc8-9e6c-b0aec10d7672", "value": "3072:1eJr90cP+zoWf5ShdaoPUZWvm3Qus5xKeIG1M:Wr9TP5Wf5IQWvm3Qus5x7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767520087, "uuid": "613be633-90a1-4f03-af5f-930060fa7574", "value": 104592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767520087, "uuid": "64f1169d-1f82-4686-adf5-fec9a2c30c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520087, "uuid": "84516005-872c-4f71-83d7-102b67b2e45e", "value": "Fantazy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1984fc-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512393, "uuid": "e802d15b-3017-4333-becc-caf36f53cb17", "comment": "Malware payload (WannaCry)", "value": "7466794c3003384459184a03a1dc2f6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512393, "uuid": "9e13d8fe-cee3-4597-a9d2-e21a2a1e6301", "comment": "Malware payload (WannaCry)", "value": "9d2f2e85d2cb767ad0cbeb84d72d53a593971632cff5f266219932f67e6afcb1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512393, "uuid": "39cbda2d-6cee-4adf-ba1b-b88027a337d0", "comment": "Malware payload (WannaCry)", "value": "4610a47ed0b421a7d845c930ac963da2208bbb28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512393, "uuid": "b5f19376-6c75-4991-935f-3808cf632b4c", "comment": "Malware payload (WannaCry)", "value": "8fdc916204a19b8c3a0c353355d5af245eed2ae99f552679cd02d07ce1c9b53887d59936a9712a0ca3270c1d6b93bf1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512393, "uuid": "fd3bee2b-0224-42aa-9f3e-40c41fa0ede8", "value": "T148363394526CB2BCF0540EB44063892BB7B73C6997FA5F1F87C086AA0D53B5B6FD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512393, "uuid": "0ce62e0d-80ab-41d1-ad0e-8b9ad4ec538b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512393, "uuid": "024e2829-e0a2-40c9-b685-cf6c525f6ef1", "value": "98304:+DqPoBU1aRxcSUZk36SAEdhvxWa9P593R8yAVp2H:+DqPT1Cxc7k3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512393, "uuid": "ef7a08a9-03a3-4354-9707-d43d8b502417", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512393, "uuid": "4161b387-dfbf-4ed6-a645-f13b16ddeef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512393, "uuid": "19d0ea07-5708-49bc-b16a-68494ceee98f", "value": "9d2f2e85d2cb767ad0cbeb84d72d53a593971632cff5f266219932f67e6afcb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8f8eb6-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509012, "uuid": "73adc4d3-d79c-4862-ad9f-5cd2277e70d2", "comment": "Malware payload (CoinMiner)", "value": "95a3918bd17a0919bc791e260c953d50", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509012, "uuid": "59fe2e09-8065-4424-ab84-912f02acb913", "comment": "Malware payload (CoinMiner)", "value": "9dfcebde6ebd44bfda66cadf5fc2ff6e84bd630e4f0b0dcda7b1ed5fe8fa2bdf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509012, "uuid": "16f6b2f4-7dd0-4f02-a84b-77313dd7ef6f", "comment": "Malware payload (CoinMiner)", "value": "4d2ecb4c764115e008e1450d6d0339b4e705510c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509012, "uuid": "29be5edf-0061-40d7-beb6-f55506c0665b", "comment": "Malware payload (CoinMiner)", "value": "27e950daf14dfc290a55b2c30c34caa7e9a29825fb081fedd7705fdbc6656388489001357eb8a34ff49be08a44eb1a30", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509012, "uuid": "ff6a446d-54bd-4dc6-8efc-c39cb354ebac", "value": "T16316333511CBBDBE7585C864ADF8E7314EA925E29D784105FC3A0428BC65EE240BB72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509012, "uuid": "c6909153-afe5-4dcb-966f-3618e2722680", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfha:CC65sr3KrCfsYiZQgzJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509012, "uuid": "32f6cc51-49c6-4734-9b4b-9178d59f9e07", "value": 4386816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509012, "uuid": "dc840322-7b6e-4539-b247-3aeb0d12508b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509012, "uuid": "7d6b9e9d-4d98-4a05-b4f6-8be7f9a90f17", "value": "9dfcebde6ebd44bfda66cadf5fc2ff6e84bd630e4f0b0dcda7b1ed5fe8fa2bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f0b6bc-e948-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767515654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515654, "uuid": "f7975b0d-ed32-4b87-9cfa-d5c0f5481672", "comment": "Malware payload (CoinMiner)", "value": "1ab4e3f5471a6fb6ed7076ec5916d2c0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515654, "uuid": "45b182f0-d48e-4626-86f4-931d96f006fe", "comment": "Malware payload (CoinMiner)", "value": "9e3ce235e09f09b398f0439bbe27cd39e2147e43dfec771c4559f14080dc7641", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515654, "uuid": "68d933de-5b8e-4d6a-a202-732399cc8504", "comment": "Malware payload (CoinMiner)", "value": "75c350e174bd6bf6170a0ac18a31ca19eceb47a6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515654, "uuid": "bcba0e6f-8080-4924-a3fa-9acfb87d2f1c", "comment": "Malware payload (CoinMiner)", "value": "3beefa9a4c7d5011d154ef4785ce6d14e576da95ae5cdd21045aee5979b3729199b9b7790ebe6bd32da99fe8b9e2cf12", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515654, "uuid": "8a0bda18-c250-4c56-ab90-155ed1080d94", "value": "T1DAB67C73945334D8E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515654, "uuid": "e7e7f89e-21d6-49ec-bcb8-df8da75830af", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQJ:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767515654, "uuid": "adb7cef3-c883-48f6-bf90-bfd615c02e43", "value": 11206656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767515654, "uuid": "f0ad5801-091e-42f5-8217-09c445772999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515654, "uuid": "d244431b-1093-43d3-b591-25b20baee01e", "value": "9e3ce235e09f09b398f0439bbe27cd39e2147e43dfec771c4559f14080dc7641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685d561b-e937-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767508463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508463, "uuid": "2b48081e-b6da-419a-891e-77a7815b11aa", "comment": "Malware payload (CoinMiner)", "value": "491bbf182e18250d487f90e502c998fe", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508463, "uuid": "0ce5b6ae-ba19-414a-ad56-6107168a0a4a", "comment": "Malware payload (CoinMiner)", "value": "9e5b93d3095f577136717e6aae8b51fea50d66ef9123eedccfc23b8faebf6d6c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508463, "uuid": "5d97184d-b928-4f5d-8580-2721a6da2d95", "comment": "Malware payload (CoinMiner)", "value": "78e1ed34ab747c061c074c6fa945c06e78c5acee", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508463, "uuid": "831ddd62-742e-4af0-9731-a504c877b10f", "comment": "Malware payload (CoinMiner)", "value": "640dcd294639a58fe5e6ea18e4b39e659a79c34c81a905ee556609ee30d23fb151ff865ce38d7619cb16eafff1546b78", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508463, "uuid": "c5990d71-d12e-4748-9b40-c1280300ee84", "value": "T136E2F94FAD8852F4C8EBE2348617870A79B07084AB2597E75A15A1F00F62FFC5A3D75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508463, "uuid": "09cc6388-c8dc-4766-8169-71f868d823b0", "value": "384:rEHx5geP6KNpv4/AUkgWBnyybaK2MScWA4o+tK3:rEHx3z4gntbMMS+4TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508463, "uuid": "e56e1f2b-9d80-4f9e-8796-ac47d571c8a3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508463, "uuid": "f72b81e9-5606-4065-89b6-26364527eb08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508463, "uuid": "522b4873-4898-41e4-b8d0-1435ea15c5a2", "value": "9e5b93d3095f577136717e6aae8b51fea50d66ef9123eedccfc23b8faebf6d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b6efb1-e924-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767500462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500462, "uuid": "dac32916-3c6e-47c4-bd94-a7cc33ecf8ca", "comment": "Malware payload (Formbook)", "value": "adf5809fe308bfe819f6e5b247df05eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500462, "uuid": "2a41eed5-09d9-40d1-82bb-f69cc184e7d6", "comment": "Malware payload (Formbook)", "value": "9e8b389a6d2dd273e9252874bc44c2ceaffdfc6102cb204a46330c823404bb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500462, "uuid": "d0659fb1-b59a-4d0a-b65a-a8b0d86df6cd", "comment": "Malware payload (Formbook)", "value": "dd123b5abb98f5f159d030376443dce63d5be438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767500462, "uuid": "430b40b1-d837-4c8c-bd36-fe058720309b", "comment": "Malware payload (Formbook)", "value": "046f4fcdc4c64763e2fa594f19c4775820745a564b84892c83923581101a40d4c93f87218b1018c00d0a98c6e00737ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500462, "uuid": "c41c7a13-2fea-4932-88e8-69670d1a4933", "value": "T198E41205771ADA07C0E21FB65CB1E2B027B95ECDBCA1E20B8FD97DDFB0396109465252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500462, "uuid": "8f69cb65-ad6d-42fc-8106-23c290c6715d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500462, "uuid": "d1bc9705-330c-419d-9fe5-f1b7d5d257ff", "value": "12288:O8o7mIrXK6vPmSGziyRmBDn6VhYFyfCQBL+tJLzxeBgd8jTing98Bc6:ODy0XZwJ+D6DN68+tJLlQx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767500462, "uuid": "2491f8b5-93a0-40ec-b48f-abaacb25e1cd", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767500462, "uuid": "91a34553-becf-448b-a98c-374661b72e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767500462, "uuid": "f6220dcf-4918-46a2-a47f-6c0408e6c365", "value": "MV MARTIN NEW SPECIFICATION.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bf25b1-e935-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767507623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507623, "uuid": "05ed15c7-02f4-4f6e-96a3-5d6b42a17630", "comment": "Malware payload (Mirai)", "value": "e2d9d09de0da60b37bf485dafd26a1bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507623, "uuid": "21573c96-c586-4f7f-a151-3e51ae736589", "comment": "Malware payload (Mirai)", "value": "9fdcb6a330b1ff9099f2b44f9fa94c60a6ef25a1bda1fbad242f1fd0cbcd5ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507623, "uuid": "3f71add4-7b7f-4bdf-8398-5941c0b7c387", "comment": "Malware payload (Mirai)", "value": "29ef3a0b1c46bd48cd89e8be322dcb6c237829be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507623, "uuid": "81eacc88-2022-41d3-88c1-c97cfa7468df", "comment": "Malware payload (Mirai)", "value": "3791cd2f358d57af76c10fea9436099239adfc1c4d1ceafd4b02ebce2182892db61e8a753d72917d3b199471ac717fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507623, "uuid": "bba18199-581e-4a12-978b-6aac7bb90075", "value": "T1F873016DEA1927D0C5310D31A0DC2B606D3DF5C0033A8E5EA22D9CF9EF4C87696660F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507623, "uuid": "6e4fa72e-d674-4ef6-b133-534830c1687d", "value": "1536:HiNnqKxdbnutez1ehkEwkfR0GyV96XNTrloR1HKr3:CNqinuuehrw00DudQHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507623, "uuid": "9eee1d93-3428-4f55-9a40-dcb534a5abf6", "value": 76060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507623, "uuid": "13bcf520-ec88-4646-baac-1fddb2da934d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507623, "uuid": "fcc57f07-fbbc-4a29-81a6-03f72acde89b", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d9b0b1-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509259, "uuid": "d0cc0504-c695-4098-8feb-cd34cc5d1df9", "comment": "Malware payload (CoinMiner)", "value": "ea2f18d1fcd4b197187db8ecb35885dc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509259, "uuid": "8ac73202-bbd2-4407-b573-b4d66359ab2d", "comment": "Malware payload (CoinMiner)", "value": "9fe7882d29c802c1b15fe8a25a72a738e252bfbbefd86c4b9b7e0b7538e3b888", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509259, "uuid": "3bf62d47-8e24-4d5d-9325-ceef79992504", "comment": "Malware payload (CoinMiner)", "value": "6639fc531d9d7023e6fb04c6fd38c2c9aac0e9f4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509259, "uuid": "2a3269a9-8e0b-4824-89fe-0f0b423a9eb7", "comment": "Malware payload (CoinMiner)", "value": "529c0f101630f5c9f408ac85b37c95ad856ff09a7f17f84b6c0709c4359d55fbe60610f1e736b9d8aaf66dd4d89a2373", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509259, "uuid": "d9478742-bd9f-4f9c-aebc-34eedf92c4d9", "value": "T14D06336201CBFCFF5985E47844ECBB320E5655F19EAC8555F929082ABC25EE3407A32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509259, "uuid": "13f0bf06-4d5b-484f-a4ae-647b68230c91", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZ+:CC65sr3KrCfsYiZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509259, "uuid": "6169d80a-3b28-46b5-84b7-8ea76aa8148e", "value": 3719168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509259, "uuid": "c01cf45c-b3c5-4ca3-bfdb-39ffc4c49aa9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509259, "uuid": "80f1b5fe-bc48-44ee-aeda-fa3dac4b4e16", "value": "9fe7882d29c802c1b15fe8a25a72a738e252bfbbefd86c4b9b7e0b7538e3b888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d08198-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512210, "uuid": "9408cda5-e706-4122-8264-810c8340e1d7", "comment": "Malware payload (WannaCry)", "value": "5660f5a86117f61d1a92e63405131c30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512210, "uuid": "f978378e-d493-427d-88c8-fb5c2b337f7b", "comment": "Malware payload (WannaCry)", "value": "a0ddd0d6596fdca886ac2892224dc2905a594e96663fa551c3193f420217dcb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512210, "uuid": "341c2200-1d43-4170-a152-43b52a220ac1", "comment": "Malware payload (WannaCry)", "value": "2f41c8cac9e3b146631dbab6a9fcf01a3b54d918", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512210, "uuid": "41260b30-d073-4ad7-8391-11a8cd97297b", "comment": "Malware payload (WannaCry)", "value": "664226f37b264ed1b65377d0989b9f57eb612d0d0f07727ab95959f856bfd174ce700ec870ab0ff972c442a1485a16c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512210, "uuid": "b0e38685-e29b-4be8-9318-9fc1002e6794", "value": "T130361252D6991EA4D5E10AF61266DB10973B3E1486AFA72F2721015F0CB3F0DDEE4F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512210, "uuid": "7b8c8f9f-278e-44ff-9800-16df25f78a48", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512210, "uuid": "6663d39c-cbd6-498c-8854-8f23e132e552", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Y:d8qPe1Cxcxk3ZAEUadzR8yc4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512210, "uuid": "ec244280-7179-4cf5-8e9f-d53e6d01e7ff", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512210, "uuid": "bc97c817-8d87-4e5e-8c14-c4d8884174a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512210, "uuid": "37525e75-8595-48b4-87f4-89d06efa1689", "value": "a0ddd0d6596fdca886ac2892224dc2905a594e96663fa551c3193f420217dcb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964fadd3-e978-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767536457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536457, "uuid": "f327a21f-45c7-4db0-b875-cf4f94ac85b6", "comment": "Malware payload", "value": "9ae589d9981c77180eb537e9075cf2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536457, "uuid": "d424e911-5fb9-42d8-9dd2-a3914455a946", "comment": "Malware payload", "value": "a11a9b608b71bac57ddce7df96c677244392abc9ee6bfee5395cea85071f6ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536457, "uuid": "64b7140d-d43f-44b1-ba06-317326c1cd46", "comment": "Malware payload", "value": "b9f525ed84413669aa28cef3fedd149f3ecac791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767536457, "uuid": "e187915b-088f-4e41-9948-a9a792320a12", "comment": "Malware payload", "value": "93673ac233a20c4a261953ad739320b7ae98df316761ed2b9cc37039aa0b79f4818959d85f4e14f6cebe1830ea00a90b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536457, "uuid": "e272e41f-6e13-45b1-8741-72946742caa3", "value": "T11406BF45B3D819E5C527DA35CB14E332C2B1B9224B76D18B1A9AD3062F77A624F3FB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536457, "uuid": "edb2374e-02a4-41f6-a9b8-6f938ea604a8", "value": "05b20b9642c5e7e35437a28b5feaed21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536457, "uuid": "8c7717b1-1a4f-406e-93aa-c584ac32f697", "value": "98304:JSgcFGfZSh4JSwcjvvgdSAFUa8vVYitoVsbXvlgC+aVr6U89MnCsj:IgcCEuS7j/ARkYit9XtgCBpf89MCsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767536457, "uuid": "d6285974-f596-4d48-86b2-6ac7386baead", "value": 3803648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767536457, "uuid": "ca33945a-2ae3-46c1-b8da-5f2f4f807bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767536457, "uuid": "cb12034c-6963-49a1-8974-8098a99b3e1a", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f18d66-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512651, "uuid": "2c6e9956-219f-4b1f-b7ba-bdd27805ee2e", "comment": "Malware payload (WannaCry)", "value": "a8a5c12f33434b1e14ae51d3da98eeca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512651, "uuid": "bcea7815-e4f6-4740-bdf9-7ccdc9f22208", "comment": "Malware payload (WannaCry)", "value": "a2459c89d088ac40f5d8d2ef90ea1d963c7f85c58b7e73506b0c7a1cfacd9b86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512651, "uuid": "d03dace2-3d1a-4bc4-a5e6-d834517d6471", "comment": "Malware payload (WannaCry)", "value": "6a994c0db46866c18e801dce8ce2e5fe11051c8e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512651, "uuid": "ddf282d6-44a4-4a7a-bffd-bd42e11f3616", "comment": "Malware payload (WannaCry)", "value": "abbee19390da28524327cd459e20be5606794998017938385147fec079e9d931a22712507936c7924f79677261f88b56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512651, "uuid": "8e13a926-eeeb-4380-ae8e-a94c200effbc", "value": "T14C363359E918E76CD16A1BB000734B2AB7A23CD9C3AB591F87984DE50C873B73BC254D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512651, "uuid": "90f9472a-d343-44fd-947a-5d71e69bc7f5", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512651, "uuid": "945033a3-0c70-47fc-893b-aa02c8a63c3e", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yA:d8qPe1Cxcxk3ZAEUadzR8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512651, "uuid": "2dca9d5c-cd84-4567-8eb5-5aaccbd171c8", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512651, "uuid": "c6cfdca2-d483-4bfc-b3e1-5d4766b8fc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512651, "uuid": "c8d00aa5-07c8-4d41-992b-f427b2129e96", "value": "a2459c89d088ac40f5d8d2ef90ea1d963c7f85c58b7e73506b0c7a1cfacd9b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2b23b0-e94c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517681, "uuid": "8e29b3e1-fbb9-4bce-a21f-9a4c30b18142", "comment": "Malware payload (Mirai)", "value": "a5751f98fa5dba426de5852cdb6fbe26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517681, "uuid": "a8ca4776-69e2-4553-b6dc-60616d46837b", "comment": "Malware payload (Mirai)", "value": "a25c180db1c0bf0c233bb7cb936b6a6202e6b5e3ab792d3bfb198e4aeab94dfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517681, "uuid": "9acf15d8-b61a-413d-b5ed-dea2842c32ee", "comment": "Malware payload (Mirai)", "value": "a9ac0820ee10ab50611857b5ef0ec00c387da592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517681, "uuid": "fd587b1a-e657-4ab2-820d-7aeae40ad694", "comment": "Malware payload (Mirai)", "value": "f9e562bcf91cc567174d7072172a85eba535fdc21f05a1c6ed9ddf74bce3fd2514ff119ceecf32c79ee5078d50d5dc6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517681, "uuid": "359df5cf-5e1b-4b41-a8fe-283863b31b90", "value": "T181834A86E793E4B1D84711B101BBAB798A31FD630630C91AD7A0BFF0AD316D1B65632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517681, "uuid": "a79fa23c-c749-46a3-92c2-a9989724708e", "value": "1536:JUr6rig+UFP+yhgwQxGFGq26XUm31MjPpgO5ohY93yt9d01QMLr:I6r+UFPtTQxv6xe1UKyQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517681, "uuid": "92620f50-a7cd-4d4b-90de-aa188945a94e", "value": 86764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517681, "uuid": "a78a49aa-c74b-48dc-9e51-e74ec3aa0c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517681, "uuid": "cd0b872b-48d6-4c73-9eb1-e3f287b06342", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33bdaaa-e9b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767561470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561470, "uuid": "26e7e2e5-1f5f-40a7-b945-505e32cd56f6", "comment": "Malware payload", "value": "0ceec323b2e060b1aedbaecb3cb92344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561470, "uuid": "428feeb0-8946-4ff5-a031-2f295fad09e8", "comment": "Malware payload", "value": "a365108bc29832306b0d5381791c907b53d32a185d0b6d98fac57bd6cb49c846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561470, "uuid": "b6e5a312-e85d-4662-898d-986b6a803090", "comment": "Malware payload", "value": "611894a869f6cacf33cac76d6662ef58b91abe8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561470, "uuid": "3cf0bdce-ac77-48a7-8e49-cb4fb47c4491", "comment": "Malware payload", "value": "82c15613e101aa0e80a9ccc9e33bb1ee7a7f026f6ab0d35ed8544f8720a7ba708d30f0022f16623841c84348cd8a414e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561470, "uuid": "d8396bc1-ab3d-46d3-aef4-7fd7b1b46e72", "value": "T139E64B93AE444326CADBD23AD5A152496634B045133111DBBFB8876A8D1BFC8273FB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561470, "uuid": "a6cc06fb-cb76-4692-81c1-73447a251aad", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561470, "uuid": "21eb90f6-e794-4020-996d-e2e5750aeca9", "value": "49152:oI04Qdrb/TnvO90dL3BmAFd4A64nsfJ/WkWtoz/vZqem6BhWI5FOkwqqgpf6Y0in:oIuk/Wcm0LLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561470, "uuid": "62d6cf24-9667-4bfa-802a-853f46d1aa25", "value": 15056512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561470, "uuid": "2ba1aa4e-8e80-442d-bffb-4dce78249237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561470, "uuid": "46bf61ff-cfcf-40fd-9eb5-4416dd7ff627", "value": "Boootstrapper-SetUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6de98ab-e99f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767553343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553343, "uuid": "3f097c18-555e-473c-bc9c-7b502dd0fe83", "comment": "Malware payload", "value": "8d3b1492e414e8c661e5e9787b73c25f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553343, "uuid": "2d550bc6-878e-47fe-a667-a1c8c77790af", "comment": "Malware payload", "value": "a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553343, "uuid": "092b2da1-9618-4cac-8849-d2fe455c4b79", "comment": "Malware payload", "value": "847eeb41c1a7891cd201e2587aead02853515d29", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553343, "uuid": "324afb62-3c65-48e6-b450-5263829c01c5", "comment": "Malware payload", "value": "69d6354a08cd95e304507a8da41d00634e68259d3f7204034961ad5b9bcbd386fa6deedeb7da902d0c034bc2760bb3f3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553343, "uuid": "086b6659-8214-4fb8-9479-d5c7940a9030", "value": "T1F52110CF54B4B5795088CF8032A254C570F4CAE1E5604E1B5EC878F785C8A1B7739EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553343, "uuid": "38b82510-ba01-4e27-87c6-11d84e1829ea", "value": "24:cj+ELbMfVEcFLNIZEtaDEVKTXCEHw/EOFELM9METQP3E3etbEKxeEzqgE1MdEk8:yS5/QXGFXpcEevBw28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553343, "uuid": "3fa9b22b-27a7-4d0e-9958-70ae3100ef1b", "value": 1345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553343, "uuid": "87cec5ae-71ce-4cb6-86b8-0a21f883b7e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553343, "uuid": "b0b617a5-aab5-4c41-abc8-71e43aee43b1", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdf83e6-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767513092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513092, "uuid": "94969a46-73a8-4b19-9751-e25b6d1b4476", "comment": "Malware payload (Mirai)", "value": "2abe9d933d6821e118fadbaadddfa44c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513092, "uuid": "282fb25b-68e4-4641-84cc-cb73c9814968", "comment": "Malware payload (Mirai)", "value": "a42161b549e195e089a366d0af84416f0eac685cdf0079def5b5f70b61207eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513092, "uuid": "b125c9f2-b6f5-4687-b339-f5aaa1c57cae", "comment": "Malware payload (Mirai)", "value": "2ab210353eb9c6970278b7a7737b1e971888fc8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513092, "uuid": "8f8f9a52-c7c6-4a38-97ac-2179ed8f1455", "comment": "Malware payload (Mirai)", "value": "71cba560b6e3d60b0f638b54542662ce75f1f5c49e9fcecbb88430eee2a3d1c9d11ccce9e819709405c9f38826de906f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513092, "uuid": "cd6d1dd9-3f71-4991-b5ad-eda71699c106", "value": "T1C2F39D33C9A5AE98C6249474E0B1FE795B539A0641871FBB1AA7CBB54043DCCFE043B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513092, "uuid": "f1fb1c55-d2b3-4d9e-aa3b-0a94445e537e", "value": "3072:nJqn73FvDaOmynee0PI71NGH19rVCUQLhQhWjEKpGhm:nJG5aXeEH19M1QsjvGhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513092, "uuid": "5d46372d-d8e4-4816-ba18-27c89e13836f", "value": 164704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513092, "uuid": "a03f6f59-eebd-4dd6-a686-d3b7f3bb8bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513092, "uuid": "6717c7d5-f48d-4c46-a863-3393a2aa90ef", "value": "executor.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c81850-e901-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767485182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485182, "uuid": "06b087ee-d082-42b4-8713-f30d808ffc5a", "comment": "Malware payload (Mirai)", "value": "c0fb2a1d961a7584f05e8efdd62b4687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485182, "uuid": "1ea499e5-98f8-40c4-be02-730b3f6bb2b5", "comment": "Malware payload (Mirai)", "value": "a448a233d175276ab77aa4cf9fd63dd02f9e6fd5f4ee160ce99f177df7d27d11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485182, "uuid": "4ab0b004-b788-4396-ae49-7839b257c700", "comment": "Malware payload (Mirai)", "value": "9a82e4285b10ec12d028964b5b45554435bf3fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767485182, "uuid": "2b6ff6f2-fa30-42c7-b26f-de7cff774640", "comment": "Malware payload (Mirai)", "value": "d555653a74d634433c7546979a9a08866230882857af260aefee12ef2c42aef9296da27ec60114d7ebd1265c0fe8409c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485182, "uuid": "c4d5a4c0-9961-41fc-adfa-e6e387705130", "value": "T179E3AECBF1578851C42183F427CB5BED6AB762158D6FD4F32C4E967B29790CB0822B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485182, "uuid": "c4febd63-3b73-4662-b9a6-590dbd988dfd", "value": "3072:oOmkLYQvoLYGc3sb7jzotxpiOzIg2jRg7qYDs:o49voLJF7/otxpiOQcqYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767485182, "uuid": "8930ed8e-ff88-4d2c-b488-20d755aea8ce", "value": 154292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767485182, "uuid": "72e5904a-ee4b-4484-935b-159b0035095e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767485182, "uuid": "fc14ab0a-6ab8-4d4e-aca3-ba01b20f1427", "value": "rondo.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e7941e-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511708, "uuid": "f04fd808-4c90-4327-a76a-7b0fe73db36d", "comment": "Malware payload (WannaCry)", "value": "d88af4a1a1efa273fd33b262696f530e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511708, "uuid": "e0993416-8d03-45e5-8962-6f787c79f0f6", "comment": "Malware payload (WannaCry)", "value": "a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511708, "uuid": "5c75fe58-d624-44c3-86b1-4d24b1d3e6b4", "comment": "Malware payload (WannaCry)", "value": "4f78e93b059758f62216313355a5233d0da314a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511708, "uuid": "c7e7d1cf-2031-4060-bd4d-039cdbbe9655", "comment": "Malware payload (WannaCry)", "value": "b4835e2fd35af52cf8a528be95d9daef4d5a21620ecbe14c8c695f7fa76f33c4a5062528d4f32618e9b3c85339b715b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511708, "uuid": "17eea21a-5490-4832-ade4-0959ede92dc1", "value": "T1F136334574AC51F8D1450BB8A4B78B56B2B77C6D21FA9B0FAB4087352C53F41EF98B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511708, "uuid": "f3f11da1-dbcc-4263-8539-935c4f2ab67a", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511708, "uuid": "40bcb0e7-5822-4c6f-8d6e-1061c47ff779", "value": "24576:ubLgurgDdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvctA0p+9XEk:unsEMSPbcBVQej/NAARdhnvoAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511708, "uuid": "aabb1d6b-f716-4aa6-bf65-03048fa13a4e", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511708, "uuid": "8e8196a5-7621-4301-8971-48547982a562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511708, "uuid": "41b295c0-b56d-4fd4-be5d-78d08a8c7a72", "value": "a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7597e1fe-e98e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767545851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545851, "uuid": "85e3b4c0-99d3-49ea-9b28-2d8b7c37b0ac", "comment": "Malware payload", "value": "055097a2e6fdfa0dd7498532926c4608", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545851, "uuid": "b84f5e2e-e808-4bfd-8cd8-4f84c9eb9e15", "comment": "Malware payload", "value": "a518857c5a8bdf39feb92ae310d7f296bebffbc0aa017ac05e2b138a6c73367c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545851, "uuid": "a93e7dbe-a795-4d4b-92af-9c5ff412123e", "comment": "Malware payload", "value": "aef5f5d2aebe60b655ad3827a17a7481240115ed", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545851, "uuid": "ce208ee6-2162-4a62-89ed-9da052c0e87f", "comment": "Malware payload", "value": "ed632634af07ef80e26bae63399a71ae0686e7d821db7302b0b957be7bd56417dc436f3e411dd3b8d8b412777de75f81", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545851, "uuid": "4e70caf8-ede1-4f5d-bcbf-55510f6ba640", "value": "T1FF77338B9C76AB4FC17BE4B98C24165A83252E54CE13A037BA60326734F3BD176B744D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545851, "uuid": "f64bb9a5-6380-47d0-a113-82d232b6fb03", "value": "786432:MfUY5cJ3xX+68Qj8HRDLfRutrBEecs0vKN0HE/n4:Vrv+6zORhvw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545851, "uuid": "0cd85224-6631-4cda-8b5d-063ac9de3dc6", "value": 35713024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545851, "uuid": "60808a18-6d46-4022-8c04-2f331a8b4ee0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545851, "uuid": "768e3662-922f-4b4f-aacd-6bc80ff13fae", "value": "Overrule.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60c68f9-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511573, "uuid": "0ea9c702-a3b4-4abe-ab15-f3b22d78ffd4", "comment": "Malware payload (WannaCry)", "value": "3ce7baba17fcf32f7310e9ab435b9511", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511573, "uuid": "10f7558e-42cf-4cd6-a42d-73abfba3729a", "comment": "Malware payload (WannaCry)", "value": "a5bbece16747a3e413efac322ff1d92a46bf8d52ef277152c952ceeacbb4ad03", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511573, "uuid": "a5eef090-1813-442f-a841-04edb12b103b", "comment": "Malware payload (WannaCry)", "value": "0ae5539649991febc7c0e4d8f38d629f45b3bdf1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511573, "uuid": "a8b6301f-20ac-4a62-b6e5-81e17e132514", "comment": "Malware payload (WannaCry)", "value": "f6004fea536dd1fdcf8ba0785de771e041f6ad085a03acda8ac88de8f3635686f80e4349dac127035968ac149b9f0a38", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511573, "uuid": "b6efa63b-be47-4c86-a82d-4f785a3abd9d", "value": "T1AA363394622CB2FCF0440EB44463896BB7B73C6967BA5E1F8BC086670D43B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511573, "uuid": "ed66b452-de19-4848-8cb3-340bceb49be7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511573, "uuid": "5f843082-2ed0-4703-9640-e35d16c755c7", "value": "98304:+8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+8qPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511573, "uuid": "68c93e29-35ea-4887-a048-26e2595625f1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511573, "uuid": "043955b8-2be7-4140-8d1d-d3eab7f3ff80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511573, "uuid": "1988ef7e-4474-4c91-924e-bcaf7740dea3", "value": "a5bbece16747a3e413efac322ff1d92a46bf8d52ef277152c952ceeacbb4ad03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abcb46f-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567147, "uuid": "a6ab92a6-ced1-40ad-8233-f967fb0b0b1a", "comment": "Malware payload (Mirai)", "value": "e7e97bf2bc6787096802298d84770b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567147, "uuid": "390ba2f4-f92a-4e37-88c6-9778504a3339", "comment": "Malware payload (Mirai)", "value": "a5deb7f7975f60df65e86cd62fde23bca3aad63036846901079ec35412cfb7a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567147, "uuid": "050e7229-0613-45ec-a8e7-5cce0bbda3b4", "comment": "Malware payload (Mirai)", "value": "0d409e839c73bec61d0007d72080da08fd67ea81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567147, "uuid": "58d4fda1-c6df-4ff6-8fd7-5df22fdfafb9", "comment": "Malware payload (Mirai)", "value": "f371f0b3555d1dbd7872f14364b030693e78dd0f8b9953178a4d0dfc82887e731293b41de24d005bdbcca756e8a82178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567147, "uuid": "76f78c9b-7d4e-4196-a451-3162a2094839", "value": "T16F332B97F601AD3EF99BEA7F84134A0AF13077950093073A63B6FD935D322949D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567147, "uuid": "dcedcef8-7749-46c9-8ca2-f986a4dc8587", "value": "768:y2eNjCsDZxwjehgzQoXRrpw6QqgOb8I8uCQwrxJbBwjG/cT88bQuL7:PQjRwjN8MR9ziI1CQ6JbBsG/O88fL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567147, "uuid": "2e7c4b5f-5198-445c-b910-f499e46fdaf4", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567147, "uuid": "42772b62-dc08-4331-a913-99d52e755123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567147, "uuid": "287e2b90-c0ab-4968-b995-fedf2d73cd5e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305d0f93-e989-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767543587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543587, "uuid": "cf743e37-9cc1-45d4-8660-b7854213554a", "comment": "Malware payload", "value": "cf733bade7107b814395fd70aff4f10a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543587, "uuid": "95c0df56-658f-4eb9-aebe-2f61cd0170c4", "comment": "Malware payload", "value": "a6083ba00421b3131a0f9c2722cee88f4ab4707c41fc1c961cf2316e9e18b325", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543587, "uuid": "2862fcd6-be60-4645-87e2-846ab75ca786", "comment": "Malware payload", "value": "defb846a8150c043e6cce8f67b8a4b8b5cbf1e72", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543587, "uuid": "1a620143-34c7-40fb-a022-771426cefa15", "comment": "Malware payload", "value": "204f3e3b55a250f147135af7c623aa8a5a31cd5beee5b92e83626195a364630bca2616539b48cd5389878c0f0ff019cc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543587, "uuid": "d22d5b7c-acc2-4f33-a616-8e3b573ccd15", "value": "T16C651256A7E8C023E9BA5B7499F96AC31A76BCA11C30876FAA45554F4833B04DC3133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543587, "uuid": "4e794489-0701-48d8-a246-f4a3aefe0583", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543587, "uuid": "f92aa2b2-8bd0-446f-95cd-3f06a4f78246", "value": "24576:/uqOcfbNMJ8THLKSrbabRCijLAme7mcPlt/fqMSKhp5c347w0wd9:LSuTHHA8ijLY7m4/fqluk47S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767543587, "uuid": "f03d0785-8644-4180-9e3b-de1cc114227c", "value": 1517680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767543587, "uuid": "30d6f8e9-2760-4bc1-b377-3365b05a2642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543587, "uuid": "6d764af1-5a13-4f8a-b45f-b8fc26286ac1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9070640d-e937-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767508530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508530, "uuid": "3f18203d-095a-4573-92db-2c55ef54bc1b", "comment": "Malware payload", "value": "b41dd4d67d2552bca2c50399fc8e0596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508530, "uuid": "9f72e294-4dac-4d83-85cf-2b99169bf733", "comment": "Malware payload", "value": "a67db7889b2bb834b178bd712724b0a2b636890eadaad917ce6256975cddda3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508530, "uuid": "f59c1816-67cb-44ef-9cf7-74605b6db383", "comment": "Malware payload", "value": "a78d66f5298c7941a508658582ec275a9d475821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508530, "uuid": "19a6abaf-8e24-4019-9d48-454938ef1bfb", "comment": "Malware payload", "value": "6d008c67fef69fc4247d1f29858fdc571a6e4a6fc68988f8841ba28476f1cd0e7da5834fb4908ac4053eb856fd63e243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508530, "uuid": "d8dd4e74-4c8f-4141-9210-a5b274ab4327", "value": "T1BB93032EF69E286CC1DA73F86680795747B1FB5C18F5F2A8F28015245BC3A5D093DAE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508530, "uuid": "1b9f0d12-4112-45c0-9033-09bc5f4420f0", "value": "93a2cb46498dd087591be7b46fffbe45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508530, "uuid": "661da611-cf81-4879-a237-68483e4964a0", "value": "1536:jwmSdKWNE7bhGKI2rq+ldo/VHPCh5WSU+wdyf/wj0JCsC4j6SsWW+6iRC6+zS7pd:jnWabhGKI2rq+ldo/VHPCh5WSU+wdyfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508530, "uuid": "494bdbd1-4517-43a3-8f92-2c26fe813967", "value": 96276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508530, "uuid": "09ade008-d4cc-43b2-b397-b1b82e86d69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508530, "uuid": "f8150dc3-adfd-45e4-8862-f91de02a9cfe", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c10a8e-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512322, "uuid": "1694c14b-8ad9-456a-8b83-4f4d5f419a79", "comment": "Malware payload (WannaCry)", "value": "c3d8b9d5bb048eebca994cdce641f885", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512322, "uuid": "3726b768-2ebe-4dca-803a-b7a908d517cf", "comment": "Malware payload (WannaCry)", "value": "a7403107fa5ebed299e06eaf5a6e04c1df1ffc794a02db4b464374be82344559", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512322, "uuid": "51ffa65d-ec21-4191-bf23-513e6d2d707b", "comment": "Malware payload (WannaCry)", "value": "283482c769ed415b10bddc209836dc6c0e1ba1db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512322, "uuid": "ddc0b05d-f67f-47ab-8afb-a8ce6e4c01b4", "comment": "Malware payload (WannaCry)", "value": "0d1a02540a4f3e1dba69e1c6642803a17f34718cd8d2dac962d85f7e5bfb031605511ea9c385e9fb7e150809e077977e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512322, "uuid": "be31bb57-9f24-4100-b17a-eb53b6a71422", "value": "T139363344E2AC66B8E1A10EF504B38B29A7773C559ABA9A1F5380415B1C73F4EEFD0F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512322, "uuid": "15189e4d-8f38-4e58-a2db-ccf380cd3417", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512322, "uuid": "9aac435f-8bdd-4520-b576-9b8254777fc3", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2H:+DqPe1Cxcxk3ZAEUadzRkc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512322, "uuid": "9c8da138-6dee-4ded-a1af-1d64c78b0b01", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512322, "uuid": "829e1f9b-01e4-47f1-8a68-d0669ba1dab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512322, "uuid": "0f24aff8-25e5-47e7-bbd4-d5af4cc36237", "value": "a7403107fa5ebed299e06eaf5a6e04c1df1ffc794a02db4b464374be82344559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ca5c08-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767520088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520088, "uuid": "fd0c2745-6755-4861-9166-e8465a75e9bf", "comment": "Malware payload (Mirai)", "value": "875d8b4703425700a7f16242f990caac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520088, "uuid": "c66b4332-9ed2-461c-a42c-536d110ab1c4", "comment": "Malware payload (Mirai)", "value": "a7614efb29ad9b64a8970c9ea8dfadb0f79f6858a30524635c0cb084ef39e72d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520088, "uuid": "ed9955d8-3d76-4e4c-b53b-766000a84832", "comment": "Malware payload (Mirai)", "value": "f11cf1fc2f0da4f874e228b7721c1e47f4306d7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520088, "uuid": "2d563047-1c64-4f40-9a6b-25f917ee3cab", "comment": "Malware payload (Mirai)", "value": "792a1cf07975ba2f4d9c39c025f4c397a2413f769a21d6f8057b9b08ab5d82a5880082b857ba004b094c89d9a74cadea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520088, "uuid": "e9378c59-b305-4bd1-a260-7fc0038e52a2", "value": "T1C8734AC8A5C3F9F5EC110979307AAB719A77F43FA179EE97D3A82533A901202E10175E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520088, "uuid": "315226e7-350d-4f4e-9b98-9fd288d956a4", "value": "1536:hFlQjJcUuoWQKhru9fLc4VoD7yB89cLYHOYvP+Q5Z+h5bGeTiS97s/:zQJcToWnhSFA4VoD7yB89cLkOA+CIjhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767520088, "uuid": "827888e9-b463-4cea-8404-ff36f846464f", "value": 74544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767520088, "uuid": "a0eefa8d-c1ee-48dc-bce8-4551a2ba036c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520088, "uuid": "0d259656-e562-4d0f-b0bb-92451bef2111", "value": "Fantazy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640c89bd-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511032, "uuid": "00287eda-3276-4114-b13b-2842abf6d745", "comment": "Malware payload (WannaCry)", "value": "5297a5b1237678eebed343d530afdedc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511032, "uuid": "8c4b9013-5f8e-4f3f-8051-22d92e8a593a", "comment": "Malware payload (WannaCry)", "value": "a7840762bb587763e3494e1d2cdbb3d168b20163772736201a1cd4c9a3fa0184", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511032, "uuid": "9bf7a591-c50b-41c9-a50b-9d1cb0ec6d4f", "comment": "Malware payload (WannaCry)", "value": "49e40f0cee7d831e9938c5cbd64b7382dff5c977", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511032, "uuid": "e6a411e4-e8ef-4ab4-91ef-e96a07dda6fe", "comment": "Malware payload (WannaCry)", "value": "69dd8e0a042c640fc24fe20d2deef93f90cfe917bfdacd5fd35b8f398d0fa2b69aa97e58f2309d60133b92e0eec53a28", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511032, "uuid": "249cb171-83f2-4bad-8abb-26eb313dc1fd", "value": "T164363319713CC2BCD209197400A7C967B7B37C6B56FE6A0F8B404A6A1D53B58BBA0F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511032, "uuid": "4a466dd1-20d2-46de-8996-8b61db27b870", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511032, "uuid": "f0ee9560-6e60-4b14-9605-6318e10e6460", "value": "49152:MnFQqMSPbcBVZGINRx+TSqTdX1HkQo6SAARdhnv:seqPoB3GaRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511032, "uuid": "d5b8d6a7-d0b3-4e02-8f2b-084b4815b00c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511032, "uuid": "cb7b0cda-c8ad-4867-9482-263a4faa96e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511032, "uuid": "6a849715-4fc0-42e1-ab76-53470e2b88c6", "value": "a7840762bb587763e3494e1d2cdbb3d168b20163772736201a1cd4c9a3fa0184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e60326-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509205, "uuid": "66140a0f-910e-4e19-82e3-48627463a9f2", "comment": "Malware payload (CoinMiner)", "value": "bdae50c709991e3d6afa67c627bc7224", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509205, "uuid": "3abaaa45-533a-410b-b140-7c0d2100e030", "comment": "Malware payload (CoinMiner)", "value": "a7aab3fd20e00d419a18921fe29e80e799d2538840d0e86bbbd657750d8cd114", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509205, "uuid": "1cfda665-6bf1-4251-b87d-d286264d208b", "comment": "Malware payload (CoinMiner)", "value": "603987cb2b1c59313bc5310612a168a9a931f1c7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509205, "uuid": "0cf09f36-adfc-41e3-97c6-6ea9b113c50b", "comment": "Malware payload (CoinMiner)", "value": "650255290be759acd3863cd2b8c00edc5c839821325e9024558f666a9717c8e08732df12d322d8df64089d792e61d40e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509205, "uuid": "ca8267d8-4a63-4e96-8b9a-fa08f6386030", "value": "T15A06336202CBFCFF59C1D47858ECBB360E5651F19E6C9125F9290829BC26EE3407A727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509205, "uuid": "6a6ae422-d4f5-498f-b8fd-59288e25f4c1", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQW:CC65sr3KrCfsYiZQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509205, "uuid": "7e9cd986-c6c0-4932-9bec-9f63060ca86d", "value": 3837952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509205, "uuid": "68688889-4932-44c9-bd7a-dcfff6fdea08", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509205, "uuid": "fd3a4c7e-fd70-45c2-93f4-a3bbde11b38b", "value": "a7aab3fd20e00d419a18921fe29e80e799d2538840d0e86bbbd657750d8cd114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65775ab-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509506, "uuid": "9f30e0cf-d384-48ce-936f-e7e8ad7ddcde", "comment": "Malware payload (CoinMiner)", "value": "3218af37f04c7ae875407c5ff7922e69", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509506, "uuid": "140fb726-e033-4fa9-bab3-c70a73663e91", "comment": "Malware payload (CoinMiner)", "value": "a8c7a912b7b737c561370e9d08d69c121dd7de3775fa35aec887b2bad297b555", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509506, "uuid": "8602ed18-6e38-44ad-972f-9b7b74d245f0", "comment": "Malware payload (CoinMiner)", "value": "bd57fecb7a436f1bf0cba32cdc24a56f9f2336b4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509506, "uuid": "519f95b0-7c0f-4545-b2fb-088b98e00ab5", "comment": "Malware payload (CoinMiner)", "value": "3f51634b9ffe10266d3dcdf198a88f4ead63f90f37bf412dfaf3df08d6ab77f9a1dd9040fab98f9ecabc38ce6183d3b7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509506, "uuid": "a37ccdf6-5dc5-458f-b119-98ee14a9ac2a", "value": "T128E5334101C3FDBEA599D9D418FCBF310E6B11F0A7685522FE7A0425BC22FE741AB61A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509506, "uuid": "f20c6f75-6823-4a42-9991-f333d9d40411", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl93:G3LG658+S8YrCpHy2dUu4Kr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509506, "uuid": "c5cae5af-7cf7-465c-988b-e283c6b95e84", "value": 3084288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509506, "uuid": "a7cc6a39-f9f6-4d39-a2b8-b442e8cd4d4d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509506, "uuid": "93650054-8f64-4d53-ab89-19c8d71f046c", "value": "a8c7a912b7b737c561370e9d08d69c121dd7de3775fa35aec887b2bad297b555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96226e96-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509398, "uuid": "5e8292b2-1e7a-424b-ac91-6e8033ef979b", "comment": "Malware payload (CoinMiner)", "value": "a817fda0700b8ac64a11edce2ce70e77", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509398, "uuid": "76adf88d-ccb1-42e0-8f81-4cd396290b02", "comment": "Malware payload (CoinMiner)", "value": "a99b0386a08842e19b00c04388626adddf398eb6fe16f68044c3a30067c23bca", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509398, "uuid": "340ab75b-e952-4ff5-9c5c-ec45e1538253", "comment": "Malware payload (CoinMiner)", "value": "9f422580f1b28d98dd606c3eff596c984b375311", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509398, "uuid": "a7a96ed7-27e3-4f68-9646-fd963e5b5eb9", "comment": "Malware payload (CoinMiner)", "value": "18443ad85aa202b08b77f005d84b1a445aee23cfb8cff6e0ecc62f3a1256b26805728d7e84ffa5b72b2184e20dff4502", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509398, "uuid": "52bfd5f2-f342-41d6-8c11-ad7fc0e7bce8", "value": "T14FF5336101CBFCFF6981D47458FCBF360E6655F09AAC8265F929041ABC25EE3406B72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509398, "uuid": "4536f472-355b-4e16-a1b6-12fc841a526f", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vH43vwO:G3LG658+S8YrCpHy2dUu4KrCf43vwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509398, "uuid": "c357eea7-f777-444f-9b56-ebf5c84b4404", "value": 3600384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509398, "uuid": "20a635f0-0e66-4ef1-8ba7-ab672b2b6712", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509398, "uuid": "23a160fc-3126-4826-9a47-cc7ac5dab908", "value": "a99b0386a08842e19b00c04388626adddf398eb6fe16f68044c3a30067c23bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41666d26-e933-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767506679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506679, "uuid": "ae418bcd-6cb7-44cf-9a1e-72a7d5a14af6", "comment": "Malware payload (Mirai)", "value": "baf3d3dfbc28ff11ce1063eb83a0a686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506679, "uuid": "af2823c9-4927-4a00-bd46-e1d95b06da9c", "comment": "Malware payload (Mirai)", "value": "aab8d737840ea2371bc43b997d9fc078f5ecc732b0df5614a8de196c55bdf803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506679, "uuid": "9638abd5-e4c8-484d-96c8-3f5e6a536a2c", "comment": "Malware payload (Mirai)", "value": "4dd8f7e975b10abb648c138421b92fbad6362dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506679, "uuid": "689ebe20-5a41-4d15-8ef3-b6e39912ddf6", "comment": "Malware payload (Mirai)", "value": "5ee0f4bd879da31d8f2fc3bc45c6f6cde63c9be459bed43657788720d0165ebef3c0a87dae1bfa1d42dac558e6aba473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506679, "uuid": "d971d699-0ba8-4a29-9bc8-8c1a3c2df276", "value": "T1C934239D6E04F0D5EE48BC73BE524C0BAC583927D19E78B18769A3F0FFA0CA58059257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506679, "uuid": "4ea72916-7bda-4177-b59b-308b8548ed6b", "value": "6144:QMvCyRfLierxhq/cobIvrJPRmW/+am9vVE:QyCy1FxQU1vrKhPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767506679, "uuid": "af0284cf-73b7-41c5-94d5-6d4a40746a7b", "value": 252220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767506679, "uuid": "c88210ab-4ebd-48ee-a27b-c120051a0230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506679, "uuid": "523a90d0-4f6e-4e39-95e0-7519e729c76d", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b566fb-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509822, "uuid": "e6f7cd61-9ed0-4ae1-981f-39cf573ddfd5", "comment": "Malware payload (CoinMiner)", "value": "e37695cae0ce608beba7371e2fc71afb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509822, "uuid": "08c27d0a-eadd-4d95-9442-97e012d59236", "comment": "Malware payload (CoinMiner)", "value": "ab36a92aa510013ba193f7bafd296f0cf1de29baa4c51936a18fec6c77f42ee5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509822, "uuid": "47e88973-70cd-4d8e-ad8c-72e1709bd0d2", "comment": "Malware payload (CoinMiner)", "value": "afa13a8aa0ac40f8a232eee35a92c231efd59728", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509822, "uuid": "557c654a-3824-4071-b63d-492056ac6131", "comment": "Malware payload (CoinMiner)", "value": "68e0107b49100d3ff29960c5e7fca3f6d4715198934bb989a7d1d20807f9af4da96cff325e38fa558453dc458b956cd4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509822, "uuid": "e72b49dc-724c-4a8d-b05f-8961dd4fc568", "value": "T1CF95336002C3FA3F559D99C468FCB6311E2559E06B2956A6F80F0C5BBC32FE905A790A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509822, "uuid": "0b5d9ddc-a72d-4a00-ada0-9fb34a23b2f7", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2ddU:G3LG658+S8YrCpHy2dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509822, "uuid": "407a6028-2916-49c5-866a-63cb45ee9119", "value": 2035712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509822, "uuid": "aad5996c-9432-4761-940e-397730910900", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509822, "uuid": "f06cbbff-8ce8-41d2-98c2-cdffd6a36339", "value": "ab36a92aa510013ba193f7bafd296f0cf1de29baa4c51936a18fec6c77f42ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e281b68b-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516828, "uuid": "b47c3ebc-abc9-405f-be3d-60c8534f21d5", "comment": "Malware payload (Mirai)", "value": "4ba33f8465d49056f324926eadfd47f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516828, "uuid": "5341c87b-6df9-47a0-8d1b-8c6a90dd9bac", "comment": "Malware payload (Mirai)", "value": "ab9a06cd98cc6619ebae0385dfe2321843887760d5b083db22f06af18282676b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516828, "uuid": "f3ccdc08-545d-4e92-bae9-0329c3410a04", "comment": "Malware payload (Mirai)", "value": "9d740ea6689ee11f27f099bd6e9af879c00df21f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516828, "uuid": "f43181db-f92f-45e2-9c85-c29038155e41", "comment": "Malware payload (Mirai)", "value": "809be13acafeeafbfd73b43596b78a047801531f591607fb4a78f6a6d569180240ce4c46748973dbdcf35a7158220ad6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516828, "uuid": "b9f68347-2063-42dd-84eb-178f72142391", "value": "T1AAD30709BF610EFBE86FCD3706E9070525CC655622B83BBA7574D82CF60E24B1AD3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516828, "uuid": "c36d0eea-8042-4118-92e2-6237818a640e", "value": "3072:z89R8PJV7NiUqrX+lfJFQUFmNJmXmirRL:iWPJ1AUq7+rnaJjSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516828, "uuid": "61be254b-b566-4e34-b84f-a764d861dd62", "value": 136360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516828, "uuid": "ed22a244-3eaf-4d42-9750-f33939470c27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516828, "uuid": "25f115e2-791f-4c1a-aeb6-7e64356a7268", "value": "ab9a06cd98cc6619ebae0385dfe2321843887760d5b083db22f06af18282676b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32e8914-e9b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767561067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561067, "uuid": "ee046140-fdd3-4f48-ace6-1656e32c89cf", "comment": "Malware payload", "value": "e4f152cbdbce4d8615feb64aa6bf667b", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561067, "uuid": "e00ec33c-e0f0-4f65-815c-6481500edc0d", "comment": "Malware payload", "value": "abca2eeb4070fa29f5cec8217d7c938973a8ecb184138aa83d3180bb4cfd8832", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561067, "uuid": "f5c1b592-2174-451f-9147-14ba96ad0215", "comment": "Malware payload", "value": "e5837a6f9fcb37b8d689e5d9687c8a41cae3cb9c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561067, "uuid": "871251a3-a546-44c4-8331-c58c13dd91f2", "comment": "Malware payload", "value": "e3ca7d4f7367f2ca154eb576916d6c5bffa1492a72cfa0cc6d90403e682a109e0256dd7a17724339c847f996bd00296a", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561067, "uuid": "d9c61037-5865-49cb-bd31-b4e7d6444a78", "value": "T1AC762807F8A144A8C0AED1348A769262BB70BC895B3027D77B50F6B42F37BD46E79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561067, "uuid": "ae49321b-fc12-4588-8e9e-2fd78a3ec9e4", "value": "49152:ERw5xddicrb/T4vO90d7HjmAFd4A64nsfJsxB9Rrj56MEKUS6e5yiUdgjyXWlD9f:Ji1xHRrsFKP9adDUTTEpWVrwsFZfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561067, "uuid": "f5897b47-d83b-4b52-b97a-c65fbc24f3e6", "value": 7680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561067, "uuid": "e3b55610-1444-4278-b438-9a8d7e612bf5", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561067, "uuid": "90d28bda-e00c-4229-8ac7-0db8cf1528b4", "value": "abca2eeb4070fa29f5cec8217d7c938973a8ecb184138aa83d3180bb4cfd8832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8328d2-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509194, "uuid": "87cbdadc-fecf-47bb-a7fa-66284d57728a", "comment": "Malware payload (CoinMiner)", "value": "ed697f7c45ff9fc0213add8c99171f17", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509194, "uuid": "b9f9efb9-c5e9-4d92-8d9a-c812127558e7", "comment": "Malware payload (CoinMiner)", "value": "ac23ffea78f814a9dd4263b95e9bbbc9686adb8ea82cbf3abee19f927096a63a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509194, "uuid": "2e039e9c-a4fc-452e-b04a-05324f0e6407", "comment": "Malware payload (CoinMiner)", "value": "5e28fb5cbf7ac7275c1863f79343f398819932f5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509194, "uuid": "cf2caff9-dc95-47ac-bc00-82a4153b6e0c", "comment": "Malware payload (CoinMiner)", "value": "18041a891c9975b5d298d5066353db9f1638eb33bb83ef305421e6d0dfd451f8670f1708d39d3b3d55ba00fa78393603", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509194, "uuid": "c940f59f-6f7f-4ee6-84c1-60419e7541b5", "value": "T1730633A201CBFCFF6885D46858F8FB360F5555F19E784165F9290829BC26EE3407A32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509194, "uuid": "c836bc14-b7e4-4502-bc24-70b02e1d71d2", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgb:CC65sr3KrCfsYiZQgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509194, "uuid": "e32578d0-f4c8-4cbc-8d70-02bff77b136e", "value": 3891200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509194, "uuid": "bc415f61-a84b-40bc-b1a8-d0f75ed6d20e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509194, "uuid": "718ffcda-098f-47e4-a1db-d2886158b220", "value": "ac23ffea78f814a9dd4263b95e9bbbc9686adb8ea82cbf3abee19f927096a63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d55469-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511359, "uuid": "70837b14-c6c3-43a6-bfd7-1907d97cfca3", "comment": "Malware payload (WannaCry)", "value": "a2e7517220fa5749b47097de5ee4a9d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511359, "uuid": "0d435d82-c10c-4541-8f3c-1985c744a660", "comment": "Malware payload (WannaCry)", "value": "acef5619d170254f350059aadbe7e676e2b871c939e90bf680eb03f74d6af633", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511359, "uuid": "1a7f031d-8969-4dfd-8d0b-97f6f6e2c860", "comment": "Malware payload (WannaCry)", "value": "3f794569b2909447de0b0dccd339eb7138fb9026", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511359, "uuid": "0c8422f8-2cd3-44a1-90f9-e8b1137c6036", "comment": "Malware payload (WannaCry)", "value": "51861597b2fe3bfe27144fc4457236c4e56f889e3cbf8e8a1c777172a50659c7e218e3dfc66fe06d1892cc172178fe05", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511359, "uuid": "0e4601e4-4148-4758-9863-0258c4cf85a5", "value": "T10F361269B6D87ABAF7B32BF12175876457BABD00AE1A461F1260054A0C73F48DCC3F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511359, "uuid": "7b479df9-3941-4f55-b8dc-1f401ed99ddd", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511359, "uuid": "23182b90-d17b-4b0d-8391-577eef4a41ec", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9ocpis2xgzBJriN:d8qPe1Cxcxk3ZAEUa+cpis2xgzBJriN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511359, "uuid": "81ed178d-2bc8-4cbe-80ef-ca7b3ef826b7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511359, "uuid": "0307031c-c9b3-4ac6-9805-bbbf28cda698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511359, "uuid": "965b112a-e5b6-4374-a476-112024fa3985", "value": "acef5619d170254f350059aadbe7e676e2b871c939e90bf680eb03f74d6af633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b498194-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555256, "uuid": "075cbed9-7ddc-45b8-b990-7fbce5261304", "comment": "Malware payload (Mirai)", "value": "8e575d39d7f3a97b9f416b5c751e50e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555256, "uuid": "b1a2eca1-19eb-4096-91f5-f808f7e4ca27", "comment": "Malware payload (Mirai)", "value": "ad1a4d90b080563c08871b8f213d8eb94faccb99fc3f00730b2220816c739cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555256, "uuid": "2e4a78e5-2ffb-49ae-9df6-80fdb13ce70a", "comment": "Malware payload (Mirai)", "value": "225acb42ad8152797fb7d26c8571ad2388550bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555256, "uuid": "0e7b5445-33b2-49d9-b43b-db896576833d", "comment": "Malware payload (Mirai)", "value": "7e9f5affedc49cd95306c66311946c39a19567d37a3ff9a0543aa77c695c0b65b194573811cf6c237ea16535b49c769b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555256, "uuid": "dec5f7ba-89b1-4176-a0d2-f2fada7240fa", "value": "T12264E852EB806EBBC00DDE31011F87C911AD849943FB576BB278C56EBB8EA0D69C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555256, "uuid": "28b507ff-b700-4590-b4c5-7ed098f921ff", "value": "6144:3oBqSoaTfbOGKVYudD3JNEr4GrAVWPiwH7cxDR06jvc0DX3koDLlpR6zJ:3oBqSot7WEbvc073koDLR6zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555256, "uuid": "47bec25a-36eb-4120-a0a3-8e6db6db7d6d", "value": 315676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555256, "uuid": "8f586c4e-26f6-427d-b88a-047a54f788e8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555256, "uuid": "86a5bfb9-e7c1-4be9-8350-70a0d758a6bb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62eaf04b-e98b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767544531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544531, "uuid": "6851c4a7-e760-4031-8132-b3439187964a", "comment": "Malware payload", "value": "e978be3cbb0d93716345198f642992b7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544531, "uuid": "0e037086-7871-4c4e-af33-a7ef2f9bdea9", "comment": "Malware payload", "value": "ad2cff1b1f35837139f30704f8f7d7c7415457c6c149338893bc21c959c89a76", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544531, "uuid": "b1748114-ec85-4e4b-879f-a9434d20e067", "comment": "Malware payload", "value": "80f02c20b67163655aaf2714a6d48f821d680e84", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544531, "uuid": "22873d79-14eb-4db6-9c9f-cf31e8348050", "comment": "Malware payload", "value": "b9facb0f9bc1441843a1a1b4fc52eab9719f6634c376a5a6deed6a487cf582e08ac3c0372b1064df136115ed2f8dd597", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544531, "uuid": "e0f6e844-7952-40fa-8753-00e0c6c8c1a8", "value": "T159E4B687F1208AC7F44FEABE04904314ADB0E4704607F2552B6E885E2FEB9D89F557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544531, "uuid": "c6c46094-eea7-48f4-ae11-09f0817daeb0", "value": "6144:+xRZxR6HR+vE5SKGGt7BiRhkQZGQ5Uus7CKPhU1eMX5Uh/W94gpr2TnWjPjhMoe:YZxeliX5A3uLQUqi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767544531, "uuid": "a38e536a-18e4-4563-a449-9c926f6bfccd", "value": 693977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767544531, "uuid": "0c70a5c2-761a-4aaf-9d56-249447bc3563", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544531, "uuid": "70dd681a-01a8-4909-99c9-f4401b7d3f27", "value": "Dupe-2026-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc871b0c-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509033, "uuid": "98837da9-600b-4e83-b17d-0a4b06d19e85", "comment": "Malware payload (CoinMiner)", "value": "e58417776c0a9232553f0586324448b9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509033, "uuid": "65a23a7a-ec14-443e-8c47-226c546c4a0e", "comment": "Malware payload (CoinMiner)", "value": "ad61f6660e3eff7b52f2bac484ebbfc16c1a6c3ed97976b0982b4b9f2a10db61", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509033, "uuid": "e6ea6bc8-a766-424c-bf93-98fd3fb9e255", "comment": "Malware payload (CoinMiner)", "value": "1ffd8f4898d8a39ee6ddf75d10945080b5e17733", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509033, "uuid": "c69f31a6-9e54-4ee5-8f21-c5b9423979d8", "comment": "Malware payload (CoinMiner)", "value": "b1936afd2af6e751aee4d9308bba9e4be5ca04ee55aebfe8a6e481e0f78c2857fba0f901125c0afef4644cbcb6e4bdcf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509033, "uuid": "10cb49df-5eb1-46e4-896f-74ea7abab209", "value": "T14B16332511CBBDBE7589C8249DF8FB324E9925E29D784111F83A0428BC65DE2407F72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509033, "uuid": "3e1c25ba-b572-4159-ae33-86361f362a9a", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhk:CC65sr3KrCfsYiZQgzJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509033, "uuid": "e3838b5c-5f5b-4afd-979d-a8b0da8ff270", "value": 4329472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509033, "uuid": "0a5dd54b-ac27-470a-a630-5f76cb9f2174", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509033, "uuid": "b2b1c2ea-47e2-4527-b30f-9aac99024db1", "value": "ad61f6660e3eff7b52f2bac484ebbfc16c1a6c3ed97976b0982b4b9f2a10db61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7eb700-e991-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767547017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547017, "uuid": "4723f32e-832c-4e52-973b-43c729294fdf", "comment": "Malware payload (AsyncRAT)", "value": "74d08e4ef17bb2631f3372bd7ae8226d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547017, "uuid": "3d002750-0c57-4d7c-a96e-17033b58233f", "comment": "Malware payload (AsyncRAT)", "value": "ad99f1e23d8eb9eb25e71e080e4af6f32f7fcc96ef0f2102f16059c38de259d9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547017, "uuid": "a4eec9a1-fafd-4848-a3d8-dac8e4773fed", "comment": "Malware payload (AsyncRAT)", "value": "0e728ccec59d2cd725a11b924a67c0db76262bb2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767547017, "uuid": "22119176-1e4a-4c73-b52a-37f3f8d5d961", "comment": "Malware payload (AsyncRAT)", "value": "a77993c2800f6554542d2691d6a44cb361365c6042a4e2e32b7411d0883ece4669c514ae159d57dc75aebcc08b928ecb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547017, "uuid": "3ccc2340-4347-4501-9cf5-d71379923213", "value": "T1AE536A002798C966E1AD4AF4BDF2550106B6D5772116CB5E7CC400CBAB9FFCA4A223FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547017, "uuid": "e69d35ed-7890-433a-b1ef-2371ae5b277e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547017, "uuid": "74813f3e-8bd9-4fe2-81f6-ca1be17c021c", "value": "1536:Tmnn75wzluQGbbAwVjET/UveGHg1VclN:qnKzLGbbACELUvaXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767547017, "uuid": "2b437dc3-accd-4739-b5b4-66ab8ff28a3b", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767547017, "uuid": "f46eb135-2ad8-43a6-8d76-6efba4260c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767547017, "uuid": "42be1cfc-3eaf-403f-9ac4-cf0d076b892f", "value": "InternetExplorer11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de02b09f-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516821, "uuid": "c0c76951-d458-4e87-baa6-10b57dbd09c2", "comment": "Malware payload (Mirai)", "value": "75e05f52c1f05ccafe71fdcc09b6ee1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516821, "uuid": "9690d8d6-64fa-417f-b406-997cd6746c71", "comment": "Malware payload (Mirai)", "value": "add2769aedc3b04cbbb709433cc81dd697462ea9c7949806d06ee6d33d89a230", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516821, "uuid": "423e1269-211d-46b3-afdc-0dc0d429f28f", "comment": "Malware payload (Mirai)", "value": "748bb2afbd2726c36957469c21422eac70350812", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516821, "uuid": "46c953c7-c949-4306-8aba-e9def0a7c612", "comment": "Malware payload (Mirai)", "value": "5f539a5be41503be5f0e4b613a6015065b4cd8984f2b37fd1351db2657c6bf1c76b2c8a032c77aebf0e0f1b91e16596a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516821, "uuid": "6465ed8f-c1e1-4f0b-bf85-871fbda93779", "value": "T15CA34B52FD92DA12CAC16177FB1E424D372753ACD3EB33038E266F21628A91B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516821, "uuid": "03ad31b1-74b2-4426-9da4-66a66d62baaa", "value": "1536:Pcbe3BSELICcyhQnl4S8vfealvj+UxPedslezH89XwOzjJ5rsduNv7tNd:PcbMBDULnlb0Bv5xmaAzHu4dQp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516821, "uuid": "66ec9bef-7ce1-44c0-8096-83c6fda2c659", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516821, "uuid": "ccc29bdc-4dba-4a7c-8566-f9402192f087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516821, "uuid": "3edeb7e8-b26a-49a2-a5a0-9ab5054f7a78", "value": "add2769aedc3b04cbbb709433cc81dd697462ea9c7949806d06ee6d33d89a230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cdbb4e-e950-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767519140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519140, "uuid": "7563e5a0-9cc8-4ad0-9643-97abff76cb81", "comment": "Malware payload", "value": "a470de5d43d7e9d2b65fa256cd124fec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519140, "uuid": "ef8bd495-1f6a-4b0a-b298-77fd0402d8a3", "comment": "Malware payload", "value": "adeb8220393a3d895f0991ee1663a677ee3fd906ad3e0702fabcb5c52507de3c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519140, "uuid": "f45d5a52-4b9f-4c6b-bc6b-f1faff72546a", "comment": "Malware payload", "value": "6d81cb8bec393a0fbd6db77e3c2acf9f3b25c5f9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519140, "uuid": "b8668876-e106-40c0-807d-e321884321c4", "comment": "Malware payload", "value": "527c82eb2554d3872a92cd138aef6673f97f188cfeffb2ef44fa0122b59adfe3bf874a73c57ba068a6a75c78558197c1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519140, "uuid": "a1b39b64-eca0-4881-bff8-c5000e785994", "value": "T12407CF63F244699ACDE6A230F4E317D032260D514793A76A571FF136BCB31DD8E26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519140, "uuid": "7f95c41a-653f-418f-bd84-141c756ed76e", "value": "196608:YO2lytGfaDNTaNnu3RpgNTyGjNvMZIg+qAYFNho89cY+iLb8/zSvF3gstaSMZ6Xk:Z20t4aDQUYTyeZSNkYFooAzWFdtJHav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519140, "uuid": "890e41f6-a5f1-4446-abc9-d789e5834da1", "value": 18227623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519140, "uuid": "3f47c324-42c5-4888-9aef-da574de6372f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519140, "uuid": "5c479314-fd85-4bb0-aeff-7a1898e302af", "value": "Masrifi-Plus.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09097029-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509162, "uuid": "eef46c07-7cf6-4905-aab2-cfd8eb1057c9", "comment": "Malware payload (CoinMiner)", "value": "6ed9260cb1ea5979bb469f6336dee19a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509162, "uuid": "7fef7a69-00d1-4a26-88e1-16ba35b56c8a", "comment": "Malware payload (CoinMiner)", "value": "ae85c86603b6fdfbc2fa6ca4b766688b5605f352b63c1b30e79a3f0d68415429", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509162, "uuid": "7e2591f9-c227-4e7c-9952-c814aed74d5b", "comment": "Malware payload (CoinMiner)", "value": "724226a9c182eb53d7d1eb687d2fe8d21d2f522d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509162, "uuid": "8f3cb180-7348-4e42-9f6f-1e5da98c9c3a", "comment": "Malware payload (CoinMiner)", "value": "55c1e047c2de96195d554b95ad185b970a513b6a44c550bf25fe9a031c2ea9a69505db26c4231d7b712c418c53812b26", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509162, "uuid": "0aeba07c-3963-4e21-bc77-536329ae15f0", "value": "T11006336501CBFCFF6985D87858F8FB360F9554E29E784165F9290828BC26EE3407A327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509162, "uuid": "bf1fad4c-828e-4c40-81b3-d7827d44d49a", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQg0:CC65sr3KrCfsYiZQg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509162, "uuid": "3b430b9f-1ac6-4b16-bec7-0e477d962df4", "value": 3928064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509162, "uuid": "d87be4ac-f56a-4279-995e-9fafaaff1f42", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509162, "uuid": "84a72d11-ed10-48e5-ae0b-d62f81937ff0", "value": "ae85c86603b6fdfbc2fa6ca4b766688b5605f352b63c1b30e79a3f0d68415429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fd4232-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509470, "uuid": "0ed5cfcc-08c4-40db-a425-d6fba24136d2", "comment": "Malware payload (CoinMiner)", "value": "7759f432c7e5cbe3adf1af8bdf34fe21", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509470, "uuid": "c23e74e3-a6a7-4bb7-8c91-5df5bbabefdd", "comment": "Malware payload (CoinMiner)", "value": "b099f104a02e7ecbdbb03100d23398e57a7b4e8b3fad00997c903c8075ec8f38", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509470, "uuid": "1d92103b-451f-470e-8c1c-ca5ac76a2cb6", "comment": "Malware payload (CoinMiner)", "value": "de9ad0d1d6ca61934cf5105742cc7ee13406fee5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509470, "uuid": "d54af006-95fc-4130-97d8-8c322c077e42", "comment": "Malware payload (CoinMiner)", "value": "74d24574b26e05c339b14d4e5a92efaeb4497f8116064dd2bc6a8cd77e8e339e5a699a9502fd490f54d0b27a00e04b75", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509470, "uuid": "7bf0ade5-b652-41a7-85d9-7455662d0618", "value": "T101E5332100C7FDBE9995E4D458ECBF310EA751F19A189115FE7A042ABC26EF341BB21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509470, "uuid": "8b2cb3c0-73a5-430e-adae-3f82c326d1de", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vHk:G3LG658+S8YrCpHy2dUu4KrCfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509470, "uuid": "13871301-1eb0-45f7-b68e-7c82c83d1d31", "value": 3280896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509470, "uuid": "c2bf1dcd-addf-4ba5-9e2f-07501f0ce474", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509470, "uuid": "25f2c8d5-58c2-4d1c-804d-7b6ec12e4b45", "value": "b099f104a02e7ecbdbb03100d23398e57a7b4e8b3fad00997c903c8075ec8f38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dc2e9f-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511463, "uuid": "cc8dfbd1-bf31-4d2f-a21b-ebea95c1b51c", "comment": "Malware payload (WannaCry)", "value": "c3771d736c9c8811ee5e44cbd533bc60", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511463, "uuid": "bb0e348a-db22-4a64-93fa-910b96cbc6dc", "comment": "Malware payload (WannaCry)", "value": "b10fedc2ddaeed43c2ca040123d060ec5af0fefc1a4ddc24f0b122b6734b8d86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511463, "uuid": "1d397423-eb77-4d71-bd5f-6adbae67e784", "comment": "Malware payload (WannaCry)", "value": "3001f0d67b254b9fac910b8dde2ee6bc29977b3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511463, "uuid": "d092da4f-de7f-495b-83fe-e06b40e73cb2", "comment": "Malware payload (WannaCry)", "value": "d27a5b106acc3d8c952112b2763e71b061ceab46c8e3c9b0e084a37983b469c2459dbabea4e65b1914e6294b3962c637", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511463, "uuid": "caf7f3f8-9eb5-4057-a4ab-54f97ad50b14", "value": "T1083633D4A22CE1FCE1451EB10063895BA7773C6567BE4A1F9B8086A70D53F6FAFD0902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511463, "uuid": "69a92694-a5d7-4239-bd2a-ad0b867cd326", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511463, "uuid": "688895c3-eb86-41c1-a621-23232e98b747", "value": "98304:+8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2owc:+8qPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511463, "uuid": "3667285d-1b29-4eeb-9405-604d75812e2a", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511463, "uuid": "1d65a247-f849-4c6d-8499-3315bcfb7641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511463, "uuid": "2f1c23f7-31b2-469b-8633-566246b8ed54", "value": "b10fedc2ddaeed43c2ca040123d060ec5af0fefc1a4ddc24f0b122b6734b8d86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcda717-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519964, "uuid": "32cca84c-a83c-4d5a-9066-b88c1787840d", "comment": "Malware payload (Mirai)", "value": "bc66350fca7daf57d9ce8898e9db05ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519964, "uuid": "5bc692e3-91e8-4413-81ec-034ad98ad7cf", "comment": "Malware payload (Mirai)", "value": "b14a20360d821ae3f22ea4e7f53c9ac9e3267d2e0a6459555c56148fa3572192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519964, "uuid": "39d7c2a6-f544-4a0b-ac1d-58951ab1c22f", "comment": "Malware payload (Mirai)", "value": "cab53c22d15e4f9616e5bc9d37ff6624d11ee022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519964, "uuid": "07f07caf-ce41-44d5-805e-df04fafa709f", "comment": "Malware payload (Mirai)", "value": "821216c7fc9c4abc811bad4edf90f0a4e2421cd2f6f7f40a197023078264a87dc6e74d2ab965add5726daf9371d47f78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519964, "uuid": "531c7063-94d5-4aaa-8cd1-1645ef99a9fe", "value": "T1D4833815B93D1E26C0E4A27E22FB8716F1F6370E14B0866E3D350F4EFB54690A9463B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519964, "uuid": "458968da-9411-4721-8438-3c172b98d3eb", "value": "1536:Cqbd887SevQxOuDylJ3UcVjmkUyUzjNV+Gc9:1W8+1SlJ3UcVXKzb+GY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519964, "uuid": "d1051e14-24aa-45e9-affe-359988c55128", "value": 83752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519964, "uuid": "f15af1a0-d3fe-4050-8139-ee5daa0e5616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519964, "uuid": "e3a7991f-9a28-4d41-a458-3e38a6788323", "value": "Fantazy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008b4912-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509577, "uuid": "321f2be5-5f34-482e-a86a-8a4502a4cbb9", "comment": "Malware payload (CoinMiner)", "value": "18e22c0fc81eee1e17090633a3460a58", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509577, "uuid": "6ec0a02b-1426-4456-b703-b96ad1112527", "comment": "Malware payload (CoinMiner)", "value": "b15b3f3b14199f39efe484f7de6bd9c04b288074e3774e58a296e5fb1ea9afca", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509577, "uuid": "822f3c3b-ab6f-432f-9576-c7fbb5772521", "comment": "Malware payload (CoinMiner)", "value": "ee05dbb1da06a2ec1d4d73492bc1da41775a6c03", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509577, "uuid": "592fd3e0-b572-4881-9819-1a5ba18a092f", "comment": "Malware payload (CoinMiner)", "value": "e1e461f72e8a76bbb31677a5a794c1f24bf90fbd949905b029aad45ff72eea27c996aeafde88b9017366b3654f48f552", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509577, "uuid": "197dc311-dd95-4fe2-9d2c-afd1def61029", "value": "T18ED5335100C3F93F949AD99458FCBB310D7B11F0AB682623BE6A4415BC32EF641BB91E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509577, "uuid": "d732e109-d94d-4e7d-b44e-9512b7329034", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh44:G3LG658+S8YrCpHy2dUu4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509577, "uuid": "c84c979d-a0de-42d1-b4fd-7cd1788ea7a9", "value": 2859008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509577, "uuid": "db6c74f0-bff5-4f12-adcb-683f4e3b3682", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509577, "uuid": "13a4e7ee-f9d3-4e02-8d97-52892b37f122", "value": "b15b3f3b14199f39efe484f7de6bd9c04b288074e3774e58a296e5fb1ea9afca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faf8c9f-e91a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767495859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767495859, "uuid": "53c56c5a-be6f-419b-a03b-1cbc7686acfc", "comment": "Malware payload (Mirai)", "value": "7c8196c4c6e93f03a5792f35ac7be780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767495859, "uuid": "09c89192-7a2a-4e52-95ad-206c5dd62cac", "comment": "Malware payload (Mirai)", "value": "b19e36e55363d19ba5af8fde9903ba8e7d9ef1966cf19763af2914e6b78a7495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767495859, "uuid": "d8168906-373f-44cb-a82a-d4c143255c67", "comment": "Malware payload (Mirai)", "value": "4158f645f2aa2a6ae9f2a55d9920d745399ffd77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767495859, "uuid": "a1c7345b-dc44-49b6-92c3-188df92e3f2c", "comment": "Malware payload (Mirai)", "value": "86aba35a851b667a7b30e2ef6cb1f2a2295faf5060271e691df7c2280f4eafef5c6035c8a718f7a218e1052f1373c727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767495859, "uuid": "6805a087-51fc-4e1b-9d34-68f2cfef7d9d", "value": "T17114864E2E228F6EF269877007F74E30975973DA26E1D684E1ACD5501F202DE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767495859, "uuid": "4e7cca98-2ed5-4e49-9f64-874de26bf541", "value": "3072:iWW467u0+TswFqdoCs8FSnYZMFNNooBUZwm:zWV7utsO385ZQNoyvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767495859, "uuid": "6fda7c07-3cdf-46cc-bfeb-e21311660f73", "value": 191768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767495859, "uuid": "c88bc98e-be6e-4b1b-b28e-d1af8d02313b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767495859, "uuid": "764d99ec-f6e3-4669-948a-b7f6536ef084", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb0f119-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512819, "uuid": "8ef0a9b5-36a8-484a-bb1b-b9ade3da2557", "comment": "Malware payload (WannaCry)", "value": "4ce660481091f793bb1ef62bb38b5883", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512819, "uuid": "49736ea8-3e25-4e1d-9889-e0dcbde20a63", "comment": "Malware payload (WannaCry)", "value": "b1c9e2911dd5cae0beae3c4b84872923296f84f1c34e6d31315d9189a1b483ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512819, "uuid": "018811b1-bc1a-4616-9a95-aa1b724474f3", "comment": "Malware payload (WannaCry)", "value": "2e92c55c6ef3dcd36d63974798aa697cf2aabd1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512819, "uuid": "9211470c-2028-4241-a550-62009637aaed", "comment": "Malware payload (WannaCry)", "value": "c53f195bc718f7dfe642b01e9b43700248b0ab19b05cea352ee77e060adf92b2a5cdaba3ada490054d5853af058b6861", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512819, "uuid": "963cfe4b-716b-4555-a513-13c8c9e5fb8b", "value": "T12436335A717CD1FCC106297954B78963A7F33C9A22FE6A0F8F4049A61D13B19FF90A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512819, "uuid": "71528c80-90c3-4238-b065-8f792220562d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512819, "uuid": "66c2f9ee-8115-4a62-9f52-2e8a45051d3c", "value": "49152:RnNQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:1WqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512819, "uuid": "7d8b019b-2923-4d95-8b71-4c9eeb547b86", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512819, "uuid": "9760711b-2045-4a60-aefa-fce4c869b6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512819, "uuid": "37305837-9f33-4352-8fc3-0b9a4204d70c", "value": "b1c9e2911dd5cae0beae3c4b84872923296f84f1c34e6d31315d9189a1b483ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31452461-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509659, "uuid": "8b85f018-6d39-49a7-a464-c83e5876e002", "comment": "Malware payload (CoinMiner)", "value": "1f1b825f421149edbfa38b80e030a521", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509659, "uuid": "11edfaf6-719c-4a4c-8b63-b8078ab9d218", "comment": "Malware payload (CoinMiner)", "value": "b1d2e89a78160834dc58c3af4b41dc02ee480fb458eb5819440d98d0ea7c77b2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509659, "uuid": "09e6b8fd-90cf-492b-9312-18b64631ee27", "comment": "Malware payload (CoinMiner)", "value": "d6681baa0911d3f46b954e48fcf91e0cf8742e8e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509659, "uuid": "2796fa7b-94e2-4663-8f15-b7d69a639612", "comment": "Malware payload (CoinMiner)", "value": "745a20f6672a67bc68dfd80ab296a2fcbb802fad4ac4d60b5e68165e58ca8ae6f8f7e74ef26279a7414b1638cf83ee34", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509659, "uuid": "ea33405d-a629-4908-a0fe-494ce409e882", "value": "T15CB5331202C3FB7F909DE9C4A8FC7B311E6654F067281A52785A0C5ABC71FF941A791E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509659, "uuid": "9ac14e0b-2e24-499c-9933-7f162959dc9b", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3D:G3LG658+S8YrCpHy2dUuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509659, "uuid": "988669a7-401a-49fb-8b65-176be2002e6d", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509659, "uuid": "906641e1-9845-4d50-9903-8f863b30dff3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509659, "uuid": "3d8d2f7f-7c03-4101-8231-5e3ef32521e0", "value": "b1d2e89a78160834dc58c3af4b41dc02ee480fb458eb5819440d98d0ea7c77b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dcf979-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567145, "uuid": "d57ba6f8-3712-47e9-81fc-f9859ae63b6c", "comment": "Malware payload (Mirai)", "value": "3dee728c386a310c59d4b91b302e9a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567145, "uuid": "5055368c-8bfb-40d3-b3fa-422fc5ec0ff9", "comment": "Malware payload (Mirai)", "value": "b22fd5c0a347ac3d86657a7d3532a0ca457806d2c33930ef3faee65963bf2468", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567145, "uuid": "2f258cd9-e59b-47b2-8ec9-327107a14644", "comment": "Malware payload (Mirai)", "value": "4fbfd3b5b1827e798796b51af66d23ab891f6285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567145, "uuid": "ebc0dfea-2fd0-4460-af6d-a7f725755120", "comment": "Malware payload (Mirai)", "value": "3c3c3f1d6ecdaf261b6d79cf0f5e43775869f1b24a701476786670b4ccf88b771d3ff11683696e607eb6574f08094c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567145, "uuid": "6a6777cb-e5d3-43e8-912a-68654eff8f64", "value": "T1E6730895FD409B92CAD216BBFB1E428D772A4368D3FA330399255F21379B85B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567145, "uuid": "8f6409b0-4d79-451d-9e7a-624aced28802", "value": "1536:3sIhB1vZvXRR32xWrOngmNSDTaz7KoUaVjAV5dxvZ:cIz1vZvXjGxWND2nKeE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567145, "uuid": "6e96f9e9-ebdf-4dcf-84af-7e60251d82e7", "value": 79200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567145, "uuid": "30dd66c6-f005-4bfd-bc0c-dcf6d73b15c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567145, "uuid": "912e12a2-4471-47b9-88dd-ec6d0f4a71b5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302d6c04-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511375, "uuid": "5c01ff6e-2b96-480c-8f75-f5da1625ff68", "comment": "Malware payload (WannaCry)", "value": "0f054a87709c2238612be989a04cb132", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511375, "uuid": "f0136f4f-b0ca-45ac-bad1-edf7f6cb133d", "comment": "Malware payload (WannaCry)", "value": "b28932fc3c86b5ead3295984c4fc8a464f053336b02f04c6f6e327ab5af5603e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511375, "uuid": "ecf26f44-f215-4935-a246-fcdc2544851b", "comment": "Malware payload (WannaCry)", "value": "c8e37547e964cbe70292acc11ea9f1cbf5c6a5bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511375, "uuid": "9c386f85-9451-4669-a8cb-12ab4a352488", "comment": "Malware payload (WannaCry)", "value": "9abcbd298af57b40de8b31fa402d55ac6d0385458c2c14e0d09014855e9ba1820428e30aa49da82ec4067478f9d23d36", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511375, "uuid": "6a9d9b4d-ad16-4a8d-8ca6-d07c9289ed30", "value": "T1AB36021AF6E8D1B5D91D32B085A6421873363CA542D2438FE7046E7B7E77B049E33E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511375, "uuid": "a3a9b65e-88d5-4c0f-af3f-e5a40f710d99", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511375, "uuid": "de0c0e08-04a9-419e-90be-cddf834b4fbb", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv5tuwP:d8qPoBhz1aRxcSUDk36SAEdhv5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511375, "uuid": "9062d4cc-43fe-4816-bc5a-46f823b3708d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511375, "uuid": "2f55eee3-fc6c-4040-962e-fa1912545b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511375, "uuid": "fe415f45-afd1-4a57-86dc-2a6bf2253980", "value": "b28932fc3c86b5ead3295984c4fc8a464f053336b02f04c6f6e327ab5af5603e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd51f5d-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512072, "uuid": "99273d65-bf46-49df-83ea-630ede766ebb", "comment": "Malware payload (WannaCry)", "value": "3db336176658dd4cb61aace85b9ee4e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512072, "uuid": "fa7c68f4-7272-42c7-acda-3dba88ea3e24", "comment": "Malware payload (WannaCry)", "value": "b3d4d1f18ad895f06a1e5cefeddd63f78c80706b6fbbc7b7d65d6032f2bed793", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512072, "uuid": "8def860e-c5db-4e92-94e2-1115b57904d9", "comment": "Malware payload (WannaCry)", "value": "aa8ff92054f2d0ec93ab7d7f43cb4ef236251806", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512072, "uuid": "8a421ad2-d2c3-4919-b2df-5fef5197a075", "comment": "Malware payload (WannaCry)", "value": "570d0902e19da7b0bdb463fee77310e734bd0097abaa8b4c53c24111c8aa5a0461d81e95a56b255257f2ae36d891b317", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512072, "uuid": "4972c02d-c5f1-470e-b06a-303d0ed2ad6f", "value": "T1F7363398756DA2FCE1040E7804A78A5773B33C692BB94B1F9F808A7A0C53F56AFD4641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512072, "uuid": "e4ef5070-6ab6-4bc5-a9f9-144126f90071", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512072, "uuid": "b5337e4a-53a4-4dd8-98b7-18122f708524", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQORdhnvEAMEoyAH1plAH:+DqPoBhz1aRxcSUDk7dhvE5XyAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512072, "uuid": "2228673f-b2be-4850-917a-aac2cfd6cc19", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512072, "uuid": "fcc6a881-7b10-4fb1-8028-dc4f18ab32e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512072, "uuid": "8fd3445c-3067-49d8-a6ef-024480c61cb0", "value": "b3d4d1f18ad895f06a1e5cefeddd63f78c80706b6fbbc7b7d65d6032f2bed793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59975df0-e984-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767541509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541509, "uuid": "e580ed5d-ed62-4475-931d-7205ad388481", "comment": "Malware payload (SalatStealer)", "value": "b5e95b08432b4c8b30a7f1c99cd309b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541509, "uuid": "d6206dc5-3cc8-44bb-a547-bf859ba77b08", "comment": "Malware payload (SalatStealer)", "value": "b46f7ea522418918ebe0a1106c24004e78f2000dc47fb66c95138cea869bbe9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541509, "uuid": "576a870f-c890-45e9-8ee1-a7b60cd5506d", "comment": "Malware payload (SalatStealer)", "value": "5b746535a867f8b71cd612d61581fea389d3bd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541509, "uuid": "a82b0e45-62e9-4bad-bc87-b2f35abf824f", "comment": "Malware payload (SalatStealer)", "value": "e5d46c14aa71dac82f41a031cbc316ca8a9323489c13407ed50adf176e6bbdf4af0c2096288eb2fd0bdc958ba1c2dbec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541509, "uuid": "56d4ffb0-d1bc-4192-84af-36c2510e23de", "value": "T13CE5336740926CECEBF1017406ED8CA548F16FA8FC40A3671957822FEB656468F4BC9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541509, "uuid": "65364005-9a4e-49e3-acf4-62aff89e355c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541509, "uuid": "a913f28e-c714-4aa3-b26c-46971e733d96", "value": "98304:F+ZXAaWY/VW+/Uqrwmy4wif+fl/0LnW0uz:LWb/xwmROoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767541509, "uuid": "84a4c52a-e2ee-42b7-b262-6ab2ad6da6b3", "value": 3293696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767541509, "uuid": "7761254f-38f6-4040-8ee6-300ab4aec6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541509, "uuid": "3a45182b-a628-453e-9aed-9affb3ebd46b", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdace76-e943-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1767513576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513576, "uuid": "735376c1-fd08-4d77-a88f-9eaa8d19b9b8", "comment": "Malware payload (Adware.Techsnab)", "value": "698541d39ea8793d9f10776816a1ef98", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513576, "uuid": "fcbb3772-9661-408d-abab-0d90144c6bcf", "comment": "Malware payload (Adware.Techsnab)", "value": "b52c7d068a55006c6ee85153313d79abb13d1ed1ad6d109ae32cb8106119fd67", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513576, "uuid": "b4f57871-6ddd-46a3-bee0-db30a518e606", "comment": "Malware payload (Adware.Techsnab)", "value": "a3af4805d7801b151c5c27df6487dd893ea1a2bc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513576, "uuid": "946919bd-d41a-4e9f-993a-d814f1d9f4f9", "comment": "Malware payload (Adware.Techsnab)", "value": "cfb68ad375d0b3321eee4325250423eb2258d9dd6156705f9d63f5e76b233512c07f73edea6daa97802faebeb0c14232", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513576, "uuid": "f5ea0dd5-26a5-40f7-9f20-d6f2e33a8e32", "value": "T12B122B2B3A13AC5943D3061AD4EFF908B65EA137274A6E8C70ADDB80BF0586443F49D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513576, "uuid": "77da82f9-2b8a-42b2-a174-e9ad4128a5cd", "value": "192:1lRGAEKc/CVl6IiCzOUfJiJIXv41hM1DLFCCE3KFri9PPJqLGAxdOf6hx:TfH4TM1DLFxE3KFSPsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513576, "uuid": "7326a0e4-87a1-4e15-b86c-647814c9859f", "value": 9547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513576, "uuid": "7e6ed787-259d-410e-9dc0-45acf316588b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513576, "uuid": "49d0e0b8-efb1-42c6-a924-98905ead7f83", "value": "bpyosuiq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0db5789-e9a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767555829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555829, "uuid": "dabdabbd-ee7c-4e2b-81c9-9beb7e181822", "comment": "Malware payload", "value": "513f9161fa9cbade9b070360932c64a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555829, "uuid": "bc735a68-cb36-4e05-baaf-43a9d66c94c0", "comment": "Malware payload", "value": "b545d8c25dedbdf5814d7868d6adf9fa95b4fe15016321f9fab2739fea7b015f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555829, "uuid": "9ad51e43-ff24-4b67-8f3e-ce70cd090783", "comment": "Malware payload", "value": "a1aff5486585db5f3c53bc27df989e0300ba9c04", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555829, "uuid": "ca1e2397-d7ad-4f2b-851d-f7325b17248e", "comment": "Malware payload", "value": "394ae385b31a376591a075f694b30ad31611baf7893bdae1f1d76d1fc52e04cd1d1206f61865e6ae7d4b6a06b2ac3ab1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555829, "uuid": "3b6cd75e-64e4-46cb-ab92-c5a5bf493f38", "value": "T1D34533916C5736F73FE3940F8D782E04EA888BA9C046F6FAD36BA45305F12186C915CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555829, "uuid": "99eb6f63-bd76-4ed2-b3c5-0c0dcfd67363", "value": "24576:0nr6mUvxavY2MTNjzkPzlmmY+6bZCT2zblqoYyrtR5:0nrdUvxZB6zlmmKdrdYyrtR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555829, "uuid": "969b2b16-7ad6-42d1-b325-cfe8a76a540f", "value": 1164818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555829, "uuid": "4404fdd6-edd7-45ee-a07f-48346e863fba", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555829, "uuid": "7736e189-1cc6-49ea-9bdf-85db4147d943", "value": "data.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0f4d59-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567338, "uuid": "f74c161c-71d2-4e27-b033-30fa865e8a6c", "comment": "Malware payload (Mirai)", "value": "6254f72d2c3ab868ac7038afa7839c2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567338, "uuid": "d253cee6-6621-4ee8-892e-2bac8fbb6709", "comment": "Malware payload (Mirai)", "value": "b5bd9d176cba5d4e95706ab28d739f9de42310c76e94ff2db5ea5bbf409013db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567338, "uuid": "c13151da-c459-4a88-bdee-b01f49ab6d4a", "comment": "Malware payload (Mirai)", "value": "2464ee621922dc56581021babe684d70c18592cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567338, "uuid": "97b6bd81-6b7a-46c6-a307-3aeceb59e872", "comment": "Malware payload (Mirai)", "value": "34d4efc93d2fb7b84e07f628c7a1bffe4f3884c9eb97425b6bf9d2b8154a67b6a12d3df962f0fe20d50490e80f28d76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567338, "uuid": "a7643e0a-b89e-4071-93cd-2e0bf6f26be8", "value": "T12D630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567338, "uuid": "cac6986d-397f-48eb-8a2f-af0498307253", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567338, "uuid": "a7236463-7616-4897-a8e2-5290ee988943", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567338, "uuid": "e5aa3ec1-f4e9-4e85-9c1a-8a1c1be34ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567338, "uuid": "20d106f3-1bef-4a57-84e5-41aea9b32d84", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a49bbd-e957-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767522034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522034, "uuid": "6d5ee7d9-9300-4e89-841a-27ec4ba48c9f", "comment": "Malware payload", "value": "3c63de3bd7238f6dac27dc4438d69fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522034, "uuid": "f69f6434-a80a-453f-a0b0-c4d1c3152e24", "comment": "Malware payload", "value": "b6af40bfcecf6b4ba9ccb50f9ff183c81a0569c5156f35c9da67fddf8185733d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522034, "uuid": "f9605c13-1e94-4358-91d6-d65b89d76151", "comment": "Malware payload", "value": "94eaad7d41923a7790b9d1d063dfd3ba79d64eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767522034, "uuid": "14fd60eb-37dc-4e4c-83da-117b5d55a380", "comment": "Malware payload", "value": "830476e71215b21e20cd95f0900f5c265c209bd3ccaabbf09c069979be1fb997a3eb7a9fc2527e637b40eabd75f86760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522034, "uuid": "9a69fee6-0b7f-427f-906b-7a55910aaf80", "value": "T1DF086B4262EA04C4F9F7DA759AE66617C673BC122F30D5CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522034, "uuid": "781c5aa2-8032-400e-aad4-95ad0ac66be3", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522034, "uuid": "a9187c91-5bc7-4e02-8792-733dc03e7557", "value": "393216:8kmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoN4:85NmdsJY62A0y8Xy5rs3wbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767522034, "uuid": "bc329fe8-4fc1-432c-86da-98c104711346", "value": 82027509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767522034, "uuid": "fa7a5206-4f96-4b83-a36d-deefa175c178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767522034, "uuid": "7a3d3070-e252-4291-8da6-e648df0c650b", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203d2323-e93b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767510060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510060, "uuid": "d095fcc2-e18e-4ea2-be23-ebb173620073", "comment": "Malware payload (Mirai)", "value": "336057e0016e4cd35ac43ee31062f196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510060, "uuid": "68027bb9-ec0f-4fdb-a746-4e8ccbb88856", "comment": "Malware payload (Mirai)", "value": "b708a008d3173c59dd002c57a481072b7e85207fea0d96374f8d73fa3ac451ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510060, "uuid": "5d27e31b-b58e-49ce-976a-2354e5fb71e0", "comment": "Malware payload (Mirai)", "value": "808f00cbd9682fc4faa7a7a69b7183f8cb4e809b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510060, "uuid": "e9765301-c2d9-4102-9e3d-712a41638b98", "comment": "Malware payload (Mirai)", "value": "afe3214e3467d11db65aef5bc59f83adc864b4e061d9168ada59529b1dc2e7e3659f8901a7a160fe2fb2aaf3fa07809a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510060, "uuid": "0d758814-62b3-455c-b2cb-ce23b6ad6ec9", "value": "T1D234C70E6F228F7DF7A987344BB79A20975D23D627E1D584D1ACC2105F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510060, "uuid": "80382970-48b4-4233-8e9e-adb91e05bede", "value": "6144:FnhtuaDnTiWF45B22j40Qg1KVCiF/zmYADJk6l2b2Y/tFTDiczFtorIE2klxzbAu:spQXgnqoPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510060, "uuid": "0e6c74a8-83d5-44fe-bd8e-52a095c562d5", "value": 238492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510060, "uuid": "2e817b29-b30b-476a-b41a-a7c5d654a48a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510060, "uuid": "10ae15b0-0976-4b8d-b5de-d88f9955f564", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3783b5b2-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511387, "uuid": "a3e4b463-c4da-47b7-aa1a-455eaa889a37", "comment": "Malware payload (WannaCry)", "value": "132cd5c5c2266a5f712bb76fc2e42c3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511387, "uuid": "151c3e7b-da45-4e85-8bb4-f645233d8cdc", "comment": "Malware payload (WannaCry)", "value": "b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511387, "uuid": "4f442f56-19db-4431-a09f-62a7ee76651f", "comment": "Malware payload (WannaCry)", "value": "fb64a5fdf3a976c8aaef32e67e333588d8683e7e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511387, "uuid": "405e2ea5-0b18-4e71-8a49-e473b0523f6b", "comment": "Malware payload (WannaCry)", "value": "527fb56620bed5c1d502f661fa70ac9a4e5132d947a240f97860d4af2fa280a967c4cbfd9d1ceb7129f00804d4775f73", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511387, "uuid": "0c4db0ef-0e65-4ca8-80f1-7a4c1359df7f", "value": "T166363344E2AC66B8E1A10EF504B38B29A7773C559ABA9A1F5380415B1C73F4EEFD0F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511387, "uuid": "9ac7f544-26e7-45ad-be2b-f6f81033ff8d", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511387, "uuid": "cb49c975-fb5d-405d-87e5-912e0b151300", "value": "98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2H:dDqPe1Cxcxk3ZAEUadzRkc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511387, "uuid": "152aa077-ef2f-43f3-a12d-4590e7f68475", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511387, "uuid": "705a5ba0-a8dd-4c7a-93f9-56bd2f7c01a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511387, "uuid": "a693c546-d39e-47ce-8f89-3e959ed86cad", "value": "b76c49cbb1a72437bb687db48f42525d3073a3a0356b7fef0220f707e0547539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3c374c-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513058, "uuid": "fff85055-2739-4cc0-a44a-c49633705f24", "comment": "Malware payload (WannaCry)", "value": "883eef9b99208625ceed633b6664d818", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513058, "uuid": "ca407a6e-bcdd-40b5-9203-0d3354ada38a", "comment": "Malware payload (WannaCry)", "value": "b7ea78a5a1a403388e8885039a4907017f877681f8813f52055460b4105c48e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513058, "uuid": "b587cbf7-6eb3-4c87-ad3e-a3e70694931c", "comment": "Malware payload (WannaCry)", "value": "7d3e42a45398f2b4223900bb7ff264b912fa49d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513058, "uuid": "770b4ffd-2871-419e-91cc-498b036816fd", "comment": "Malware payload (WannaCry)", "value": "74d1d1c2d05270574ed6787bf220d78e95dccb4f1672a530690eed5452a865803a7802e4e335567414cfd6270a2b5950", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513058, "uuid": "f9966f01-8e3f-4f48-b5db-886ffd9b75d0", "value": "T1F836236A766C90FCC10A627574634A6696B73C9A32BD960FCF9487620C03750FFA8F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513058, "uuid": "7b65da35-9b8b-44fb-99c7-8442a39e1452", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513058, "uuid": "86b75aaf-9258-4d87-a6ff-8156573a15a6", "value": "12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFO:SbLgddQhfdmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513058, "uuid": "b629b74d-4b56-478a-ac07-90d3b30b4901", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513058, "uuid": "7180aec5-1519-4cd0-a743-8e5769f746d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513058, "uuid": "94bb9cc9-aa76-4b73-b419-fb653630a2c2", "value": "b7ea78a5a1a403388e8885039a4907017f877681f8813f52055460b4105c48e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc93a87-e9be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767566565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767566565, "uuid": "170750d8-ec47-49b0-9331-d0ea32165371", "comment": "Malware payload", "value": "362a25bd018488ba37da1871e404b78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767566565, "uuid": "c7395834-4448-4f19-9bc5-6d513ca8a957", "comment": "Malware payload", "value": "b8d1c0436023bf58ea7b0f530ea37ae67bac0e956d9c93376702b4832055e0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767566565, "uuid": "0817896a-4eef-40a4-a56d-2477d7ae7899", "comment": "Malware payload", "value": "89b3c64dab355d6199d2ffce37890845119b4a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767566565, "uuid": "f7a85394-99b3-4378-a558-61ba7030d2dc", "comment": "Malware payload", "value": "ee6b71fc8e6928f78ffe21db4146c4ead48cc7634c44429749443458eadf823313334f02aaab2e5a013b6ee8a9ef6a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767566565, "uuid": "483ed577-ef9b-47d8-b37c-29b5b7684e18", "value": "T16808339E9659A852F66A4336C722C74DF5D2F01E426AC50B2BF000363D9B6CF95FEE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767566565, "uuid": "7c3aa063-9dc9-44ff-a667-17a31c040963", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767566565, "uuid": "cf0c27dc-847b-41ba-829b-ccea269b38df", "value": "1572864:P7g1/IKcjPEhqKVZVd1AEJ5Rh1+BDDy4gds8KN2BAW+eHF2qHWB75ildLRufxktx:PcfjVd1AY5bADDxgds8312qHO5inL8f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767566565, "uuid": "7951882e-057a-4b55-9cda-e21358e837b2", "value": 77486844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767566565, "uuid": "06748a8e-82f6-4c1b-b521-d6a27b434424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767566565, "uuid": "d49e824a-1151-4139-8a97-839c281866d5", "value": "b8d1c0436023bf58ea7b0f530ea37ae67bac0e956d9c93376702b4832055e0fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac1fd8f-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555148, "uuid": "e92c15f0-c3a1-4943-9552-bcb147784dfc", "comment": "Malware payload (Mirai)", "value": "09e21ce5ced2aada28389449e7556325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555148, "uuid": "cd67da34-8604-494e-9344-9a68334b95d7", "comment": "Malware payload (Mirai)", "value": "b93dc603733662d5c5334167603583b0d1dec694685c1d59f5e3b0d95188ab49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555148, "uuid": "f3f7e16c-0d85-4be9-ba62-696cb7fa4a8f", "comment": "Malware payload (Mirai)", "value": "b48a052b4d44d1bf0b1d1afd49e591270d17aa50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555148, "uuid": "3024092c-def7-40cc-a7ae-eb217efa669f", "comment": "Malware payload (Mirai)", "value": "af3b277aa805523ff5d3e5a0f540b1e045524d700942d5678a7e2d3f969d64669218f74750bc10b8653e95389770bbe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555148, "uuid": "8181c8e8-b8ca-4d48-bad2-5ee8bb9558bc", "value": "T1EC64C5BA7750BF9AC378C23805F347E996B2235116A38505E12DCA3C1DA138C5DDFEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555148, "uuid": "83ad2fd5-869a-45c9-8ac5-c68b9c61e3da", "value": "6144:YDoIJkjxB5h+pR03bJJQUegxV8oZ9Sv1hw+0UOgbu+6zJN:wo26KgDqXXOW6zJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555148, "uuid": "44cce702-488c-45f4-bfb3-9fd87538a456", "value": 315728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555148, "uuid": "e8b03e17-f1e7-4339-a6a7-265090e3184f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555148, "uuid": "83f99811-8eb1-483e-8d52-90e0b77dc18c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73c6bc6-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767511226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511226, "uuid": "7acd321e-3d03-41e8-8f39-a5cdf2b4e118", "comment": "Malware payload (Mirai)", "value": "c30f9dd85b8e659a474885b3626965ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511226, "uuid": "3ec9e584-e08f-461a-99d5-fd42cdb4bb05", "comment": "Malware payload (Mirai)", "value": "baa115685aa1f8e822f828b100d6e53235c25d3f5d64b1d76db8d0240a850a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511226, "uuid": "359af80b-2eaf-4135-9e54-7cc20915ae1c", "comment": "Malware payload (Mirai)", "value": "884aa958f2713b2d28166191c614149c781a0012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511226, "uuid": "8e9f1a02-eccd-46c8-ab51-cc3e0db26324", "comment": "Malware payload (Mirai)", "value": "fd5e6120eb4e6e9ff535045da5dd43ef0cb7ca20ef53b0f2b2b181dde11c2e1d90b97c2bb3ca51d36d0963352f7cdc07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511226, "uuid": "c6ee87b3-93e6-4ff5-b535-7b860492d1b0", "value": "T185043906B5CCC0FDC89AD1344BAFB536D971BC5D023CB25B27C5AE222E4FEA05A2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511226, "uuid": "92f23409-502b-40eb-a2c0-0f947ba2ac05", "value": "3072:lZBh9eWdVFe5uF9Oe1BKTssZ6re6IPjN+gUmcxO+/cztjRlfhsV:lZBh9eWHFeXC6v6q+xV/E5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511226, "uuid": "a66f7a4f-201c-427c-876e-fc8faff6e535", "value": 189992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511226, "uuid": "653b85be-47ec-49e9-9d8d-b699e4b45f24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511226, "uuid": "2f9a8aa7-7336-427a-b20b-7f38764eadaf", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc8ddbb-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512924, "uuid": "01d05347-3350-496d-b0da-c80ee8d47464", "comment": "Malware payload (WannaCry)", "value": "bff0aa6595e3fc250a32ada5ca1c0cfe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512924, "uuid": "7e0cc4d0-f215-4e6d-bfac-117277ee3c2f", "comment": "Malware payload (WannaCry)", "value": "bae676adf235b1ec80ef24c7db5531ce7ac1a3c74124bbe405e9f4c98d358624", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512924, "uuid": "9f0a2d79-7102-4db4-a992-0e9c3a181036", "comment": "Malware payload (WannaCry)", "value": "c9b1d78fe33b96b883af27aa01bc55fb52a22bb6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512924, "uuid": "c7b12b47-41c1-4889-aeca-013311ae14a7", "comment": "Malware payload (WannaCry)", "value": "bbad4bb9fb4067f8c4335d28a74c1774777cf90d4b5806fa4c425e1f47e968005270c434b223534202e5b5a105ad1234", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512924, "uuid": "04e6c992-a26d-4e57-beee-2cbfa004d169", "value": "T11D362369766C90FCC11A627574634A26E6B33C9A32BD960F8F9487520D03760FFB8B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512924, "uuid": "1b027d64-4d2a-4e04-8063-90f126007642", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512924, "uuid": "e51957e2-3d4a-40f6-870f-90b2d755e0ff", "value": "12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFO:SbLgddQhfdmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512924, "uuid": "cd0f4013-b193-42c8-9669-fb56e3b24ac4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512924, "uuid": "056d75b5-2230-404f-8b38-b8da2c77468d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512924, "uuid": "615bf176-4ed9-4391-b9f2-3c282f9a8181", "value": "bae676adf235b1ec80ef24c7db5531ce7ac1a3c74124bbe405e9f4c98d358624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c606b22-e9b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767562425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767562425, "uuid": "dd886aec-a557-4147-8fde-b2f9b7cfe4ef", "comment": "Malware payload", "value": "e5f76b2db75723b2803f5d4a5b5187e8", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767562425, "uuid": "16bde3b7-1a6a-4316-85d9-d0e5858bcb41", "comment": "Malware payload", "value": "baf43d31ee9e62706ca5a894735202bbaf918729a09bcd91b5066b8e820dbc90", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767562425, "uuid": "a0709175-e8da-432f-9644-08fb64df9a9c", "comment": "Malware payload", "value": "23e0ceb34a9d968465054fb7fb32e205f9ac786e", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767562425, "uuid": "f86bafd1-d4bd-44e9-b46d-f17e92fe3eab", "comment": "Malware payload", "value": "35853cce47009f6208c7aafefc3083894ae8ef93c437304826522128fecbe2d044b77df5f973791def6c930b0b50252d", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767562425, "uuid": "a1937ccd-014c-4293-978f-e9b8aa563e2c", "value": "T1CD448D51BAA40CFDE97BC13CC9524906DB72BC5A07A1EBCF07904A925F236E49E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767562425, "uuid": "02996fb5-ef3b-4224-b2cf-388a5d2343ac", "value": "0bc790d86115172fa0bd2d854a03262b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767562425, "uuid": "917f186a-71c8-4257-b359-eeac0984478e", "value": "3072:mNOwqK4rgK11DQFhjFs5zlwuSnXrZNkxIEAL9DVdUr6RFhPp3YVKrw90C8/NHLXI:8ORK4rg+1DOpskTXlNkxM/smwn8BobE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767562425, "uuid": "43217bfd-d6c8-4418-b448-df4a2f604c6b", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767562425, "uuid": "693c2296-15af-4cb2-856a-3a85821262f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767562425, "uuid": "843a2261-8029-4c11-ba15-5d33c5c1cb1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d09164-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509903, "uuid": "38ea5264-be21-4464-aa39-4423135dfbad", "comment": "Malware payload (CoinMiner)", "value": "04708318e117dddb89c9b10feced74a5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509903, "uuid": "9cdf9c73-dc02-4d9b-b395-66a9c435156a", "comment": "Malware payload (CoinMiner)", "value": "bb232ee51f8bac9c3054ea8d29a24b31de371b37bc9d1aa6c9b90c58a01f4174", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509903, "uuid": "4f53f5bc-be9b-403e-8857-f824c19814d0", "comment": "Malware payload (CoinMiner)", "value": "09523f831adadd3ef0a3e04d9f8b8631f611f0f9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509903, "uuid": "b258ce9b-e727-4d13-a22d-be3a17e6b1b8", "comment": "Malware payload (CoinMiner)", "value": "0c04188ee2eb1fcf53eb6d0565406cb96d90ce450d3700e09c8227be5c185e0063ba95e324de91c97ffbfe045ad5fa08", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509903, "uuid": "c056bf51-c04d-41a6-acf5-e137eab2fa83", "value": "T1C78533A000C2FBBF969CDAC458F873311E1559E02639556AE84F4C67FC72FE906A7D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509903, "uuid": "9a339c14-e8cd-4216-9a0c-91c24907823d", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqD:G3LG658+S8YrCpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509903, "uuid": "a0de2148-c6db-4f41-b069-add1f9124d5b", "value": 1798144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509903, "uuid": "be0ce1bd-8eaf-4ddd-90f8-0ba7a737475b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509903, "uuid": "b2d02dff-8416-4778-99f7-79c522f6a72e", "value": "bb232ee51f8bac9c3054ea8d29a24b31de371b37bc9d1aa6c9b90c58a01f4174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623e97e6-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509741, "uuid": "1615b61f-6a5c-418b-aa50-94f910eb3991", "comment": "Malware payload (CoinMiner)", "value": "c99ccbbbb6df33891c72a5a4e4f40108", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509741, "uuid": "705c27d4-1595-4eeb-8de6-29d77fb7bfd5", "comment": "Malware payload (CoinMiner)", "value": "bb7392bee24eacd2aeebca23ae2adb4a94176cb299a641f1b220e3e0ffa163d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509741, "uuid": "39b1181a-2e1b-4494-aafc-fd0cf532762a", "comment": "Malware payload (CoinMiner)", "value": "64e1bfa2762d26c87e24ba10a2e139210a2570aa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509741, "uuid": "e4073b55-7e7b-4e63-8d65-140cbf82fc0b", "comment": "Malware payload (CoinMiner)", "value": "6f2b83fd02ca3ca043b00ca371270b6e3ee07c285586ca5eae7c6890d7dd08aaec01a1fa818f40bcf183ee5d9a5a05fd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509741, "uuid": "c0c0f268-eb6c-44a2-a00a-b4e61ccb5062", "value": "T103A5335102C3FB3F909EDAC4A4F8BA351D6655F06B281A52785E0C5BBC32FF901B791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509741, "uuid": "5b380faf-9306-4882-b633-77ea6621b6da", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuX:G3LG658+S8YrCpHy2dUuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509741, "uuid": "730fe44a-1eb8-4bcf-a2d6-eeecd9364c0a", "value": 2211840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509741, "uuid": "d3f8a784-962c-4f9f-8b0b-a37fe9915efd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509741, "uuid": "ea2f3fee-253b-4c90-aad8-45c65ea82e6d", "value": "bb7392bee24eacd2aeebca23ae2adb4a94176cb299a641f1b220e3e0ffa163d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a1166f-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555493, "uuid": "36f6150d-26e8-404d-9d09-1f25e0a2507a", "comment": "Malware payload (Mirai)", "value": "bfcaec8216beec079134ae32c3cab6f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555493, "uuid": "5858bfae-4953-4d56-a0bd-52583b02c2d4", "comment": "Malware payload (Mirai)", "value": "bb7d28f1e824f600b852634a4cad3d9c361b292b85f5f8477b69b7e33d7c233a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555493, "uuid": "0027932f-3862-4361-bcc5-87a69ee7de48", "comment": "Malware payload (Mirai)", "value": "4cadf02f8d7a6315df8805655751606c876bedce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555493, "uuid": "11438431-33bf-4e86-9b54-e6bf6ce6eaff", "comment": "Malware payload (Mirai)", "value": "df35f0ecf7ac9a13448ae38743f688ed7dcd1c092af3080ef64ae2cde87fe6c7df1a8a897c39c324e8f96857c8eafdab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555493, "uuid": "f88d250b-6545-4f2b-92a4-a349c7786e1c", "value": "T154043A26EE50C0AEC052D5B86BEBC1B2F731F8B40321761F73996E363E65E505B19346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555493, "uuid": "9585fec4-66c1-4ad2-abbb-ee87d8771322", "value": "3072:Gi/2UiesF4y+hCGxZ10qgHXd9IdW0ButoRNoQ0sbkuG/d+b6PDarFTd:rhiH47XzuXdOdW9Gf0sbFV6EFTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555493, "uuid": "85327115-29c9-4e04-b3ee-b8404745c9f7", "value": 174432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555493, "uuid": "a4cfbd69-c8db-4dac-b9d3-0942423ecc2b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555493, "uuid": "550bbf76-9ac0-44ee-94c7-86c0e92d27eb", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaa2ab1-e98b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767544685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544685, "uuid": "03b67f9c-797b-4b92-b731-859ee31deb66", "comment": "Malware payload (Vidar)", "value": "53947098f8c5cf4c0d833f8072bfcbe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544685, "uuid": "1ca1797d-3dfa-4e66-b26f-d1a1b3a88cad", "comment": "Malware payload (Vidar)", "value": "bb9c04f1737f431635090ec436ffb5e79b2259f7bbfe2d9c65fb6f3799828ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544685, "uuid": "75acb3b5-f2e6-4603-b676-d839196e9bce", "comment": "Malware payload (Vidar)", "value": "e3b20acda4b6b677b464087d3254f7b4ac030a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767544685, "uuid": "9042dfbd-8fcc-4faa-9c1e-13ad6d8a30c8", "comment": "Malware payload (Vidar)", "value": "7d608d94bbb1bcc9a9fc5995f6bb79b751b34d8f8c58cdfa7a22e4142349e6ab00817c2d72c0a68dd64a07a010502692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544685, "uuid": "b72c62ca-5939-41c3-86ae-01a188599403", "value": "T171663A83AE408229C59BD239EE79625AB270B085433113D77F631BB95DC7BC4173B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544685, "uuid": "51d25664-32c5-47bd-a13d-c02d8da7daed", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544685, "uuid": "f55ce4b9-9967-489d-8619-84c2909d128a", "value": "49152:Bo387rb/TMvO90dL3BmAFd4A64nsfJD+rOPpxctdMSE3JWcCIvT8RfK1JkBIxxRl:BoyUOP07Rfw8IRAc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767544685, "uuid": "d8e3b574-4705-48ad-ad82-ac8dfe560280", "value": 7101568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767544685, "uuid": "d8fa9398-63b8-4935-aaf6-2764a8ff9de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767544685, "uuid": "5efe2f69-4176-4884-820d-5c36073dc7a3", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce09e11-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511906, "uuid": "ce1db691-32bb-42bd-96c0-01beeef90eed", "comment": "Malware payload (WannaCry)", "value": "c59cee99d74fff7bc2ad17d91b6684b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511906, "uuid": "6dee224b-5ac8-4677-9440-7256d793dd80", "comment": "Malware payload (WannaCry)", "value": "bbac9662ef8309f4d2bbedc7a13a591072d6616be1c3e1f4ba1a6b4de0573c04", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511906, "uuid": "265fd567-de4d-4434-81ad-3c9a55109576", "comment": "Malware payload (WannaCry)", "value": "0c427b409ff5fcb25ff7c8f536aa0e18043ea161", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511906, "uuid": "078c696f-c2ca-42ee-8dba-fbf36e80b4a3", "comment": "Malware payload (WannaCry)", "value": "16c2d0fbc3a50475408bfc22c0bb63a7fdfb088906754045e5d8522c00f24deb31e8e3a9fdb78a09a1cd1be9de895f00", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511906, "uuid": "c73db0ed-8ed1-43a8-9a7b-aca7820b5325", "value": "T1AB36339971BC91FCD206297544BB8A22B2B33C6D26FE6E0F9F4049351D43B55EB90F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511906, "uuid": "b9541d2a-cf23-4a5a-bfff-169ce26ef810", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511906, "uuid": "a716b1f0-a86f-4449-b625-662cc3093a6c", "value": "49152:RnnMSPbcBVQej/1INRt1HkQo6SAARdhnv:1nPoBhz1aRjk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511906, "uuid": "5f93bb06-e3cf-4e6f-9954-9db79ab2fd42", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511906, "uuid": "f47d59ff-84c7-42ce-9a7f-096b2a328e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511906, "uuid": "e1334337-d7ee-4686-995d-7a56bdd9363a", "value": "bbac9662ef8309f4d2bbedc7a13a591072d6616be1c3e1f4ba1a6b4de0573c04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bfed89-e98d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767545558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545558, "uuid": "7586ae67-ba24-4d9b-ba04-84d8fd6e17b1", "comment": "Malware payload", "value": "18dc3f2587e0b146a1b503ccf3d4703d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545558, "uuid": "505b8a1f-cc4d-4986-896a-b5edf7af32d9", "comment": "Malware payload", "value": "bbe599986aaa90079525a756511ece723988a21eaafe9ebe3474f7c5bee6fa60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545558, "uuid": "e7da7536-c7e5-4dac-8653-863ef7f0dc9a", "comment": "Malware payload", "value": "0e5229fe45de5b629149fcc5a517fbad8af961dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767545558, "uuid": "4aee7189-402f-4b75-beba-3fc07dafb6df", "comment": "Malware payload", "value": "d95bbddd4b4401e229258762e73ac0ca384ba5ec7dd73140bd401bc7bd073e139714765679d1bab44f942a8b4be033e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545558, "uuid": "93639bf6-b6ae-4893-a06e-598a2d6e0392", "value": "T105187C4263FA09D6E9FB9A3489E65213D633BC062F3086DF724C176A1F736E04976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545558, "uuid": "e6f0622d-25c9-4d59-ae9a-3b3571ec9591", "value": "764090509664248d5254caeebe1e7af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545558, "uuid": "6cc70e11-e630-4fab-a97a-27a52eb59e0a", "value": "786432:ElI33vITTYy/5AYtzT/9tf6QvpgPVlcm2wq:L33QTTYA6VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767545558, "uuid": "5a520e02-4e82-49e1-8d40-2bc5c723a6a9", "value": 86546170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767545558, "uuid": "5650929a-7e63-4c1c-92fc-34b99d4b5085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767545558, "uuid": "fcce8de9-abe2-4f04-a59c-d7c5d075ce1b", "value": "Oblex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cf7258-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512374, "uuid": "a24413a6-7d3d-494a-a45e-61ed0d083b88", "comment": "Malware payload (WannaCry)", "value": "78c4bdfcf25809ee9b641f652c7ddc5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512374, "uuid": "3393a68c-071c-435c-a4a7-abc456366ddf", "comment": "Malware payload (WannaCry)", "value": "bc84ef9aa6a4363396986468c5a50a11dae4a92ca1e00770554c39bc7c7839d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512374, "uuid": "92bfe3c6-3870-4858-b913-87ea32e58a1f", "comment": "Malware payload (WannaCry)", "value": "c2f3b043ef15856938d0faab2799515405bcf775", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512374, "uuid": "f6c92fe8-5354-4586-a384-02a36b415b32", "comment": "Malware payload (WannaCry)", "value": "e44b43e395ed201579d99742120e0b7fc418b00d59c832a43c7863c7e1a514f482e6bddd13e30b9458d18f23aa13201f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512374, "uuid": "d8359ada-b541-440a-a3b6-b01a81e194ac", "value": "T10236DF00E1E42B60E6F25EF626BACB10477ABE46995B965E1221514F0C73F1CCDE2F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512374, "uuid": "b136dc1f-5f63-4f5c-8a51-424f0e9edaf4", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512374, "uuid": "e765f69e-c6bf-4236-8cc8-c869b3a691ce", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhhP55Vp2H:TDqPe1Cxcxk3ZAEFV4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512374, "uuid": "67e57eae-7ff9-4e4c-a7e9-69dfbd19165d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512374, "uuid": "c03d7d4e-28af-4036-86de-96e316bf0570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512374, "uuid": "b1919b4e-45b1-4cc1-acca-f41573818344", "value": "bc84ef9aa6a4363396986468c5a50a11dae4a92ca1e00770554c39bc7c7839d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae94b538-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512446, "uuid": "f301dc57-e6b7-411b-ab96-5e09a870ed6b", "comment": "Malware payload (WannaCry)", "value": "d48e7ebef8005a893d0d4c6a8c020a46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512446, "uuid": "7c2f2df8-b42e-4534-8fe7-3fe11c571aaf", "comment": "Malware payload (WannaCry)", "value": "bccf65c40db569d8ca72a23003d794ab0716507dc5b53f012c7c9b3a1f05a84d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512446, "uuid": "7523a8f3-b0f9-4864-9aec-c7a334b577a8", "comment": "Malware payload (WannaCry)", "value": "d6d720fbd8ceaeac815e128a6be9f1d3c412a6ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512446, "uuid": "021c7f79-0ab7-40e5-912f-f806d6f63e81", "comment": "Malware payload (WannaCry)", "value": "8d04139223f85ff4549ded2fadd1fe9874a9a96022fb32d19da1a84328996f5c111ce0b095d524be19bb4e61de25e884", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512446, "uuid": "e81f9120-1075-4fba-b4fd-d53239bf4395", "value": "T1033606838007156CE46DCA71D2ED1BA0C92B5EA57A6CB08D6F13BA4A27F31D3F596D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512446, "uuid": "db960468-3964-4596-bbc4-bef4fe760949", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512446, "uuid": "8d045966-b9ec-4b40-93b3-6960109b93c3", "value": "98304:+DqPoBhkPOZRSV8tAT2q9c5fDaNwbQf1YTza3R8yAVp2H:+DqPfGZAW82q9ctOi46ER8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512446, "uuid": "3b3a300d-f79f-4c6a-b54d-ab5a864f072d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512446, "uuid": "8475e776-ffdc-4394-add0-79c73a5d98b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512446, "uuid": "66b3764e-0490-4b19-8d8d-c2dbb7b5dd2b", "value": "bccf65c40db569d8ca72a23003d794ab0716507dc5b53f012c7c9b3a1f05a84d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779f3f7b-e96c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767531252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531252, "uuid": "e2c5d659-d2a1-4617-9b60-5b61a028b3e5", "comment": "Malware payload", "value": "aee266ff81db4bf67cd65e5d2e1c12b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531252, "uuid": "3ed2c072-5db9-40d0-9517-2a5b3250841f", "comment": "Malware payload", "value": "be6d99967452433fd84e6767f69fcfaf40618927207a09e5c625b59e764fa12d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531252, "uuid": "2d799fad-14c3-4589-bbf2-e553604c087b", "comment": "Malware payload", "value": "bd038065917f54d47040a8b1bc4e73c512703a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531252, "uuid": "2ed2e453-2def-4cc1-93d2-419a72cbaff3", "comment": "Malware payload", "value": "e6c4870f677c2db421087d312e05b62654be5bee73aef3d32a0daabfe73b6c309230bc3c535ea0ad6f5f560e2813ee7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531252, "uuid": "24af1bed-754c-4971-9666-c9da8bcc2f36", "value": "T14796334873B044DAF9FBA13F66625082B3F2B0224761CADF4BB8439D2E4B5F54D39649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531252, "uuid": "141c8648-f03c-4ca0-9ae0-8269721df55a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531252, "uuid": "2b171bde-20e6-422a-813a-9e1aabd5c67d", "value": "196608:NUhkemtbW897GJr1LDsBTG9WdyCMPWhqWQGa/R6:NYM1S3sB1wzCqWQhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767531252, "uuid": "dcbef8ed-2823-41ce-b177-fa9ad524437b", "value": 9374397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767531252, "uuid": "98177786-46e8-4437-ae4b-03f1bbf1a399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531252, "uuid": "ff0a1875-9b6d-46ce-a796-bb5851c1cd91", "value": "MinecraftGenerator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f881672-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509173, "uuid": "55a100f3-133c-4544-b17e-de35e9096dc9", "comment": "Malware payload (CoinMiner)", "value": "320db436bfdba35675ca56289db5fc26", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509173, "uuid": "f5f25c5c-fe53-4a8d-8875-7c785f26abeb", "comment": "Malware payload (CoinMiner)", "value": "bed2d4cb0507c84fc603cb6ca030246eaf1d9b076aaed72dbee081568eedf1da", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509173, "uuid": "95591e19-ebad-48a3-bbdc-cdea84b8b600", "comment": "Malware payload (CoinMiner)", "value": "86e3704946ccf2b159b7fab7fbe357ce9a3b5eaa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509173, "uuid": "ca60eb63-4f6c-4d45-aece-3e2d6e7a64f8", "comment": "Malware payload (CoinMiner)", "value": "771c717e986b0fd34c538ddee440279f6cfcd1754e55a22ee89fa22f32615f0de057f8dce97cfef2f0b26a88d6230f74", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509173, "uuid": "e0fb9298-50d9-4b4b-b7a8-c93f370c691f", "value": "T1CC06336201CBFCFF6985D46858F8FB360F9555E19E784165F9290828BC26EE3407B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509173, "uuid": "19516f14-74c1-468d-88e3-96d91391263b", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgI:CC65sr3KrCfsYiZQgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509173, "uuid": "8d2e7204-328e-4ec4-8fd0-687d9dba15db", "value": 3911680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509173, "uuid": "871b2c8b-df2e-4e32-9dbf-ff09947cf631", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509173, "uuid": "be715bd7-3304-48a0-8013-914ae8bd0126", "value": "bed2d4cb0507c84fc603cb6ca030246eaf1d9b076aaed72dbee081568eedf1da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ac7292-e93c-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767510770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510770, "uuid": "a10e7ac6-9adf-46c7-bba0-803849f97f90", "comment": "Malware payload (WannaCry)", "value": "0a3a089906fcbd25904c8c8d7464ffda", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510770, "uuid": "8dfbe1a6-7138-483d-b8b0-45ab423203d5", "comment": "Malware payload (WannaCry)", "value": "bee4be30c05b499d7c25a7f69a66db634322678d50f5c80557a9306fc198510a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510770, "uuid": "846fb677-7840-4085-86ff-c58729d7b448", "comment": "Malware payload (WannaCry)", "value": "b0f516e98d74f1ee231d9671f8963bc1b282d90c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510770, "uuid": "00316f0e-3092-461f-aa98-3efbe64e15e8", "comment": "Malware payload (WannaCry)", "value": "072458424ba98ee3821e63d29d077f9d594aafc8cc190ebe1051f89ea6677e0a5caf8595820215e4c57eec64249a5143", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-0144", "colour": "#7AA8A6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510770, "uuid": "cdd7ff09-56a9-4e3b-a75f-8f99e482d982", "value": "T15236236A766C91FCC11A6230A0634936EAB77C6A22BD970F8F948B520D13750BF74F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510770, "uuid": "6f180c39-46b5-4934-b974-cfc15ca564b0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510770, "uuid": "a73001bb-5a4a-4777-8ca3-2f7fc5b4f2af", "value": "12288:NvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:tbLgddQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510770, "uuid": "3b8794b8-c84c-4619-9769-4738d674ff82", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510770, "uuid": "fdc6603a-f6e7-4f02-ad47-9ac1a5160d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510770, "uuid": "6c954ee8-c6d6-4f66-990a-4e7f70b402ef", "value": "bee4be30c05b499d7c25a7f69a66db634322678d50f5c80557a9306fc198510a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8c8a74-e948-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767515983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515983, "uuid": "8ce0fa3d-c478-49b9-ab06-c6985968f0be", "comment": "Malware payload", "value": "e76708a259b84b44c099ae3e4c44929c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515983, "uuid": "38c97d22-24a7-47aa-a5ad-960b3ee41261", "comment": "Malware payload", "value": "bf85a5f736f2026d9525ee57e0cd96bf8aed02862355ae2350dd3de76a9771f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515983, "uuid": "3723e457-a613-4c72-8dbc-e18acba5f2cf", "comment": "Malware payload", "value": "427845500db7fe4345f9ed075aa7d06000c7603c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515983, "uuid": "fbd0c6a5-e000-4208-832f-687cba7e9e74", "comment": "Malware payload", "value": "bef4b5c567ec76e6ae4ce2b2ff0163c257cad68e76f9d1baac6cfaff448b29010efb5da25d02802784459bd46ac5f41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515983, "uuid": "bd5bf2f8-1b0a-48cc-9838-e96953f4920b", "value": "T14B42184BBA960CF9E53A8272C0731E19A4BAB7119332479F67F554211E712C0BC7B68E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515983, "uuid": "b94b591c-9b25-4677-bc30-c36aee712511", "value": "d4d8d316f05b3a50d628b5e17bdde03b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515983, "uuid": "5347af10-b5f1-4591-94be-4aa016215621", "value": "192:9/2ARQKnj4TeSdF+KfpaxXA+KSfNc6e55tfwcuc:l2UFn8RdF+KBablcV+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767515983, "uuid": "50438422-3c8d-4239-bf40-ecbe50475def", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767515983, "uuid": "e3761562-a45b-49a9-9341-305db515181d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515983, "uuid": "70f0d76a-34c3-4f05-bdfa-29e6dcd4b967", "value": "SecuriteInfo.com.Trojan.GenericKD.78216966.12877.19888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6ea732-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567148, "uuid": "6b4aaa06-6a1e-4cc8-92fc-d3acabd603b5", "comment": "Malware payload (Mirai)", "value": "3c79cd0bfbbd3155611c35a9985da617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567148, "uuid": "ef688c0a-8da2-44a0-b3bf-4a0757deeb8c", "comment": "Malware payload (Mirai)", "value": "bf8c8a847289132ff9606dd7d808f91070dfff0ffdb9a8a4c6bf076697531e18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567148, "uuid": "d58e0d20-a664-489c-baca-a72cfc96af11", "comment": "Malware payload (Mirai)", "value": "3cd8aa8e32836d90011012dd7fd67419e6d9fbf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567148, "uuid": "76a58b78-614d-42ed-9411-59c2e44333e9", "comment": "Malware payload (Mirai)", "value": "1d36222543a0d0e21884728ee0d97652eacb3ffe1579a7081792a59f9ee0cd575216d0c78f6e0a7795baaaed95c43912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567148, "uuid": "fc4f8a5b-b09f-4ede-9683-5aa679b4a1fa", "value": "T1D0238DA6C8796DD0D1588274B9248EBC1B23B405C6A33EFE5E45C66A4007EBCF62D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567148, "uuid": "f28532ef-0a76-4bbb-9f1f-d2cd0f3d2cfc", "value": "768:Fa3wtkeojMWeqUyYPnek1iBGruCynnk+EC9oNibz+CGIc:Fa3wtkZbxQnelGekl5Ns+CGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567148, "uuid": "ad7d33a4-a219-4b23-a1e8-ea6f33d13778", "value": 47700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567148, "uuid": "03a385e5-6a08-4265-a903-d157eaea58e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567148, "uuid": "a89261de-1af1-44bb-a901-cd5d8c03b516", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd018133-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513329, "uuid": "3341bec3-8ef8-4378-9d3f-5124f365903c", "comment": "Malware payload (WannaCry)", "value": "167c15460347daa218e530d842807b3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513329, "uuid": "bf32b8d5-2247-4c0e-b227-db19db30cf80", "comment": "Malware payload (WannaCry)", "value": "c042ff85ba7a6894f6aed99da09f2d0cb6a1915f1aebd75fd47e14380db151f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513329, "uuid": "92ba9205-5118-4e73-a7e7-9f4384a32fa4", "comment": "Malware payload (WannaCry)", "value": "89496b4ce5ef305beee6672a93f91f504fd89e0f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513329, "uuid": "7650d064-7555-4e2a-a8a7-556b02d1c7b1", "comment": "Malware payload (WannaCry)", "value": "059daef8a438ce353ec719dc2ade8b318b53113509e350d289f4c3f8542205e7c9151a963706ecc2e1fe83dd304af1d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513329, "uuid": "592e49e9-66a0-4926-a2ed-0f2def96efc8", "value": "T173363359717CD2FCD10919B404A7CA67A7F33C6A16FE6A0F8F4089661D13B19FBA0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513329, "uuid": "01ea0f3b-e7b4-4f3b-930a-a28c4c40597e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513329, "uuid": "3aef6055-aab3-4fa2-b268-56956a7baaa6", "value": "49152:RnNQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1WqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513329, "uuid": "5b4f14c6-65c5-4585-af8c-e0e3dddc7da1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513329, "uuid": "46e42b1a-35be-4983-9d3d-3d1bf43dc33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513329, "uuid": "58f91af0-c42d-4444-95d7-0dc46b94b596", "value": "c042ff85ba7a6894f6aed99da09f2d0cb6a1915f1aebd75fd47e14380db151f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70257406-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509764, "uuid": "38812331-4b98-4380-8488-df3a2d92352d", "comment": "Malware payload (CoinMiner)", "value": "23988c9b7c0a4a051755bbd54b41632a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509764, "uuid": "055bfa7b-d86f-479c-a912-6499082477c5", "comment": "Malware payload (CoinMiner)", "value": "c0722d705ef0bc96dfa4dccf337460afd5f15e2794aa9f18e10449175882189a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509764, "uuid": "6b3270a7-876d-43b7-90ef-c5ad5725d9c1", "comment": "Malware payload (CoinMiner)", "value": "4c10eb8c8b11052cac7457af475d874debf6af36", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509764, "uuid": "dfcc14fa-722f-4d9a-98f5-727d846a131f", "comment": "Malware payload (CoinMiner)", "value": "e062395ee2a0ac76df95043c44995f5f173dcfc3a6771aa0593d08f161734d15ac10e20e87dbbff3d059d57de35111f5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509764, "uuid": "d540b5b6-760b-4df2-a2ad-9f9f646f867c", "value": "T156A5335102C3FB3F909EDAC498F8BA310E6555F06B291A52785E0D5BBC32FF901A791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509764, "uuid": "a838d2c9-3ed8-494e-831b-831098b855d8", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cu2:G3LG658+S8YrCpHy2dUu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509764, "uuid": "d0241ed3-dbfc-401d-83fe-570b1b6e7dc5", "value": 2203648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509764, "uuid": "11765f4e-d865-4bbe-a818-0ec406415b47", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509764, "uuid": "5a5c9b60-6062-4945-8183-c05efca86368", "value": "c0722d705ef0bc96dfa4dccf337460afd5f15e2794aa9f18e10449175882189a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7557fa8d-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511920, "uuid": "883615e7-032c-477b-b389-93bf6373dcf2", "comment": "Malware payload (WannaCry)", "value": "050c5ed8644eb77ce7e830bdc1fb111f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511920, "uuid": "2eac5415-f10f-42ec-889a-442212ce1966", "comment": "Malware payload (WannaCry)", "value": "c0a4d37a646e772df5b3f0641ca7dae1ea70d5e2752c1dad596e524f3847da4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511920, "uuid": "50d7dfb3-cbde-4834-9d5b-b5df0e8c7bb4", "comment": "Malware payload (WannaCry)", "value": "0259081fdfb69b748683e2c64850ca8b2629ab58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511920, "uuid": "88a54290-d2c6-4f23-8eda-d4f15538ecb2", "comment": "Malware payload (WannaCry)", "value": "b816598f967a585bd55c2e730e98f9eda14974e2ea03455a9e07c9bef42bbb56c77c18c94ef61ece7f9b6c5b2bf3d55a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511920, "uuid": "f9c37f5e-946b-4efb-b1d2-4d89c4c8e7b5", "value": "T13236F543C0071569E46D8A31D2ED1B90C92B1EA57A6CB08E6F27FA4A27F31D3B597D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511920, "uuid": "9dcf390f-f332-4f8c-abb3-5bfc0afc9417", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511920, "uuid": "6672e3aa-562a-40bd-9083-927f96c233b5", "value": "98304:TDqPoBhz1aRxcSUDFNX6P6TOPVAqpYL5XEsWVYP84tot8E3DGm2OBlgQeOBMfQ4S:TDqPe1Cxcx6PGgYk4WCsgn602", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511920, "uuid": "a97dba2c-00e6-47c6-b28d-928102f2e3a6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511920, "uuid": "7066ff10-fa1e-4065-890b-fd46069a8e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511920, "uuid": "41657222-cca6-44e1-88e5-3871406ff660", "value": "c0a4d37a646e772df5b3f0641ca7dae1ea70d5e2752c1dad596e524f3847da4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74aa7c99-e935-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767507624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "c72639c1-dfda-4a6f-b36c-e02b66ddd940", "comment": "Malware payload (CoinMiner)", "value": "7dfcbdf3d6601d7a61ce8481cd38dac8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "d7144638-bc41-4c2c-94a5-574718a088bc", "comment": "Malware payload (CoinMiner)", "value": "c2d04e162c73315355f24f34b625ab8bbefdce6eb722e56e73293158de599139", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "2649afbb-e35c-4d65-ad87-50a00f04d647", "comment": "Malware payload (CoinMiner)", "value": "34e4451d2fa33c75f4a22d1239615d1a8e6a76fb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507624, "uuid": "1f3d4bd1-c11d-48c6-bd62-81f3bfa9c51e", "comment": "Malware payload (CoinMiner)", "value": "e706fd073e78b39b78cc48d99a7409563b4c4da88aa893509df26da1b3b180877c19884b64f59d2902eca8ae36ab935b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507624, "uuid": "95746b59-8c98-4f60-9e96-accb13adde14", "value": "T17366332101C7FD7E748DD89499F8BB314E6A65F19A385111FC2E0829BC71EE640BB62F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507624, "uuid": "b36f6e20-cf02-4815-8604-d45623188f61", "value": "98304:oybBLM2tzuQVE1ldzRNOyZcye58vNzOgR6wE0HkpGoR4abwRd76O//Nfhx:1Jvtzt0dzDQgR1ECk0eM76OtJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507624, "uuid": "27674a89-9c8c-4a32-9128-e78d1b060de2", "value": 6610944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507624, "uuid": "b7e647ac-ffc1-46cd-9520-dc7cc0ce7bc5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507624, "uuid": "dc7a1c26-d3ef-472e-a955-034db2de6110", "value": "466f9378cbfb4a9224bc4937aa22cc776a37dc99e4715681260a2d880e49d4ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dab667-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516805, "uuid": "c95940d7-1712-444a-bea1-e9e2afdcf947", "comment": "Malware payload (Mirai)", "value": "abdec61c8f6d7292fb114ac2d917ad7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516805, "uuid": "53831a26-b4b1-45c7-af94-24584fe6176b", "comment": "Malware payload (Mirai)", "value": "c3189a9efed4eb5463f28c7d80f59f4958d3ec1fdb99d682bffd4c3617e1420e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516805, "uuid": "450a496c-2a25-4054-ae36-c9e969db3302", "comment": "Malware payload (Mirai)", "value": "b3e46a01519ddfc061a8f9cf34b029671bf925c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516805, "uuid": "e16adfb3-9cd1-4cde-ac21-bd1f75f14d7c", "comment": "Malware payload (Mirai)", "value": "ad65c5faad8f14686d6948023442154585b0a25e5dc1a16b814c464fb8ffdfdfd810b046615d72b80512765f360499f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516805, "uuid": "5e3396b2-b779-4e5a-9e97-7810063f1267", "value": "T1BAA35D52FD92DA12C6C521B7FB1E424D372743ACD3EB33038E256F21628A92E0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516805, "uuid": "3d6229e3-6086-48f9-b828-f39afa7d71dc", "value": "1536:J+/GFUAHasRXBDmc7BKsd0GD/SxBrMdMbIqwEJXWOjQ3yaO4gAQ62ndAKm5:J+/GFNHtf7BKEDkBYKkqwKZAQ/bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516805, "uuid": "4a9733f6-12e6-406c-a7c8-7616a311ca51", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516805, "uuid": "89037c3f-a117-4505-a2b6-e3a1e7fc14ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516805, "uuid": "83b7c66b-0151-4994-a0f3-16c958628606", "value": "c3189a9efed4eb5463f28c7d80f59f4958d3ec1fdb99d682bffd4c3617e1420e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92c9259-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509001, "uuid": "8fdcf967-c268-4453-a1b2-9b04988e241e", "comment": "Malware payload (CoinMiner)", "value": "7d6b862c4c13466b8dd1eca9b26cac27", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509001, "uuid": "593e9df3-c56b-41c7-8311-473eea131200", "comment": "Malware payload (CoinMiner)", "value": "c34f73a9a307b7cd5499543ea0cc0a25b33239d1ed667cdc8f970cec0337b97e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509001, "uuid": "3e6a20d3-77f6-4175-9f45-942841a7b24f", "comment": "Malware payload (CoinMiner)", "value": "0941728e6653dc5ff3c65cd24124ce348eb9b496", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509001, "uuid": "6535bfc2-1bfb-4b17-be35-a4703c537f4c", "comment": "Malware payload (CoinMiner)", "value": "e36892d82e3ac81e9a6ad806593a3478de38310274a1cea43d9d6ecc6d4d75237cfe49151ddc5232086791d02914f687", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509001, "uuid": "f0a544c1-b6b3-4e01-8c02-0179c4a7ed8b", "value": "T18916333511CBBDBE7589C864ADF4A7354EA925E19D784105FC3D0828BCA1EE240BB72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509001, "uuid": "fbf56343-1b7a-4b2b-b90f-2629b290262b", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhd:CC65sr3KrCfsYiZQgzJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509001, "uuid": "698fa944-1448-41d1-9289-a5f51e398d62", "value": 4419584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509001, "uuid": "c47ae29e-61e2-42a5-94e9-c94b458eaa6c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509001, "uuid": "7392f23a-990b-47f9-97aa-7a5e81b1ec67", "value": "c34f73a9a307b7cd5499543ea0cc0a25b33239d1ed667cdc8f970cec0337b97e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7e405f-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767554937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554937, "uuid": "2c2df910-0953-4581-8e5a-f17ae65acefc", "comment": "Malware payload", "value": "d0c854ec586c654f71ea27b04cb79111", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554937, "uuid": "9db77a72-27da-4133-8763-795c8ee32ab0", "comment": "Malware payload", "value": "c3cfdc7509a3dddc8fe0d0a46932678acaca3f91db59929bc6d4738a37a3b9d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554937, "uuid": "a4f15e17-9eca-42e1-a201-f03867a4095a", "comment": "Malware payload", "value": "11c1c0447eaa7d06d3ca9a580132a248a88ec4cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554937, "uuid": "40e2fa0a-583f-4385-97aa-4f00cdda000f", "comment": "Malware payload", "value": "23a617174858a009c4eb5b11702f16f4833e0b8d8042ee3d1ed8942ff3798fcadc4eff99686ed00d08f96910e9d9fa07", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554937, "uuid": "5609a01d-7d3b-43c8-9408-e7fed337b154", "value": "T15821F2CF6074B96A5048CF4131E216C975F8CAE5E6708E279E9478F785C86073638EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554937, "uuid": "fe1348c4-b750-4d25-ae09-584fdf6124b0", "value": "24:6j+ELbMsVEcGLNIZEtHDEVKT0CEHZ/EOFELF9S5P3E3e+bEKCeEz3gE1FdEk8jn:g14EQ6BF2S5EeO4rJ8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554937, "uuid": "ed962466-57ff-4b9b-8aa3-2226e1119293", "value": 1228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554937, "uuid": "aea7791a-74bb-4c80-8172-563f2009c93a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554937, "uuid": "752b97e0-03f8-40ac-983c-1712c7839fb2", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24390119-e96e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767531971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531971, "uuid": "7e3d02b9-6476-49cd-835c-0496c70fa5c2", "comment": "Malware payload (Mirai)", "value": "6cf6b01811193b4094a95c3a7d5ab98f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531971, "uuid": "53077474-910b-4580-abbc-f464e345b8ec", "comment": "Malware payload (Mirai)", "value": "c3ea29d7d1d66d4f0e6776e5d592a1a583bde8aa1520a2a8c0fee0b69ae21d06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531971, "uuid": "3e5b6458-28b5-4289-85c9-6a463df3ac1f", "comment": "Malware payload (Mirai)", "value": "cb1fd6b6aa1cdb65ededbde0c2648df36998ee0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531971, "uuid": "92af3513-fb65-4db0-9ca2-df8683508959", "comment": "Malware payload (Mirai)", "value": "a148a28e858ed9d8cf0f0a5f6666cff620469966a7cb63311c5e7109cad5cc066eaa09a49a2cb68d3141fb37dd773c39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531971, "uuid": "8e190c22-656c-49a6-af0b-157789652816", "value": "T11B042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531971, "uuid": "78d03da1-646f-430f-bc48-6274d4b1acdf", "value": "3072:OzeSvtfV84oALv2eEQakGzORuGMzw99Lod38YhTfYo+M/RM+FDhdLn:2eSvJdoA7TEQakGzORuBGLod38+x+M/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767531971, "uuid": "fd05bb59-e65e-4a30-959e-0a9252e6c3df", "value": 181466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767531971, "uuid": "e3114183-b645-428c-b7dd-92b1d823a32b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531971, "uuid": "65a08623-7949-4550-b561-21b805053043", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e394d3c-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511533, "uuid": "b03b2fbb-5999-4eef-8f54-b26c12431315", "comment": "Malware payload (WannaCry)", "value": "c5ff03fe7bb4384a1814c3fe7fe84119", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511533, "uuid": "a68e27db-2164-4b0c-8a09-b99bdc57bdef", "comment": "Malware payload (WannaCry)", "value": "c43333cb1a1ed11d157cfd471881c0bfa89400e12923f42bc526ad0954468bdc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511533, "uuid": "8fa5b737-108f-4a95-9b8b-236c02068530", "comment": "Malware payload (WannaCry)", "value": "fe80deaf861b220a64d9bce6ade5a770455d2804", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511533, "uuid": "8bb88f7b-b090-4a1e-bcca-6df95c34e1e4", "comment": "Malware payload (WannaCry)", "value": "b2c167f4e7a57f67a5f50f4f294c81746658b23fc78cc54c62ed802a0018091d3b44ec4dafd3be5b9034a3215873d9b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511533, "uuid": "c0c4bb4f-2cb9-4c08-9b7c-c4ab0abfd9bc", "value": "T16E3623E1C918D5FBD7BE3975A4A89C2826E13C6E6FD40639F24849D18EE7EE4D041E0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511533, "uuid": "2668bebd-0ef1-4a8e-a398-7b810d14350c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511533, "uuid": "409b3dc5-a513-4ad6-9692-0eded3cccbbb", "value": "98304:+DqPoBhz1aRxcSUDkEQv9Snm1tnr7DRbxyE1CaX+G4Q8F:+DqPe1CxcxkEQv9Snm1tnr7DRbxyE1Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511533, "uuid": "6638add7-1869-4eaa-9a51-71d241efc124", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511533, "uuid": "0f8a8d82-115b-4238-8b6c-483dfad94af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511533, "uuid": "f5f5e554-9c08-470d-9f97-3b05ef616308", "value": "c43333cb1a1ed11d157cfd471881c0bfa89400e12923f42bc526ad0954468bdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef119c4a-e92b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767503535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503535, "uuid": "ba5e61a3-a254-4457-9291-4320bf11ab42", "comment": "Malware payload (Mirai)", "value": "673c690dbad12aa01e0d0623b280f611", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503535, "uuid": "976f6d48-ba84-44fe-8d42-e98edf037525", "comment": "Malware payload (Mirai)", "value": "c4c4a3e240ed0b770427b1a4e371e91f66db9c6d3f5f6cd240e47506a8a28419", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503535, "uuid": "4f7d7786-c160-4750-89bc-c3c35c115fe9", "comment": "Malware payload (Mirai)", "value": "4209e83eb97b52ca0169806e76a70c7fb9ed5349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503535, "uuid": "6a744304-2493-431e-af1b-1ea8fe756b74", "comment": "Malware payload (Mirai)", "value": "a476ee467133ad4b3d009f57de652ca9f640045fd0889500a15406517fef9ed3c89d9a3b56b82edae5732c390a9e888d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767503535, "uuid": "aca8d34b-7bab-4401-af00-03b859bb5d8e", "value": "T185831200D29588B3E2A128B4E4DFCD49D4F76478B8DD4AF39399444F68AA9407EF538F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767503535, "uuid": "1f37804e-d208-4ec9-a64c-0a48a6d1b889", "value": "1536:EQOafW5DLJTcMf8sHNxU6mjJO1otXO40f20opRXVAJIoFJ44X6ylLyxETXHUo7Y/:EQsRJTkMUFj1M400yJIoAelLgKHUo7Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767503535, "uuid": "82344545-b3bc-4f96-bcd5-68e67b1424e1", "value": 88304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767503535, "uuid": "99570c81-8954-49b5-927a-d1e6fc812879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767503535, "uuid": "7dbaf344-71cd-4deb-b7e2-20c832837b3e", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b5f6d4-e99f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767553252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553252, "uuid": "92db1d02-d3cc-4e22-a704-5fb796e48f4d", "comment": "Malware payload", "value": "1ddd9a87907a48719e4956d92a064c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553252, "uuid": "6722c2aa-8929-4c9b-8d7a-4f800173d2a6", "comment": "Malware payload", "value": "c57781940e3f0ac3e9291bd8ae612733e9a66a36f8dbd6e4e5666fd3758b3aa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553252, "uuid": "944487ca-dc31-4583-96e1-caac1cbf04d0", "comment": "Malware payload", "value": "329aa2e06f91340ad08dbaf132a4ce9996a4051c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553252, "uuid": "24c6ce74-34fa-4ee1-a589-7de749682153", "comment": "Malware payload", "value": "2e9051d70cfb50407ba50efbc73e5761cb6cb0bc0e31de975a796953283211773b844d1ed2a33dd3f9f218826dcc4260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553252, "uuid": "956bfca7-8e26-4fd6-bcc6-ced5568f4596", "value": "T1E036FABB8E384C89C6D7F1F69381D6700DEA9E67A4E6E0FA51D109401F43B106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553252, "uuid": "210dd01c-3e30-4498-8681-ad0f491de20a", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553252, "uuid": "7b65c4f2-3bc1-457b-ada7-6c425b8f45cd", "value": "24576:RB+/8iGhGwH7dZWSTL65dQNY8KuRaBxiTvRD0wnSX8zk9S/RTcHKXTJH11bQD3/g:RB+UiGhJbWWLKKNdAo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553252, "uuid": "3171237e-5587-4334-9321-a8041af89669", "value": 4919808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553252, "uuid": "b8a10d02-9b81-40ef-b673-ec8abdcf18ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553252, "uuid": "fa61358d-0dfe-43eb-900b-794c26cf7308", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79bd555-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512005, "uuid": "2977abdd-95d5-446a-8cae-9b17bcad3ad8", "comment": "Malware payload (WannaCry)", "value": "aa718a028875637e1c6eb648706340b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512005, "uuid": "a9950095-e05d-4924-b7c9-bcceb8c02f2f", "comment": "Malware payload (WannaCry)", "value": "c5deb35612689e49ec3ad8336cda395a90da5d995c924c9df1ce2ce003178fbc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512005, "uuid": "b6f4d3e8-c719-404a-8e24-89586618ccd3", "comment": "Malware payload (WannaCry)", "value": "7710fd39b325c26ec9dbc396c52d281fe2f9090c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512005, "uuid": "48d99850-929c-41da-85d4-d117aa40987c", "comment": "Malware payload (WannaCry)", "value": "5b4eb0bf1d0c76e3d7a52e93faa4a4bfc7bcb08183ba63d8efe6c5923b0f0b8317367861031a9380a5ba8aba3117bec0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512005, "uuid": "06d8cf1a-0bcb-4326-a2b6-40ad8fa5893c", "value": "T1F436239975AC90F8D10A63B5B4778A26A2B37C9E31BD970F9B9087610C03790BF64F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512005, "uuid": "cf2c6130-e94e-4a84-be21-e0810145f387", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512005, "uuid": "57c4bb5d-3ba0-4c5d-8de3-f7cf57ce98af", "value": "12288:T1bLgmluCtgQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEy:RbLgurgQhfdmMSirYbcMNgef0QeQjG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512005, "uuid": "ebd2c30e-91b1-4a7d-903f-3f51dfbc0a84", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512005, "uuid": "acc9e0a8-00af-4a66-a414-a0d11a152f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512005, "uuid": "f9ccc7c8-a8ae-48ea-85ab-c913b689b085", "value": "c5deb35612689e49ec3ad8336cda395a90da5d995c924c9df1ce2ce003178fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f451bd-e93c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767510626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510626, "uuid": "f2402835-686b-47cf-a3be-c0fbbc2a8484", "comment": "Malware payload", "value": "a3d8998f45867d515503dddb8bb1f6ae", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510626, "uuid": "af5cea5f-514a-4568-ba8d-de519bb35dbc", "comment": "Malware payload", "value": "c658b246592110b8c916d53ba6d202b1ce89fe12e2c8afd3363c38351fd3bfbf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510626, "uuid": "49aa82c1-0969-4f66-9066-52f5b8fe2225", "comment": "Malware payload", "value": "dc79cd692dd3cbe96f39265c6518b9397355da22", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510626, "uuid": "c0c6aa6a-5232-47a2-8c97-1056c2e2a142", "comment": "Malware payload", "value": "7a9e7e1b26a1de5f5294b597dfcfa100190a2a911183b49b3caaa728c634f8c3330db6deec911c5e51a29a78bf8d17be", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510626, "uuid": "7e430a9f-8a58-4313-83df-feccc8ed2cd1", "value": "T1EBC501C756040AE0CCAFEF7070D745BA8DE71E2D8AE119D76D59764E373C28A2E26123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510626, "uuid": "1811e30a-aba2-4d01-914b-3a5566e8c1cf", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510626, "uuid": "6a943d90-cdaa-4e3f-af9c-383927c098df", "value": "49152:sUHMq41JUT1rtemDl1qY4LvHU87zQ8uEsmrHuAyd3JcSBDQTMrVk0HbsCcFFFOhQ:fTEJmx8mDyLvH7zDVvrHuRd368DQTMR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510626, "uuid": "7730e056-e79e-4351-ac82-a60b6d578ad0", "value": 2724232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510626, "uuid": "c73ee129-0c71-414a-b4a0-534f14687d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510626, "uuid": "b4685b07-de2f-4f62-9b3c-c57c4ad4ff23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9449356f-e935-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767507677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507677, "uuid": "ece7cdf8-703d-4bba-8333-02cdee5f3742", "comment": "Malware payload (Mirai)", "value": "d2e85ccbb85d3c5c5e8a16aef8e100b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507677, "uuid": "8b46ae95-90bc-4085-8c17-4feeaf1f8ee6", "comment": "Malware payload (Mirai)", "value": "c6e7733f9eca779a6c2c857373a334b3f22bdd26a8f360357fa663875e927b85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507677, "uuid": "867d3413-00bd-4c13-bca3-f3bbad6f4aa3", "comment": "Malware payload (Mirai)", "value": "5ca7533f12df9d16e28c570cf731f692e33a78a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507677, "uuid": "ad6da429-8e76-419f-9337-2240a8776536", "comment": "Malware payload (Mirai)", "value": "8d45b6d55c5d525f5c0acef6404702c444a4371a4fd54bf6e99384df5f582db27a467e2b0051a46875f33af81c6f431e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507677, "uuid": "c38f8250-afd4-4fb2-a63a-67eb0c952942", "value": "T17E044A02735C0907D1532EF1263F6BE193EFD5A124E4FA44650FAA8A9272E72158AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507677, "uuid": "84b304bb-4156-41a7-88d1-ab2a4e456c1b", "value": "1536:hKkbOXrtGh26Ul8riIHoLGqGe7J8GJFAmSxDxfg80/+Mcj+u8fNaMZlSvAUhW4MK:MJXrwGiipLGqnVjSxdwKjb8EeLUP2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507677, "uuid": "354361ca-2829-4178-a8bc-395f40cd0e13", "value": 184024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507677, "uuid": "e42bbe56-a255-4e6e-a4b9-27922934f8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507677, "uuid": "00a4be0b-b887-4c10-915a-5a91edb2d495", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13647896-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567161, "uuid": "793298d4-924b-4c63-a872-09699f0ce9eb", "comment": "Malware payload (Mirai)", "value": "5d90fc7e4f4f428260f3052d1f8b9811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567161, "uuid": "163fd5c7-1bcd-403f-8c55-69e9d1f2919d", "comment": "Malware payload (Mirai)", "value": "c780c30670235b27191894728ba6d44a2968b5ec1851313dc8655ccf11b32f76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567161, "uuid": "bc349cec-6d52-4226-9088-df7d5943e47f", "comment": "Malware payload (Mirai)", "value": "1b6381d0042d79dc9b721e8170310612861c5e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567161, "uuid": "7d7ddfb2-6628-43fa-9449-02dffc2a8249", "comment": "Malware payload (Mirai)", "value": "1f6dfc6efabd66d970dd788d9a3bf1c093cc9a61de2f60c09a127a4df71193c8838f2959863d4bb72ca14effd133ace8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567161, "uuid": "7438077a-9d30-461d-9c44-8d5b374e0e73", "value": "T11B331885B8C18A17C5D413BBFA2E51CD332563A8E2DF3203DD256F14778A82F0EA7695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567161, "uuid": "fa3271a8-8589-4160-823c-49c7a41a16fc", "value": "1536:ihrtWg2MLs5V51nzUatNoTcawt5GrQB7L/:ihrtWg2MIprRnbGrQB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567161, "uuid": "92118fe2-a49b-4372-b881-0a1c0f170869", "value": 52916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567161, "uuid": "d799f3b3-c176-4dd8-b9fd-c62bfe9395ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567161, "uuid": "523dcbc1-9bbd-4f63-90de-f357cb7d1970", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf6acda-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509891, "uuid": "7c42e244-f180-46e9-8efe-cffe245b9ed6", "comment": "Malware payload (CoinMiner)", "value": "991ad12169c6002200e5d3637b144221", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509891, "uuid": "bd888ee6-0ba5-478f-bb61-af233e81379b", "comment": "Malware payload (CoinMiner)", "value": "c7ee8e9227a11645ddd85635d48b53e8b524c14e60f86cf9ccf709e7e8c4ec06", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509891, "uuid": "07cd8a63-4d74-4e55-bcf3-683d011de817", "comment": "Malware payload (CoinMiner)", "value": "de995550bc0539d57be46d8cee5484c327cfeb35", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509891, "uuid": "e05f91f5-37d7-4554-b3f4-b8f92eaa0d59", "comment": "Malware payload (CoinMiner)", "value": "01f9d40744f2acd592b39f80fb1348a5a44df67c3a67c9e2e4f853fe9344d0a45eac9782e8a182c42ab65c0ac28b356b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509891, "uuid": "b2f2e8f7-0f4f-453a-82b1-9cdbc4d82b71", "value": "T1CD8533A000C2FBBE969CDAC458F872311E1559E03739556AE84F4C67FC72FE906A7D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509891, "uuid": "0da97d53-94e1-48d0-97e7-3b48e05537e0", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqf:G3LG658+S8YrCpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509891, "uuid": "b728223a-16e2-4ccf-aa64-0adfcb5bc3fb", "value": 1806336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509891, "uuid": "2539820d-c5a9-42f0-8474-983a269f3873", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509891, "uuid": "ad619120-9456-4c2b-9aee-ac7cd33da599", "value": "c7ee8e9227a11645ddd85635d48b53e8b524c14e60f86cf9ccf709e7e8c4ec06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c03da3-e99c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767552072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552072, "uuid": "9a043108-b52c-4cff-a590-e680322fb7bc", "comment": "Malware payload (Mirai)", "value": "01270660af07180054449b422424280c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552072, "uuid": "e78edbb9-36de-4355-a54b-3577541ba6e3", "comment": "Malware payload (Mirai)", "value": "c88bc2203dfafc6a575fed9ec72c6cf13a17e1891dd155a7586ce15ce43c4860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552072, "uuid": "2ed66e4b-5289-405a-a0b6-1dcd1c6fa956", "comment": "Malware payload (Mirai)", "value": "66195762486498dbdc369160ecb8d1ff2b567474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552072, "uuid": "cfc58976-2b3a-433a-985f-269722c9accd", "comment": "Malware payload (Mirai)", "value": "e223569b5488739959ca62515842876bfc2dafb201f9aae733ff9c4154dff6baf9efeffbab4ca3a4a2e429f5d6aa9629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552072, "uuid": "db6540e3-5da2-446e-b6f2-57695ef2137b", "value": "T103145BC2B96D7D7BD2670F3FC64247596F3CAF029E012917A06E719B29BB1920F52708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552072, "uuid": "aa933800-ef59-4be4-8d96-103daf9eb69a", "value": "3072:9TJJRe0DIrOBPHhowvDlD4/4aom2HFl2YeeOap:BUE/NH/vDl0/4LplkYeJap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552072, "uuid": "ce024497-a31a-4f48-8454-9a9010987632", "value": 202048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552072, "uuid": "34fb11c7-fef7-418f-8982-b66761bf1369", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552072, "uuid": "14b6f55d-f92b-4c55-bfd4-66ce67d5ebae", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22fe405-e97d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767538705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767538705, "uuid": "01fad74f-b0ea-4303-bf5d-506ccc96129c", "comment": "Malware payload", "value": "731d6960809c7793829d1837e2a9fc3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767538705, "uuid": "71b6abd8-edb7-48ed-ae22-3d2df4f81fa1", "comment": "Malware payload", "value": "c8f0d3459d4a026cb7d46656661913b116e99ca06eda80b5bb39dcb0ac4b6851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767538705, "uuid": "14323f23-019d-439d-86ed-49aa408ab346", "comment": "Malware payload", "value": "f4198b34b53cf22a843313f2d95795d87b53e1be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767538705, "uuid": "9bcbba9e-8841-4754-89d5-492e62f390b1", "comment": "Malware payload", "value": "d7184fee0c6e0e4f5898f353958120a95f5909dfb5ea521d2d55b6161ea672969b12994f936758f32b9f9048faec43ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767538705, "uuid": "c962b7c5-f2ce-4bf3-a0c3-0f1e096aa405", "value": "T17607330C13A001F7E4E6C43A49A7D57AD222FD222792C68F43B856A53D537E61E3FE21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767538705, "uuid": "0bf8511b-c330-4d09-983d-9e2845f50d64", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767538705, "uuid": "176bf365-001f-436c-8d01-8f437c3b38e0", "value": "393216:X85vzaPKwGaa5wEMiuHClgW+tHjdCp6vwoPoiyp4p/w/cpbNPi:M5vzmaGziuilgW+Nj9BW4RwIRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767538705, "uuid": "772742a1-8d6d-403e-a24e-22414cebbd86", "value": 17656759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767538705, "uuid": "81625758-2416-4c70-b834-1d291e993fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767538705, "uuid": "e436f03e-c1d8-4ba1-8625-e3a6c7dbd55c", "value": "PC-Executor-New.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1692af3e-e991-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767546980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546980, "uuid": "97c9d1eb-ca8e-4c13-81d3-3a90f3e99233", "comment": "Malware payload (ConnectWise)", "value": "84fc14836b99af724d8d58c3a34911ad", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546980, "uuid": "cfd5c326-0e88-42d2-a387-38a2dbb7acc7", "comment": "Malware payload (ConnectWise)", "value": "c8f5a4d26b10be34a2b865ad914b296f3618998d42e1c12ef0374c014b8bac58", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546980, "uuid": "7b011061-8d1d-4ac7-9b98-0ef95777c191", "comment": "Malware payload (ConnectWise)", "value": "fbceed6a5be0e3b39b8e28288797ce791264dfde", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767546980, "uuid": "681a674d-e866-4943-a500-d79c0f74957c", "comment": "Malware payload (ConnectWise)", "value": "b1835f7ce2ff7b39c946394e8fe3ec66d199af433206c7de28218737a85553cf966c2f9ea3ff786ca8225657691505e3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546980, "uuid": "ed012842-ab39-4ccc-94ea-ed11c07a9657", "value": "T14351326FF54AE2354E725373A0B26C6DDF570259154081A07EAE808DEB2122DDBAC2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546980, "uuid": "5726714c-02d9-42e3-87b3-4cafc1f3dc76", "value": "48:eKySN7j7ksLvfbdJsUrBuYaRpunagA+ANtDWE:PksLvBJNYYGunpA+ctDWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767546980, "uuid": "befebdda-a8b0-4171-99fd-bd3670ff12af", "value": 2526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767546980, "uuid": "8657803c-75d1-4a34-b0d8-cf219420b8f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767546980, "uuid": "79e910e9-2708-4c58-8ab6-a3c85c364a8e", "value": "msi2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5c5c5c-e9a7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767556467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556467, "uuid": "51f48533-cc31-4fcc-ac24-e7a43d17648c", "comment": "Malware payload (SalatStealer)", "value": "b08c60b819f465659affd0575c3fdaf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556467, "uuid": "30987624-48cd-4773-a04f-29dee698e0c5", "comment": "Malware payload (SalatStealer)", "value": "c9acec4262b4c2f4a0ca4f40de8e2bde3628458d50251483d0772454da79f055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556467, "uuid": "8d925119-ce18-4305-bd78-c03b3a19bc11", "comment": "Malware payload (SalatStealer)", "value": "0197c54be23c7ce33c8e577838fd72eeef8f69fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767556467, "uuid": "41ba269f-28c5-421d-9e76-d0d96add5827", "comment": "Malware payload (SalatStealer)", "value": "080f2790de406c7235127b9427572343e960c1bba9e507cc8566487605e2f30b00517634bf6ea58fd7bc21faef6ce3d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556467, "uuid": "a8523bf6-4d05-41c7-a3b1-69414bc53329", "value": "T1B6C65A11FA8B54F6E9031831415BB23F63305E049B28DBDBFB547BAEFC77681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556467, "uuid": "d82d745f-8604-4567-85dc-808cdc2ba9d7", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556467, "uuid": "b6d0f68d-0c86-4bf1-be74-e1700fad058f", "value": "49152:G6L/p4g6H7Ym8FGNJ0ByObO77EvVOrhxPIJ/o/bFtHUhuNknNSoUAUzgPyZjjciA:F7pO88JDzUXoQLYX4YUBnI/f1tCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767556467, "uuid": "121b02ac-0680-4489-b58d-aca4d7e893cf", "value": 11658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767556467, "uuid": "98741c52-2a06-48b8-ba5d-06d282e7bc74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767556467, "uuid": "0df8fc08-85ce-45de-9a75-26dabcaa9fe2", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325a2004-e99e-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1767552610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552610, "uuid": "698ad525-41c8-4309-95ff-a5a65c3e1126", "comment": "Malware payload (ScarfaceStealer)", "value": "c94c32908c0004e9bd819b92fde2bdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552610, "uuid": "ee8a1227-6678-4a7b-bcfd-6925091dfe92", "comment": "Malware payload (ScarfaceStealer)", "value": "ca6528840464f06ea89fd446dda1eefec793b424cf895d5026a401d507cdb9b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552610, "uuid": "9ddc4b3b-0597-442d-af9d-10c18ae4fe66", "comment": "Malware payload (ScarfaceStealer)", "value": "71f6b93eccd69005236591e712b608210cae30dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767552610, "uuid": "d67b3bd5-697a-41be-b2c4-0e37d1bfa909", "comment": "Malware payload (ScarfaceStealer)", "value": "13f7adf118af4bab44809fcf096740f85593ffcd453695c33f0868770a43c56db19dbd7baf3a22713f975a9bf1116f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552610, "uuid": "bbd71b0a-63a0-479f-9dbf-d37393b0c9a4", "value": "T1FAF623D23ED6D2D8D493463065C70799B1E1778AC2FF8A5E3AD31C0277A0E074E4A9B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552610, "uuid": "1f634988-f52e-486a-98ac-c1fd19615a79", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552610, "uuid": "2ed474a8-47e6-4d09-be33-a25bcdf2d30d", "value": "196608:kS4k772GH8rCzIn8fEOxbIAob/PBfkLXUaKnsX5vFSJpv2wRHMNT3n/Gr:6mcpeb8b/PBfQXUalXjGpuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767552610, "uuid": "8b7c05f1-ccd6-4178-b1f1-7ed0cca7f171", "value": 15567360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767552610, "uuid": "1abc64dc-9e1d-4887-9149-c4b876a5d261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767552610, "uuid": "12e6b22d-e6dc-4d9b-a587-621af0aa32fd", "value": "oblex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4b4589-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512898, "uuid": "012e9cbb-5e8c-4568-baf1-3b3d39f2c74d", "comment": "Malware payload (WannaCry)", "value": "719e3211a56696c1eaaece793d90b064", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512898, "uuid": "fe40a4dd-bd0b-4b04-b361-3a2440498821", "comment": "Malware payload (WannaCry)", "value": "ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512898, "uuid": "6cc10f07-4fb3-47a2-9e08-659e88e2c099", "comment": "Malware payload (WannaCry)", "value": "c158a7bd3d82c0aaa120acb1b1071c61eabf07d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512898, "uuid": "50bf643a-5a3d-4b69-b84d-aca3bed06ce6", "comment": "Malware payload (WannaCry)", "value": "7b9a46eb03f798a04377314ea111f32cb3cfd0e20dc14606d612571f3d7c7de8a55d2136dc58e5b1885487be21f3568c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512898, "uuid": "71b589d7-490d-476a-bda8-21196f719732", "value": "T129365A01D1E51AA0D9F20AF726BADB10933E6F45995BA66E1222510F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512898, "uuid": "5425ed37-46f4-439a-b130-6f00126452f6", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512898, "uuid": "db0f64ab-e6ee-458b-8145-54b7e539f4c6", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:+DqPoBhz1aRxcSUDk36SAEdhvxWa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512898, "uuid": "badef0c5-f6a9-47e2-a934-e9b2140ae0f2", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512898, "uuid": "0a4378dd-1c07-47d8-800d-e9fa98d460a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512898, "uuid": "a2217d41-12f6-4599-9854-3257a85dec3a", "value": "ca66d96b074b784b8a3cbd9492053e56e2cb630ed1a929cfc94f412d7a54cc40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1441e9-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511475, "uuid": "fb751ce9-1907-4947-96ef-1d589aad7993", "comment": "Malware payload (WannaCry)", "value": "f65fcaf8c4be060e7c9285c811792c96", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511475, "uuid": "0b3d3f12-c31b-411e-b302-d409d89beec5", "comment": "Malware payload (WannaCry)", "value": "cb0740cfe3e218745b4d25ab6c12d942370596859536311f584a93723e676ea4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511475, "uuid": "437c0363-5c8e-4e44-a000-e3adfa5096e4", "comment": "Malware payload (WannaCry)", "value": "6f3665270334512f10e422281428bcc43d61818f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511475, "uuid": "344c84ba-3f3b-4b92-8997-172f6488ef24", "comment": "Malware payload (WannaCry)", "value": "777e5b75944122c2d8bb9acb0bb274a9e955e155eb6e53a153dff17dd1974d9ff73c175e8a983b0b7698d6ee2011a9e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511475, "uuid": "db9b5efd-e965-4377-b28d-76fe950c0b4c", "value": "T167362359727CE2FCC609127460778A2796B77D5A22BD560F8F40CB261C13B90FBA8B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511475, "uuid": "a9556b87-cb85-4c7f-a006-0bdf5c1d4dde", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511475, "uuid": "9791b844-aaea-4d2d-af5a-d97630568dbc", "value": "24576:zbLgddQhfdmMSirYbcMNgef0QeQjGqD8kIqaXmiHkdhAdmv:znAQqMSPbcBVQejqGX1Hkdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511475, "uuid": "4f6d28bd-9382-41b1-9099-3e29953fe83b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511475, "uuid": "30a6ca18-cead-4b99-b1a7-49b47138d7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511475, "uuid": "024db264-2aa5-431d-a028-e692ad18dfe5", "value": "cb0740cfe3e218745b4d25ab6c12d942370596859536311f584a93723e676ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1354fc16-e92c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767503596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503596, "uuid": "599b0b1c-57a2-4e13-b6f9-122f9c65ba59", "comment": "Malware payload (Mirai)", "value": "3ec5423cc6a8909a2d13cea49e8f65fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503596, "uuid": "fb78add8-df81-4f8e-ba67-f3321100c45b", "comment": "Malware payload (Mirai)", "value": "cb68850c52bc941b220989ecb4c1a83a30b564ca4963176f631bdf295d21dde8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503596, "uuid": "f8c7922a-18ad-4552-9800-73b004a7e441", "comment": "Malware payload (Mirai)", "value": "f2ae7209a8d0ba990c0175d749cc67a44dd5e322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767503596, "uuid": "4e9dc85b-12f1-4261-a0c3-5a7872213452", "comment": "Malware payload (Mirai)", "value": "631a9a7e53eeedab8bcc71282d799f0e5f7dd6728bb2d5bb2f4919f34ae50ccd718ca07137cd26da3d872fa6214177aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767503596, "uuid": "3e6993fa-eeab-4464-bff8-6bdc473f3ec8", "value": "T16E343B86EA814A13C4D627BEF69F424933339754D3EB720299296FB0378779E0F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767503596, "uuid": "0b450690-cb8c-4751-93c8-687e8e14b864", "value": "6144:eGRS39fG63T7t+d1NOaOUUJ8YaUfROhb16rsGM/RmReP:eGRS863Ty1NOaOUUJ8Y5Z4isf/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767503596, "uuid": "506d42b6-cfce-4e2a-b3d8-98af70897552", "value": 242076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767503596, "uuid": "a2f3da41-8e84-4d7a-825b-eb82cfa62125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767503596, "uuid": "91409ce5-b7c1-49b6-b7e2-8a5fe8c06ac1", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560d7bb3-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512727, "uuid": "0a2691d1-a318-4b6d-9d0c-85cf5c3c05c5", "comment": "Malware payload (WannaCry)", "value": "4bfcfab0e20e75b5a5eb19283868a7fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512727, "uuid": "45626fac-5bc4-4b3e-84ae-ccd709c4c6d6", "comment": "Malware payload (WannaCry)", "value": "cbbbd2008f73151c5c02273131ab5cb231fbd22e478b24d9dbde4ab153a71e8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512727, "uuid": "c7ef7265-5a62-45cb-aa0a-dd2660a02f49", "comment": "Malware payload (WannaCry)", "value": "ca99b2b506e05b690cc2afff7491628ccd2e01e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512727, "uuid": "d12bb3d9-ae4e-407f-80dd-baf1dd98033a", "comment": "Malware payload (WannaCry)", "value": "f399c51db62aade3f9e6821b2757817547e959a16603e51ca5dc0a28a8e754bf4809d6cfc0e05e153073a6d7f994621a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512727, "uuid": "2e3914b8-bbbc-430e-9803-4951943e19b4", "value": "T1DF3623441E1891A8E84E0FB434324D35A6633EB4FA75BB0E5F4C71753FF3AD66AA8901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512727, "uuid": "c99ec511-530b-47a8-b8f0-a648c75a7174", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512727, "uuid": "908430cb-1d31-488e-b4d6-1befc75c0d9f", "value": "98304:M81hz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:M8L1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512727, "uuid": "b7993e45-bf9f-4866-88b5-c7975e4eb028", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512727, "uuid": "f28bc996-b321-41ff-a91c-030c5e6cd3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512727, "uuid": "bfd76b9c-bd49-4c16-a44d-633ce877de6b", "value": "cbbbd2008f73151c5c02273131ab5cb231fbd22e478b24d9dbde4ab153a71e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a915e5-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509914, "uuid": "b208b02e-06b6-4374-a0a4-cf5b9e68819d", "comment": "Malware payload (CoinMiner)", "value": "8637672ecfc3f5c23190580257d55b08", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509914, "uuid": "83445642-e18b-47a4-b5f7-101e5ebfbced", "comment": "Malware payload (CoinMiner)", "value": "ccf8e181ea6477bac982aef20e4103d821f22a45addc187604f34a892a49db58", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509914, "uuid": "40c91de2-6f4a-4dac-ba1e-733c6726021c", "comment": "Malware payload (CoinMiner)", "value": "b736a03fba31ee047111c2f06bd0baf8b84ff3a1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509914, "uuid": "c89994f8-8667-421c-8035-d802464862d5", "comment": "Malware payload (CoinMiner)", "value": "98b9ec34a40a34983fd347e0613df708394355e64825b52041812cc9d874f0f750d78985755f91fede488b34f771a578", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509914, "uuid": "a2587783-5dc3-4b12-b770-d3d6a0b19b4f", "value": "T1468533E000C3BBBE96DDDBC458F837301E154AE026355A5AE84F095BFC61FE906A7D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509914, "uuid": "a9a8dfd1-d7f5-46a0-a6d4-77306e0c1bc3", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqB:G3LG658+S8YrC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509914, "uuid": "3d25a284-9e5e-4416-95fd-5729ee4fc28c", "value": 1728512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509914, "uuid": "0217bb58-add4-4988-99b9-68be036787ce", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509914, "uuid": "f3bd2832-3c50-4758-a6d5-701a5567f68f", "value": "ccf8e181ea6477bac982aef20e4103d821f22a45addc187604f34a892a49db58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbc63f5-e96c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767531477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531477, "uuid": "f71cee5b-0bbe-411a-8cea-ecd01df4ae5f", "comment": "Malware payload", "value": "2ba32d3e1acdc9b51a9eff0cb5010631", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531477, "uuid": "c618538d-c2a9-46e8-8560-5f58592d3e94", "comment": "Malware payload", "value": "cd3273892148c2ea8d43aa8d6938cd3b7a348cb9128fa6d66805ce399184c56e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531477, "uuid": "63338d15-2d69-424e-b10e-cf28b70637f4", "comment": "Malware payload", "value": "433a974b79122e9f2783712774258cc417ec50e0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531477, "uuid": "f2d80f4b-55a3-4928-8d73-e71d965f49d4", "comment": "Malware payload", "value": "6acf1472d9f492d194dd6cd901608906d0cc48221539c7dce80dd4b6011a4941b068a0f4bd031ebd7e27b194eadf4f7e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531477, "uuid": "2270c6b1-7110-45e7-9c55-8ab0c72e3302", "value": "T17D428E22BB41CD1DC807963B58CCCE8B291A0754798BE81FA4A041FF40E1D1F9B57EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531477, "uuid": "84b7eea1-ff2a-420f-b010-57b817ca3524", "value": "192:T1+7TM3N9gUQDxH52/OeY1lTb7SOMo3fHW2FlfwYC4UEhUSsrd3AWbrd8g:Tg3w9gntZ2meYL/CMfHWAzUEhUjrd3AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767531477, "uuid": "a00d5e36-5d58-40de-bf94-31c7960eaa90", "value": 12445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767531477, "uuid": "5d116c89-2240-4a65-b4c3-1440fa41bb0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531477, "uuid": "23796ff7-cd74-4720-8999-bc8ce7fe6c0b", "value": "donutsmpdupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feb0114-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767513254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513254, "uuid": "0509e663-6ed0-4ecb-afc0-9caa092be27e", "comment": "Malware payload (Mirai)", "value": "b326be514c3b38293ec953ef61baacfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513254, "uuid": "607f2fa8-be6d-4d2c-b086-f75e4f3375c0", "comment": "Malware payload (Mirai)", "value": "cd85d5a435e8c476a4218a22ea689fe401ea4fa289cd3727c80fc41d90144039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513254, "uuid": "86482a69-12f5-43a3-aee8-4fd0ba911a0b", "comment": "Malware payload (Mirai)", "value": "fc4bff71482e77320d33d1fca69c83a6455d9015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513254, "uuid": "ab1c5f05-138c-4122-89b1-0e05d2077fd6", "comment": "Malware payload (Mirai)", "value": "674a3f67fcd31b23bfc79da36c2f99c620318c0fcc069a9c4b1dceaf5038d81ceaa65c06887d85733bad3d66bb02ea0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513254, "uuid": "150a0cb9-ca0a-4715-b9cf-1ce637234d26", "value": "T1E2C45C59F8409F91CAD529B6F65D929C33070B79C3EAB20799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513254, "uuid": "80922827-f768-43f1-92f0-3183a7702d35", "value": "6144:5JQOa5jLUqBhlt6F2n621nBsPT0eAS+vWW2Wod6mjS8mJey7bB3GBgUgpZ6mN9:56FUqXtT1OJ8ey7VWVgpZ6mN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513254, "uuid": "ba6a2020-fc32-4409-987e-065993821e38", "value": 553924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513254, "uuid": "4e543b68-fee5-48a1-99c1-b424d2f6629f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513254, "uuid": "bd400765-02b5-4126-8d10-b4110b0adff2", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22021991-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767510922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510922, "uuid": "91bf51b2-f618-4531-98f8-b2459fffc0d6", "comment": "Malware payload (Mirai)", "value": "be311388d45c5c1c9da13f011d7e16cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510922, "uuid": "8cdf8614-2740-4940-a1f3-7b83c027e155", "comment": "Malware payload (Mirai)", "value": "ce98ed9549c3258f06468310102e94d5b962e4c0b1faa5f0c965536bdb12431e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510922, "uuid": "24e165ee-e615-4eaa-bb9f-8e3f862b221b", "comment": "Malware payload (Mirai)", "value": "47bf771969c20a9ff7af662c1dcdc6440efddb0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510922, "uuid": "12f95dc4-4771-45fb-8a6e-797770b89ca4", "comment": "Malware payload (Mirai)", "value": "f1fe8157928a86aea980ab38e3e61abf7da3c1f27cf2a80bced027e80c95248d741352230c86618fe3729f9751d32dd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510922, "uuid": "b11980ac-ef9f-42b7-9ca5-298407361c94", "value": "T15B04BFA3B34F2491C87106F80BCB6B9D262361125DA7DAD76C6F753A5E375DE08023E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510922, "uuid": "3572554c-0ef0-4226-babd-768dc2c3a30d", "value": "3072:ADBdjwnSSY0VLtsYPtkchPPd2WenqkxJjg/ClTK3Kiypq:mX0LsYP2chXdCqk/yCdK3spq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510922, "uuid": "54577758-ace4-4140-b099-e0f0c0004e4e", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510922, "uuid": "8083fbd6-9d95-4772-96d3-4ef3bbdde372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510922, "uuid": "aaa9d23f-fcc8-4b5c-ac42-f082bf8b578d", "value": "executor.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08a498a-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509845, "uuid": "b1bb515f-f11a-4b51-b77c-571c62de01f6", "comment": "Malware payload (CoinMiner)", "value": "e70584ffe2ad9206e9ff8d4df4f7afa7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509845, "uuid": "3a5b16a5-dcc0-4d33-8956-edb22cabae5c", "comment": "Malware payload (CoinMiner)", "value": "cf921e860f3364747e2a86d5032c9f61be44ad3c998bf5f38e629ef1c46c2ffe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509845, "uuid": "3063f25c-a332-48b6-84be-802b969de81f", "comment": "Malware payload (CoinMiner)", "value": "1ba07acb00e7b0473098358f72a4f0710a67ab77", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509845, "uuid": "c8ebc874-b32c-43de-a024-f3373e6d4f2c", "comment": "Malware payload (CoinMiner)", "value": "c2440653bb2e0c3e23a3f116344eb47375513e2d11085addd3e657df333968f885c45adc859e46bdd53ccf4b0eecf922", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509845, "uuid": "9c1b9a49-1fa4-4850-9a7d-f539e2cee237", "value": "T19A9533A001C3FB7E469D9AC858F876311E2559E02B285666F80F1C5BFC72FE905A7D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509845, "uuid": "e2cc13a0-31ac-454c-8ed8-17e9a1697b33", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy9:G3LG658+S8YrCpHy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509845, "uuid": "0681a917-b3f3-4d07-9748-7a41499dd448", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509845, "uuid": "b21197fe-340c-4e1d-8c88-383f716e60ce", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509845, "uuid": "09cf065e-4dba-45e5-b3ae-336f12fddc2b", "value": "cf921e860f3364747e2a86d5032c9f61be44ad3c998bf5f38e629ef1c46c2ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6bd756-e997-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767549887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549887, "uuid": "76a84d2a-bc8f-4c01-a905-d69a8e783c07", "comment": "Malware payload (LummaStealer)", "value": "e412f4e4cadc4e1a974df63fadec1210", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549887, "uuid": "81f4361b-4bba-4dd0-bcf6-0bd34b3d851b", "comment": "Malware payload (LummaStealer)", "value": "d06c4afaa3653547c5b106a53fd57783381ee52cb9762d681712e5ac858526f4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549887, "uuid": "e5d64b41-1062-41d1-bf91-a651e0b36acf", "comment": "Malware payload (LummaStealer)", "value": "8a8bd3b4fe4baaba90d999230a009ddb0d868970", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549887, "uuid": "8c19efa3-5dad-48b1-9b8f-e6b454c0de29", "comment": "Malware payload (LummaStealer)", "value": "616f7054bf323cdae6b73e605d8b98583b8edffae73698ddb8c168b58f5fcdc95b6b05b4cf3d7e03b09810b395f8c328", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549887, "uuid": "69b6fbef-760a-4ecf-a5c7-06f16e964b36", "value": "T1BE552353A3DA8573E8F64B741CF16BD3163A7D628879C6AF1A09648C0A73388DC71367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549887, "uuid": "165eb3db-0c62-4780-8d92-33fc3de79fda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549887, "uuid": "2fa32b28-9f12-4a9d-9939-6909c9281c1a", "value": "24576:/1xQ3YSbmOAf2SVWoV68MAzbjZzrcaPKbJGqfDTJ7rf9rjPPa3I:/1iblAf2SV7YJAV5nolVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767549887, "uuid": "5609913c-9dfa-4965-a476-ec420dc8ca1b", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767549887, "uuid": "1d5443c9-6fd7-4976-8527-2e6706752b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549887, "uuid": "3da56bea-d1db-47b2-ab40-2b8725522519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f5f17f-e91e-11f0-a129-42010a9c0007", "comment": "Malware payload (Anubis)", "timestamp": 1767497939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767497939, "uuid": "d4d86ca1-71d8-419c-81ee-b4d76ac664cd", "comment": "Malware payload (Anubis)", "value": "081221240ad2f0d85f6612527941a617", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fack rto apk file", "colour": "#054E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767497939, "uuid": "e91b0f85-0dbd-41c1-adf9-fb4611c12cdb", "comment": "Malware payload (Anubis)", "value": "d17d2f0ab340d52c83e59d3d7d6636d92e15f23a9a70b4f402c5af54cfc291af", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fack rto apk file", "colour": "#054E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767497939, "uuid": "0adaf960-9361-4750-8faf-18f720680139", "comment": "Malware payload (Anubis)", "value": "624693ac8444687b56566a6982d05ff1a8eef7f5", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fack rto apk file", "colour": "#054E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767497939, "uuid": "c013942e-d0b2-4b97-978c-56ba601d2adf", "comment": "Malware payload (Anubis)", "value": "511527917aa51c74d1f0988198a47766cf4aa573818d03653ae5c75f26f095a9a89710483f531df17a37cc3a44324d36", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fack rto apk file", "colour": "#054E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767497939, "uuid": "53ab59f5-6af6-4c00-bab4-90c3b2b9350f", "value": "T18546F1EFBFD4796ECC3A00B1886E12B577578D198AC78A037D18361C687B1D41EA4BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767497939, "uuid": "dbecd330-651e-4e23-bb5a-a8a4ee075a62", "value": "98304:3GnX8Nu1Vo02Dey8gVwodQvMfVYt8Xltlb37p61xq10jS:3KXSK1GeyKvC687ZF4w1kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767497939, "uuid": "85b3f99f-d82b-46b6-8a14-90c842a29c8b", "value": 5466304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767497939, "uuid": "bc19122c-584b-4d86-a65f-2313d4d8fcc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767497939, "uuid": "f50b78bd-5ed4-423a-890a-0a47ae4ba00d", "value": "RTO E CHALLAN (19).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116fdcf1-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513041, "uuid": "399b6cdf-c8e9-45c0-9c67-be67308152c5", "comment": "Malware payload (WannaCry)", "value": "b4095a8d321c1d2db5a30ce1f2bef6f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513041, "uuid": "01a57276-1b70-4092-96f4-cbdc6df77097", "comment": "Malware payload (WannaCry)", "value": "d1845c9e4110057602a23a668d9ef76cbbbff74496048ae80037cd648647d607", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513041, "uuid": "174043ef-720c-43fb-b06b-63e8a9d86fe1", "comment": "Malware payload (WannaCry)", "value": "34867befa902949b83d7a1f84006c81605fd218c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513041, "uuid": "0818af04-ebf6-4a0d-a712-0df2d2e65751", "comment": "Malware payload (WannaCry)", "value": "5ae283173e2ce4a2ced85c696cbe1b542c9b9b9bb821ab613594843cb5a3721be83796ec70ca94ff02b0aaa55c0a887d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513041, "uuid": "a14657fb-3fbd-4c5b-b540-17641a9645e6", "value": "T11F363394622CB2FCF0450EB44463895BB7B73C6967BA5E1F8BC086670D43B5BAFD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513041, "uuid": "1a88c50b-f932-4846-a636-4428dabdb3d7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513041, "uuid": "2699658e-8f43-4519-aeae-478b12f55839", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:d8qP21Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513041, "uuid": "483e47d4-6456-4a34-b3da-b612d29d2660", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513041, "uuid": "fc99c3bf-c632-4bfb-8a2a-815c630bb628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513041, "uuid": "16abf6e6-48fc-4313-8e16-4249d573a893", "value": "d1845c9e4110057602a23a668d9ef76cbbbff74496048ae80037cd648647d607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4608c23-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509422, "uuid": "e3f8bc4b-514d-4d0a-a2d4-5ab8a6801703", "comment": "Malware payload (CoinMiner)", "value": "f88e35c78f00305c1b0351635337f868", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509422, "uuid": "4b222b31-c0fd-4dda-bb60-d6312f5d7108", "comment": "Malware payload (CoinMiner)", "value": "d19f5b1a678a0c2b4640bc67c23e5f6d5cecb8b988ffc07dfb43ae6fad18666e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509422, "uuid": "8f2e410d-65aa-4669-adba-93e48de955d9", "comment": "Malware payload (CoinMiner)", "value": "0dfbe74cbb00852cdc8f3d7558d7b877def57ede", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509422, "uuid": "f2635a1c-6f4b-4191-9f46-b43745edf339", "comment": "Malware payload (CoinMiner)", "value": "91502066b26733d1dda867f88da0d972fba1ae398796e7f127ce1014eeefd37ac253b6423ec5f30c13f39f53f4cbbeeb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509422, "uuid": "469b5068-cc52-4334-83ef-848552fcab66", "value": "T1FDF5336101CBFCFF5585D46484ECBF320E6A52F09B6C9665FA69041ABC25EE3007B72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509422, "uuid": "24f140c2-f2b3-4b0e-a4e7-507723089e91", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vH43vwG:G3LG658+S8YrCpHy2dUu4KrCf43vwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509422, "uuid": "c15a982a-31df-4e1f-989a-cca831ce0f0e", "value": 3522560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509422, "uuid": "7ed11b4a-8d55-420f-ac4f-262bbe6f53c3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509422, "uuid": "7b14a3cc-097c-4840-98ca-96eac63d18aa", "value": "d19f5b1a678a0c2b4640bc67c23e5f6d5cecb8b988ffc07dfb43ae6fad18666e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d30cffb-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509410, "uuid": "40c6f24b-4600-4893-aefd-032ad548fd49", "comment": "Malware payload (CoinMiner)", "value": "e08e120d82f59b9906ba0c04a84555d5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509410, "uuid": "7a5ef00b-72c7-4929-ada2-7906b0e022cc", "comment": "Malware payload (CoinMiner)", "value": "d2694b21e00f48bb83b27942581d3c2a42887306b3fc692df9a1bf5716f5af0f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509410, "uuid": "23652d19-853c-4562-9e3c-8fe3a5709234", "comment": "Malware payload (CoinMiner)", "value": "efb91a4e60a0b4c8b50c3e1ad2f16b9fd6caec12", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509410, "uuid": "fe8d4051-bd1d-4b7b-b003-e26984b59f06", "comment": "Malware payload (CoinMiner)", "value": "1effb8e3b0375839202a4b6af9789c675f3ebfa56dcf74d19a2350c46aa988217312402c2476e68d434c42d65d61232e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509410, "uuid": "dd6b1da6-9ae7-4fb3-b726-0ea5eeade827", "value": "T15CF5336101CBFCFE6985D46458FCBB310D6A52F09B6C8665F969042EBC25EE3007B72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509410, "uuid": "be13c437-ae20-414a-9d9c-e7c45de72e9f", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jl9E9vH43vw0:G3LG658+S8YrCpHy2dUu4KrCf43vw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509410, "uuid": "aff6fb1b-3bef-4ba0-9da2-8ca7d915293d", "value": 3559424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509410, "uuid": "ee2ea1e0-704c-43f4-842d-81e82e926e86", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509410, "uuid": "cc2975b9-4b95-46e7-b455-d7e532a74cce", "value": "d2694b21e00f48bb83b27942581d3c2a42887306b3fc692df9a1bf5716f5af0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ac7bf7-e932-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767506413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506413, "uuid": "b2ca8e32-a173-49e9-b87b-1e07faa6dc6e", "comment": "Malware payload (WannaCry)", "value": "a7ff21a8257e49faa1923f1a2e42c2e0", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506413, "uuid": "d58b0071-40e9-4c4f-9329-1fc28cd65e4d", "comment": "Malware payload (WannaCry)", "value": "d2f1a27ceb90e61023066ed6ee9f40c9c3d53ac22e19eef3c25dc2fa16174381", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506413, "uuid": "4dfd755a-f713-415b-95e7-b7eb14da574b", "comment": "Malware payload (WannaCry)", "value": "80028f73b08bd2bdad7a76371c31ed2e1adbc925", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506413, "uuid": "a0cfd983-6b0a-49ef-b7f6-e6f73a98fe38", "comment": "Malware payload (WannaCry)", "value": "f49e619c5107b245d705863d23cc13553a1ee7f9ba3917a98f93290c8683e3ada8fd65cf51b82376a74998141eeb882d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506413, "uuid": "b6c21ab2-d3f8-4707-94e5-2952f50effb4", "value": "T15E36339975AC51F8D1550ABC80BBCB1AB1777C6E25B94A0FBF40CA356C63E40DFA8603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506413, "uuid": "e3236467-881e-4c87-add7-7b85601006a8", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506413, "uuid": "0f218ecb-4600-48ff-a299-c6ec33a3b46f", "value": "49152:mnsEMSPbcBVQej/NAARdhnvoAHvDmg27RnWGj:ifPoBhzNAEdhvpHvD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767506413, "uuid": "9e3da999-97ac-4e01-8a22-b981f994cbc2", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767506413, "uuid": "500efa85-7ff6-4f37-8fda-f7bc09ec02ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506413, "uuid": "caa85c8f-e69c-45f6-8e31-e27bc0f2a432", "value": "d2f1a27ceb90e61023066ed6ee9f40c9c3d53ac22e19eef3c25dc2fa16174381.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734e41ee-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511488, "uuid": "edb2efd1-9623-45ad-af0a-21ee5b5ad118", "comment": "Malware payload (WannaCry)", "value": "02695567732500a352fb607285d5e4e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511488, "uuid": "8c5b9511-fa4c-43ad-aa7c-ad579918c8f4", "comment": "Malware payload (WannaCry)", "value": "d333cdb64c64ce3b9dd355dbaf16754708ec61bea2212da43ef171e7893e2d7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511488, "uuid": "92157263-860b-4c7a-ad01-d5377ce9ca86", "comment": "Malware payload (WannaCry)", "value": "c8c8a457d65ac56180fc1349cc1bea7942d196f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511488, "uuid": "21f691c3-57e3-4c1a-a3ff-e5907c10387c", "comment": "Malware payload (WannaCry)", "value": "20eadd5ac04dbbbf8ceb4b73abc5b653b20138557155ee4a355bcaf389e33934bde842b616d908f047d5050328c90059", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511488, "uuid": "66f656f7-2adf-4d47-aa97-9b9f66b205e8", "value": "T110362359366C90FCC15A627874A34A66A7B33C9A31BD970F9F8487620C13750BFB8B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511488, "uuid": "87601f69-54fd-4ed4-8fd9-880778ad66d3", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511488, "uuid": "5b9fcef7-cda6-45c4-bffd-ac66f51dee1b", "value": "24576:zbLgddQhfdmMSirYbcMNgef0QeQjGA9XEk:znAQqMSPbcBVQejk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511488, "uuid": "ec80eae5-ce90-4616-82bb-fab52c770a19", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511488, "uuid": "6c7ad608-b4ae-4cd1-93b8-353181f644a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511488, "uuid": "83eb7354-833f-44c2-b444-a9db1b16144f", "value": "d333cdb64c64ce3b9dd355dbaf16754708ec61bea2212da43ef171e7893e2d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7501be8-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512434, "uuid": "202880bb-753a-44a6-bc17-28df514eda35", "comment": "Malware payload (WannaCry)", "value": "f7a58e64f1bffe8bf31674e92a1995f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512434, "uuid": "07fdac1c-fa42-406e-82cf-d06fbbb6ba00", "comment": "Malware payload (WannaCry)", "value": "d35188af422653e693ba2be6acaf8b02229e00e4ea5cb55c3f81688383fb482c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512434, "uuid": "e6694cfe-fe56-4acc-8678-cf0b81dac6f3", "comment": "Malware payload (WannaCry)", "value": "0a583c4bc73d705643956d3678c5bc6f6546d4d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512434, "uuid": "ed451637-b5fe-4230-9c64-b86459a0a90b", "comment": "Malware payload (WannaCry)", "value": "3e598ac4b3b77d29803150bc3f97240079f33503b1e93825a215dc9df945b3a5776a876c315c04957ee4b5ad763fd399", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512434, "uuid": "4ca9b8b2-bb99-4b5f-9191-7c4b00b21daf", "value": "T120363399717C92FCD10519B440BB8A27B2B33C6E26FE5E0B9F4049761C53B5AFB90B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512434, "uuid": "80f7d070-3fab-4a90-9674-4dda1924e5cb", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512434, "uuid": "63a47c42-39cd-4201-b9d6-702e1a36359f", "value": "49152:RnHqMSPbcBVQej/1INv+TSqTdX1HkQo6SAARdhnv:1HqPoBhz1avcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512434, "uuid": "b001ba3d-a57f-4a68-a1fc-362f6d5eb17d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512434, "uuid": "2804fe5e-e7b6-4226-88ab-9e0c8c29e8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512434, "uuid": "d2d8355e-e8da-433f-abb9-fa0cd2404fc4", "value": "d35188af422653e693ba2be6acaf8b02229e00e4ea5cb55c3f81688383fb482c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfec2868-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511616, "uuid": "d60547c9-2a02-4ca0-b40c-985f5cd55e95", "comment": "Malware payload (WannaCry)", "value": "2ae4d3dae2b56edb8eb7206342c13188", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511616, "uuid": "370c88d3-6aa4-46c9-9b6a-2ece5f66d14a", "comment": "Malware payload (WannaCry)", "value": "d3902f1f9a03a12391c83717074693cf320929d5b47674c0ed45687e3093d45c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511616, "uuid": "70652645-8d7e-433e-8063-dfcf2f216f54", "comment": "Malware payload (WannaCry)", "value": "e7aea1bd70c7316a963dc830e3db670ccf441f70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511616, "uuid": "e08dc639-2834-41cd-8ef6-4ba1ebd56e88", "comment": "Malware payload (WannaCry)", "value": "107122c91b3baea034e4a30cd86cedc1a2c91c602a87787d6f4788480b661094e1bc1621ec039620ac11375eedbb1603", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511616, "uuid": "a7143825-4a37-4f2f-a0df-94bc15ecc36e", "value": "T1B8362395727C82FCD209187480A78922F3B27CBE52FE6E0FDB9089691D53B55B760F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511616, "uuid": "5d3ef2b8-c32c-40e8-bffd-7374f771f32f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511616, "uuid": "da799c6f-33c3-4d2d-9395-b14dd9fee600", "value": "49152:RnnMSPbcBVlNRx+TSqTdX1HkQo6SAARdhnv:1nPoBFRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511616, "uuid": "104d5955-259e-401a-a082-0652e653b819", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511616, "uuid": "4a9c361f-2312-4c9c-a160-1527faf6c803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511616, "uuid": "b05e3f15-ceb1-4b93-b271-2890904f93a4", "value": "d3902f1f9a03a12391c83717074693cf320929d5b47674c0ed45687e3093d45c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afa24d8-e9a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767554477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554477, "uuid": "a190fc86-8623-427f-a5b2-f4163a957b33", "comment": "Malware payload (Mirai)", "value": "18fb36d46a2c02aaa9243e1b6652bbce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554477, "uuid": "e3fb9ad3-5a65-4d54-875b-6f86c33979c7", "comment": "Malware payload (Mirai)", "value": "d41215b8f3daf55f8f5b9616be8b55d663081542a82df768929106692611da4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554477, "uuid": "ed7c98cd-9f15-4a8a-831c-e301a491162b", "comment": "Malware payload (Mirai)", "value": "47ce86bf960c01f37fad5df2a5be069f883dff0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554477, "uuid": "64c55f04-54e9-470f-9aca-3c463d8602c0", "comment": "Malware payload (Mirai)", "value": "b4a93dd0b7bde6d95fae3ce5d0c9bd445608a040a51035c02bfa2da7cb418a01cf6c0d74c926ad6f14749fd17e7b0e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554477, "uuid": "fa1a544c-734a-4b48-9ab0-8c72f57e6e0a", "value": "T180344A23FB0C2463C892AF715D7B2BF69338D9D25176A00961192F2D2E33BB4598776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554477, "uuid": "5fb3b161-c992-4610-98d4-ac7561614a6e", "value": "6144:vyRPY/2o3i56mm6vqJ1j8YRmOJd0wGilds:6RXy3Dd03ilds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554477, "uuid": "4066208c-0884-4084-ada5-0a67ac535a17", "value": 246124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554477, "uuid": "ba6352ec-cc7d-4bd2-ad59-6251233407c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554477, "uuid": "63c89865-1bf4-48fa-9871-73c01e466fc1", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac2c143-e943-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767513567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513567, "uuid": "8f927386-db89-4ad7-ab3a-4997e14e9350", "comment": "Malware payload", "value": "aae1a7b857d26934e4d148e7a8887840", "object_relation": "md5", "Tag": [ { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513567, "uuid": "7896bcc9-8055-4751-ab31-5d2a5bb28f4d", "comment": "Malware payload", "value": "d4d17f6a6a1f3f7c6154c0ca1910c3ba84c67158102cbcc7bae885fe5ba1bea3", "object_relation": "sha256", "Tag": [ { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513567, "uuid": "60346554-e93b-4407-9888-ff8308b83ff7", "comment": "Malware payload", "value": "189c0b45547dd68138039f2173ced1942b9d465e", "object_relation": "sha1", "Tag": [ { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513567, "uuid": "220bacde-bf3c-4142-be42-b1fbe8823913", "comment": "Malware payload", "value": "92d99a7485bace1a759c341fdb82894b83b28ed627d1280be0f9c14202fe1ef5a462deed7aa4e2249559957f334cbb4b", "object_relation": "sha3-384", "Tag": [ { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513567, "uuid": "facf5d83-2471-404c-ae5b-3c8c4f13ea19", "value": "T1ADA00215843150A89E554335966485105532365AC85075E733415605048956696E8439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513567, "uuid": "27a4d226-49c4-4fe5-ab9d-db62c3b8ffd9", "value": "3:VSJJFIqF1F65IF/8VXuGTKNWQmn:s8qF1FkyWQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513567, "uuid": "5c149753-6060-47b3-bc9d-8a7a1a3cfb97", "value": 58, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513567, "uuid": "878a4017-97a2-4ad2-8c79-81d51d454ec2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513567, "uuid": "8b7242a4-1e5d-4151-a3a6-71398b0f2b75", "value": "tt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1a9c74-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509949, "uuid": "140e77ae-7d47-457a-93dd-202e610efb04", "comment": "Malware payload (CoinMiner)", "value": "4e6d5d42d587d4fa10e67209666ac860", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509949, "uuid": "5d636c90-9147-45dd-8a90-5f327e1791a3", "comment": "Malware payload (CoinMiner)", "value": "d4f6de9d6498a57032b3461e6e9734b2a47d8193991287d7087b16e7ee799563", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509949, "uuid": "0c394672-b809-4cc8-9123-8e3be20a999c", "comment": "Malware payload (CoinMiner)", "value": "fc9ca9e50595aa1de78d33c288170e5d405dd91a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509949, "uuid": "80e4a8ce-3cc6-4b99-ba1a-0288548bcba3", "comment": "Malware payload (CoinMiner)", "value": "a53d06080795a17e23eb62b642043f8681f824a72aaf17519f1921e61f50f8fea569b0fc8a9c0618a227bdeae6449f86", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509949, "uuid": "17bc4348-8bfe-4a12-ba88-7761fb75099b", "value": "T1E47533E101C3F7BE5AD89BC415E837350D6155E06A3A5A5AF80F0C6BFCA1FE4066BD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509949, "uuid": "01acfd8b-b343-406f-b3e1-1a31bb8f795d", "value": "24576:G3LWjlhQ4nr0vJbDFF4xjPQ86X8ut9QF+8DfiHJqZp8C18zp0iZy0TTvUTosq:G3LolhQAr0hNW188rJTQ+p8CU0r0/Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509949, "uuid": "d413c23d-c31e-4498-9a7e-ad251f043a12", "value": 1564672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509949, "uuid": "5387f821-dbc5-42fb-b217-45c60fa08e43", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509949, "uuid": "3a040fa1-fc60-48ed-9185-b582048d7cdb", "value": "d4f6de9d6498a57032b3461e6e9734b2a47d8193991287d7087b16e7ee799563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81be951-e9c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567867, "uuid": "8b95ffdb-01f7-444f-b8c8-b13a4ee9a001", "comment": "Malware payload (Mirai)", "value": "d56e07acbad974a0cc50a3b05ef7d51a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567867, "uuid": "b17405f4-ce77-4b98-bb17-a1f444b4557a", "comment": "Malware payload (Mirai)", "value": "d5061784b9959f6660258ad86bec13bcb61e05fd3c38659b23bb3661abe10f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567867, "uuid": "4a8e7266-9888-4b9e-baec-0d819628e2cd", "comment": "Malware payload (Mirai)", "value": "c14405e83408eeea82060c5505870e33c7b6202b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567867, "uuid": "86fd395a-f5ee-4aaa-9c88-56ab013b15b8", "comment": "Malware payload (Mirai)", "value": "a1873a128233bae766485990c65f0af01ac314f2928283441d97ba3b7d07492c7c896cbead59669b85f341867e20bfc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567867, "uuid": "fd892d73-ea4a-4f36-9941-2efca7649c02", "value": "T1E383B60A6E21DF6DFB6C873587B78F319798239226E0C241D16CF9045DA434EA45FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567867, "uuid": "a5d68668-2fe1-4b13-897b-a957a45f924d", "value": "1536://a5wt3N/MpUrYwNRPM6o4USDkdKH4j3DYxHYzxZdmZdmZdRKdRZiNBdzyEJC2E3:K5oNzLPJ1TD8DDYxHYzxZdmZdmZdRKdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567867, "uuid": "de52499b-2a4a-4810-a158-5e723a0ab2db", "value": 84944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567867, "uuid": "f4ce384c-ad09-4ca8-ae06-6874b0353fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567867, "uuid": "dd406fee-8995-4799-9ed9-14e6ae9b104c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7334ed8-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511628, "uuid": "ecc4f896-ee12-44fb-a69d-be40fa558fc0", "comment": "Malware payload (WannaCry)", "value": "8215323ed464b7bfc7b9374580faa557", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511628, "uuid": "92e795a2-f48c-43d3-b244-90ebee252ce8", "comment": "Malware payload (WannaCry)", "value": "d540784d06bdc4b7d7bc8e7713bfb0bfa49f4a23b2461f82876320accdaf388e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511628, "uuid": "e665ca14-6142-4305-9968-e62992b7c0d8", "comment": "Malware payload (WannaCry)", "value": "c68300c4a8788c4a4c6d75a38a4b216fc2387c94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511628, "uuid": "842365b8-af81-4405-aec4-97ed1f97609f", "comment": "Malware payload (WannaCry)", "value": "12cc6d554b0ea122f5f429a94004d405495115b9cf465b8bd5c86609b6607e852002db931bf513f6bafe0eb6ad316008", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511628, "uuid": "4c1358d7-2b3a-462c-91e7-0cb45d9c0d5d", "value": "T129363359717CD2FCD10919B404A7CA67A7F33C6A16FE6A0F8F4089661D13B19FBA0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511628, "uuid": "379aeb59-98c8-4e92-844e-be9e93ec9699", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511628, "uuid": "0a3eaf8f-f6fe-4ebf-83cf-15c435200299", "value": "49152:RnFQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1eqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511628, "uuid": "ac38d14b-436c-44b9-bb17-52bd2b0c1bf7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511628, "uuid": "e38b9cf5-772a-4831-be1f-a3e067021459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511628, "uuid": "da27619d-9140-43fd-8260-7c1151cf37f8", "value": "d540784d06bdc4b7d7bc8e7713bfb0bfa49f4a23b2461f82876320accdaf388e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cd3082-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519968, "uuid": "6c24612a-64cb-4842-b288-5ff832694d82", "comment": "Malware payload (Mirai)", "value": "55ad17fbb66e4f5fc128a3d779c96c68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519968, "uuid": "a1f7ab46-ecbd-4b2d-b191-babe535ef14d", "comment": "Malware payload (Mirai)", "value": "d5417d4967c4552dee42f0e40f0f2da9df8d32e951524a670d12cbe48d2bb5a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519968, "uuid": "c1d1181f-e29d-452a-88ba-a8d86634ecf7", "comment": "Malware payload (Mirai)", "value": "66b697db945a95f5d6b759db15775cb43b184311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519968, "uuid": "a044dab3-9a97-4acf-858a-cffc9ffbbfc4", "comment": "Malware payload (Mirai)", "value": "a6bb5c251b0e521beb14b77a742cb95af6d8888247db0141412175c8dc045b16eed0adaa2d987b8e305607ece87d032f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519968, "uuid": "767556cc-19dd-4219-926c-228efe271e5d", "value": "T112E34D86EA408E13C0C51776FA9F414A3322E795E3DB33068D185FF43F8AA6E4E57616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519968, "uuid": "2fe628b4-4a8f-4910-be5f-8970d1f1d893", "value": "3072:IXfJrjxz6euold+21MrdgH5CwBrEV4fY9kUQ52DdFag3OM/9ntv/r:IPJrVz6elrrBrEV4AjQgFag+M/9tv/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519968, "uuid": "b844586d-b36f-49c2-9831-ebeea41ddbcc", "value": 154840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519968, "uuid": "25364c42-de27-46a2-bb31-456674f5c998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519968, "uuid": "54b87ef2-d92c-4942-8112-62ec4276fd67", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b049e6-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567346, "uuid": "d1aac710-8af5-4ac7-b660-8e5e714a9f4b", "comment": "Malware payload (Mirai)", "value": "f4e0dc7cb3e69d360c8e357d1c384cc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567346, "uuid": "9cd91fa1-5386-40fd-935e-8c69279ccd27", "comment": "Malware payload (Mirai)", "value": "d56be67568ddf8da343c55e9913729da5fed8525efca897edf017dc9e0db440b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567346, "uuid": "e1c6425b-43b3-4510-b084-e9befb44bafe", "comment": "Malware payload (Mirai)", "value": "37b6c7bd404a2db015369410b757be6837597e53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567346, "uuid": "8c160698-8d52-4f7b-9c59-92c1aff872a8", "comment": "Malware payload (Mirai)", "value": "c5d331fa782af88946b497ba0af8b9676521e470d01e685bd37911a09d9d82a6ce59306fc35da5e065dfff00da21ef24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567346, "uuid": "8a7c3dff-a2cb-4db9-b265-81231e9485ac", "value": "T185432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567346, "uuid": "944b1713-2540-435b-8159-24e39f7f074c", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwZ:RqtmZPuutfbltZFBSJsBcfDSTFI+BEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567346, "uuid": "6553a3a7-6c78-48b9-9697-751267727680", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567346, "uuid": "2883ef4c-920c-4c40-a021-0689de25b7a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567346, "uuid": "6c81b3e1-6312-4ef9-a51f-2bab1e51d0ea", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7ba494-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512739, "uuid": "770cc93e-1862-4867-9bb0-e4e2e99a86ee", "comment": "Malware payload (WannaCry)", "value": "da2506e63930938a41ad2bf44d59697b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512739, "uuid": "7a97373c-092b-458c-a095-6b21297091ac", "comment": "Malware payload (WannaCry)", "value": "d5bce7431b4dacbfd07c36d7ddbb2ffea2fe71c0f9c125a437b9339a2943231c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512739, "uuid": "2f1e3e76-66ca-4780-8d81-afb044813f28", "comment": "Malware payload (WannaCry)", "value": "4ce1880e6c66791952b80102521b439008a4def1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512739, "uuid": "2ca9cfc7-e3af-4d96-a541-6b3b5c1a3b35", "comment": "Malware payload (WannaCry)", "value": "63d8b1a709fcedadea776c9354b82aeb47bf02b346c23a847778d2fad5925a7de1bf246439e377b75e3243a8bd1455c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512739, "uuid": "2978813c-efb9-43b5-bdf2-e523a589991d", "value": "T11C36339971BC92FCD20929B49477CE13B2B37C6921FE6A0F9B4089791C43F46B790B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512739, "uuid": "ce5360da-13a9-4de0-be26-18f5d3c1ef3b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512739, "uuid": "364a142d-d1db-430e-82ac-981b42283a60", "value": "49152:RnnMSPbcBVQej/1INRx+TSqTdX1HkQ8Rdhnv:1nPoBhz1aRxcSUDkxdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512739, "uuid": "1f590100-2907-4076-8a07-d83fa64bfe0a", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512739, "uuid": "138736ee-db06-41ed-b635-38a10c893f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512739, "uuid": "42ebc5f2-54fd-405b-afb7-d2d94b554611", "value": "d5bce7431b4dacbfd07c36d7ddbb2ffea2fe71c0f9c125a437b9339a2943231c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7e1b18-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512198, "uuid": "5b1ef94f-bebe-4b83-81f6-bf81be61e28e", "comment": "Malware payload (WannaCry)", "value": "17ee20d6591b493ebfede83792314344", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512198, "uuid": "6d47eedb-8ac4-49cf-b27e-62a4aa97eb92", "comment": "Malware payload (WannaCry)", "value": "d63574b6db9af1bd2150c888a7b7eac9eb5884a3723c3095397bdcb3d58882e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512198, "uuid": "93906640-0f06-4ea0-a06f-3c0e81c37e4d", "comment": "Malware payload (WannaCry)", "value": "24fa2260b31564a5b17db3b8b512530e3d0ca9ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512198, "uuid": "3e607129-322e-4e26-a86b-a295124816b4", "comment": "Malware payload (WannaCry)", "value": "747296a0c83d1095edcafe46ed499c19125c028f6aa7d48f4a4fc4784871227a16ba8012a02bf890cc51d6326a08e968", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512198, "uuid": "f6650fa6-6f33-40be-9153-010a9920a6b2", "value": "T1C236239192585AB8D0900AF60066CB26A77E7D2997BF673F5B40825B0D73F0EAFD4F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512198, "uuid": "ff124aa7-0d6e-45ef-bad6-a4e1b0b4dc94", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512198, "uuid": "2412415b-186b-4f5b-9173-e7eaea99ed49", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2x:d8qPe1Cxcxk3ZAEUadzR8yc4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512198, "uuid": "e8059e45-c0c9-4687-96ce-f84103e0a395", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512198, "uuid": "3390ef10-2502-4dfa-9c27-8c218326f02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512198, "uuid": "c6cd6e42-0f35-44d3-bcd2-c3e627c60b9d", "value": "d63574b6db9af1bd2150c888a7b7eac9eb5884a3723c3095397bdcb3d58882e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ff0738-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516721, "uuid": "4d0f466a-a495-4fa3-aa16-42158f86d6f2", "comment": "Malware payload (Mirai)", "value": "a38b4450d00a38c63de1fb89832b174c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516721, "uuid": "5b959a80-55e8-40a0-973b-a8380d09cd1a", "comment": "Malware payload (Mirai)", "value": "d66bb89ed010c0bfce592c9a89238d525bdd3d78aadac8bfb08193b200094766", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516721, "uuid": "604cbdf4-b8df-4d89-a2d8-270adaed3399", "comment": "Malware payload (Mirai)", "value": "2be1863867684b71678ba594b144f2f5eef8d93e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516721, "uuid": "bb0579b7-1d0d-4568-8993-3ffe7695e645", "comment": "Malware payload (Mirai)", "value": "60780bf15fcfc81349e60dba66a39dc929dd6968eb13780fc9134e15856f2ff2722bb76e4fe262a8f6ea0f907cd1c1e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516721, "uuid": "5fb3aebc-d886-49e9-97ad-943ff4f20797", "value": "T135F36C86E747C2F3F81A05B46067F73745F1E93D002BDA96DBB4A931AC61642A61B33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516721, "uuid": "3ad5e9e0-e1ba-4ade-923c-f647f9741120", "value": "3072:MNNOGToor/BZHRHzXAS7eTfzVSytBACTP3J+CJHTaW13Zi987E:Mffr/BZH5XS1SoTP3HJzag7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516721, "uuid": "493d250f-5d8a-4800-a695-6dbd34229a84", "value": 158228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516721, "uuid": "b20a33cd-8759-4648-a1b8-587dae00e6d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516721, "uuid": "6176ef39-a52c-4b40-bd54-3e5eb8fe8df4", "value": "d66bb89ed010c0bfce592c9a89238d525bdd3d78aadac8bfb08193b200094766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39a1a00-e947-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767515488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515488, "uuid": "afb039f3-5bb5-49a6-b7dd-c3ede50dfe05", "comment": "Malware payload", "value": "9675f773287c39aa110e98aeaa14e8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515488, "uuid": "787e354c-3869-4f7a-bee1-005661f95504", "comment": "Malware payload", "value": "d6d2a82cb80f3157e007dbf12b22617559002102804b2e5feee3aeca46ea0c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515488, "uuid": "5f598c2c-c3c7-47c5-8168-b363c5131741", "comment": "Malware payload", "value": "01ed0c9ffb33a5ceb9a1cca364d5c1928bfa66ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767515488, "uuid": "19a2d5d1-944d-45a1-aa2d-41f0771d064f", "comment": "Malware payload", "value": "12322ffb2c1197839fe717c3cabc88d774498f69bccc6f59821362be04de42c6930e12ab0050c9d2752fe15b2b773330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515488, "uuid": "9507a46d-4881-4bb7-bb3d-66edc7802476", "value": "T19A07625F464303BDA4A205B60AB6895BBCEBA9D23711ECE34C3A051A03D94F5C6FE5CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515488, "uuid": "4a5c9b5e-f522-4b25-b87d-b3d752256fcc", "value": "91da3881ea3b816b94a727ed283639a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515488, "uuid": "d222512d-30fc-4011-8018-d244afbef45e", "value": "49152:ZMhqra5RMfXSXnbl1u62s8ZFyu08sgcX7iMUl48qdixLbZrpxnpyHR1TJsCQku63:ObiBzyg5Izd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767515488, "uuid": "a4940d26-764b-4edb-8974-9fc370b6ee85", "value": 17382400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767515488, "uuid": "ccef66dd-0b96-4f34-8e49-bf3f04280af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767515488, "uuid": "44811c57-54a5-4982-b501-9cd00df218d2", "value": "DeltaClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b522ab4a-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509880, "uuid": "b7dec735-906b-4774-8e55-d0588f89daae", "comment": "Malware payload (CoinMiner)", "value": "4687ffd4d0e8f3b1656740d8a3e6dc1d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509880, "uuid": "c507f724-8fae-40e0-a894-7d969bcee3a8", "comment": "Malware payload (CoinMiner)", "value": "d71f82ff9761c9fb9487ac86b513720d5c5b1118db9bc2b382329496ac8e94f9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509880, "uuid": "f9fd2fc1-798c-4080-8733-dec57a9f25b6", "comment": "Malware payload (CoinMiner)", "value": "bb4270674323f1349a4626722dd8e7a3a2862fac", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509880, "uuid": "1c9ff6a4-4753-4a8d-a061-d72212515d03", "comment": "Malware payload (CoinMiner)", "value": "c1a53e4779f3f537b7062fb36ee19f018f4d5850e3de75588389b5bbcaed69a47c698ba884d16228c2e303ccb4d51add", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509880, "uuid": "5464f77f-5e8a-4218-ab9f-fa5e886f7d19", "value": "T10295339000C3FB7F469C9AC858F876301E6599E02738556AE84F1C6BFC72FE905A7D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509880, "uuid": "b8b5d77d-3c69-4fe6-b188-8b3ca3924900", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqb:G3LG658+S8YrCpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509880, "uuid": "bed95f3c-1707-4ee3-89cc-ec62f50acb07", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509880, "uuid": "41ea983a-169e-4c23-8093-786a43eea7a2", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509880, "uuid": "7104e64c-f565-49fd-b88b-aba13dcf0743", "value": "d71f82ff9761c9fb9487ac86b513720d5c5b1118db9bc2b382329496ac8e94f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc1c7bb-e984-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767541593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541593, "uuid": "da59f60f-4239-400a-9ed0-a59ce921da79", "comment": "Malware payload", "value": "e6767efabf3da565317758ee582d7405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541593, "uuid": "0f7e0edb-a835-471a-ba5d-210a7abb4d9e", "comment": "Malware payload", "value": "d7e9c3c649a34d505b73a00b72b20f0048c4495244da3b0c6ece56892f33d058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541593, "uuid": "08996e8e-b5d2-444b-9163-cd9a41c4dee5", "comment": "Malware payload", "value": "6b7e480e6ca1e63531b64af4265b017bac7b944f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767541593, "uuid": "1d3e0de3-9b37-4b3e-803d-cc0160f4a093", "comment": "Malware payload", "value": "13732594a672d42f28361e07e61c75250f35f4afa45abe7b9b2eae5a7187a9d777fde408016abd7ef41136c1dd2764b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541593, "uuid": "a257f099-4edf-4cd3-910a-293c90f66a95", "value": "T10B073B87E8A25DD4C8EAC674916A8157BAA17C0D1B7823EB17E0F3301F32BD05E76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541593, "uuid": "d398c52c-60ac-449c-99b4-f3562b0827b6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541593, "uuid": "3c70ea09-420d-4c06-94ce-efca4a7017c4", "value": "98304:4vjMeNIlOyVq41ka0TWcbiztpKLweHjqG3iefUG5XtIbF+OvA:4vjMegOM0TWcmPKLw2qIieMGT0F+O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767541593, "uuid": "e3e7aaa9-a01b-48b5-8b02-7c9bd2cbaac0", "value": 17486848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767541593, "uuid": "6f81990f-2d13-40aa-b994-2e44e00f69fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767541593, "uuid": "7d375cd5-5def-457f-bb26-9b09d4fb044b", "value": "clipper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f538aa94-e94b-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1767517289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517289, "uuid": "5928fcd2-2b9d-4277-86f0-8e2e3cf4f5fb", "comment": "Malware payload (Arechclient2)", "value": "c004df54da96ed59476b8d32f91b625c", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517289, "uuid": "2d343692-a534-481a-89f4-15bf76ff4f0c", "comment": "Malware payload (Arechclient2)", "value": "d8703f3ae5d5d14e99ee750ec4da64a4c4ffbf242355e2c526285673c3caffcc", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517289, "uuid": "75daf467-4d27-4319-ad93-cea1f835b361", "comment": "Malware payload (Arechclient2)", "value": "62ba1a15268ce16a1fbd0da2158122bb45d84c0d", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517289, "uuid": "d0a265b3-291c-4197-a2b4-f62edfc6d679", "comment": "Malware payload (Arechclient2)", "value": "4323b82bca889563433be98ba560c403d81acada19f95383ec1ffb1ad9fe6079e9472b68a608faf81c87c09d8e9b6f9b", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517289, "uuid": "63945e8d-732e-4981-bbe4-636164bf4d82", "value": "T1D7158E6D7647AA29CFEE777581FF5F09827812EA8982A5050BCCC8D06FD532DD709B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517289, "uuid": "cb455bdf-809e-488a-9151-8cef7396c58c", "value": "24576:PzsTpr0F4ag1pdpGeuufAajnwD91ttZfgxuRhDQ1GNGB8ZLmppZh60GMC+HzBXko:bh4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517289, "uuid": "7366c488-fa54-4899-ac45-2c5a5e9946d1", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517289, "uuid": "0b427589-119b-43de-b787-cdde09f2ec8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517289, "uuid": "b4b42600-d34b-4acc-b421-928bb7aa18f6", "value": "exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f22cb1d-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767519963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519963, "uuid": "e703d74b-1307-472d-8396-8fe9c77aa022", "comment": "Malware payload (Mirai)", "value": "b18538d757e59a10af38feb7d74269d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519963, "uuid": "9260b711-de5c-428b-9726-ff52d49cd0ac", "comment": "Malware payload (Mirai)", "value": "d8c00911c9e3a92fc4caeab67c68a144ca3f4b5637920861ed09dbf0be9aa633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519963, "uuid": "18b1db51-d28d-4248-9223-191eb1875575", "comment": "Malware payload (Mirai)", "value": "d4e9265b7c8279fbf5d03ab814f4b135592e9f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767519963, "uuid": "85ba5ca5-9691-4ce5-9945-b449a84a4d82", "comment": "Malware payload (Mirai)", "value": "d4929e1bc92b52afb9d819dc8c3ac03a59fb5b28ec60bc9216e80ef27f29c7e6cbf6009f298a0354e74937985b7f3b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519963, "uuid": "2a967ee8-c17d-49d3-932d-02cd9961ca6b", "value": "T107734C0077588E07E5E90AF9283F17E483FEEE4011F5F4446A0EDA5A4235E735999FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519963, "uuid": "ae58b33a-ff31-4ab0-90ed-462c7ca735de", "value": "1536:YfFBpEgqeh1803rtqkinkKg/KUWBov1U7GtIk7VeP8bYB0:Yf9Egqeh1803rtqkbNU2IEVvbw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767519963, "uuid": "0e0d0424-40c5-4479-a2d0-ca93fd61ffe6", "value": 74856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767519963, "uuid": "d3177e37-69b1-4f3a-acff-0bdf9b213f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767519963, "uuid": "1c0702d4-240e-4f86-a2c6-4c58acc0f4a3", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bac33c0-e94d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517810, "uuid": "8901bbeb-64ad-4cc6-954e-14027956933c", "comment": "Malware payload (Mirai)", "value": "b54cfcc5944dc4c5a8a6778bfe85f962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517810, "uuid": "84800ccb-9734-4c44-9a87-e752efbb0928", "comment": "Malware payload (Mirai)", "value": "d90b52ec4e5b30831b620106061664f9adeb84a773115376384baa49c8027c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517810, "uuid": "b4d1e223-8f7b-46ec-b1b5-da45290458e6", "comment": "Malware payload (Mirai)", "value": "0bdfd1f325981f817d99203be4fae7a90aa18376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517810, "uuid": "72b0a36a-0fa4-4f62-ae6b-657973b2573b", "comment": "Malware payload (Mirai)", "value": "bbd204051149fd96105cdfc7d0885f51891cb6885961dabcea086b5895b029dd894b91c3861a96af6ad4a91be6bdd82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517810, "uuid": "e55babcc-efef-4de5-a74b-897ab75ec172", "value": "T12AB3F656AA829F01D4D731BAFB9E815833536FB9D3FA3101DD20AF6023CA5DB0F66116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517810, "uuid": "1e30bc0f-1f25-4300-a37d-81f230965175", "value": "3072:/8LtijfmFeAacV5HV3iXyYE/bAwTWYKK4r:/WtirYeAacV5HV3oyHb7TWE4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517810, "uuid": "e86209a9-22d6-4d99-9ec2-50ef49135bed", "value": 108512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517810, "uuid": "ecc9e7cd-9614-4e33-90e8-ba5d00b43d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517810, "uuid": "355f2097-ba1f-4f6d-85f1-12ac5a6840a8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0628e04-e987-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767543024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543024, "uuid": "0ab25cf5-2a37-40a8-9475-ae89fea0974c", "comment": "Malware payload (AsyncRAT)", "value": "db84c22a46e882c9e20a2c1ceb43e02a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543024, "uuid": "18be1f9f-6270-4631-9f7e-6d174b5107c0", "comment": "Malware payload (AsyncRAT)", "value": "d9809fcece6925ecae2fcd77f50fef52a93be62b9d2f464a5ef27cfa59c604d0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543024, "uuid": "a14c2111-3160-4cf4-9b9a-611727934153", "comment": "Malware payload (AsyncRAT)", "value": "68660e7c1e58cc7394ad721f76ff95135d4795fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767543024, "uuid": "59862277-c097-42d8-b1da-2ed9d72cd26f", "comment": "Malware payload (AsyncRAT)", "value": "b093f45fa43971cebbb8fe1dd7c36ed2001de099521364dfaecbc1f4a3bb106e24235b87311684b24eae31d01eefe787", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543024, "uuid": "4094cfa0-0e68-41ff-a1a1-39f44248fe7b", "value": "T1D3233A0037E9823BF2BE4F74A8F26245467AF5633503E69D1CC4519B1623FC68A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543024, "uuid": "621e21da-3cdf-4622-9fa6-5b4ecaad4946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543024, "uuid": "0cb668a7-cb82-4645-896f-f7f62be536da", "value": "768:kuEjKT0k3qXWUrV6e1mo2qyIKKODTQIM3NOPIozjbpgXzqijY3LfdbzmwKoy7g9X:kuEjKT0cE2/NKoTY3o3bmXHG1rKVgnnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767543024, "uuid": "ba8c2390-96e1-4d00-bddb-b5c5374ab231", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767543024, "uuid": "3dd81cb0-4f2a-4298-8aa5-5f2c8ccd13e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767543024, "uuid": "713445f2-387b-41ad-ae0b-87b5e5fa7525", "value": "Fly88BetCasino.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2859e7f3-e96e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767531978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531978, "uuid": "cbb23191-0a3f-4e88-98bd-5f3015052ef7", "comment": "Malware payload (AsyncRAT)", "value": "228e23a926de993c2f4a2ffaf5792e87", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531978, "uuid": "659df85d-13ae-4c10-a991-e2c3d3d34a2c", "comment": "Malware payload (AsyncRAT)", "value": "da268b5f413ac53f0f9488912cfe693fa15a50b0c7635b64dbbfef2325e44a4b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531978, "uuid": "3e09525a-6f49-4922-8524-fda767bd56a0", "comment": "Malware payload (AsyncRAT)", "value": "98e1c2e099ae07f1018dc1d951db0b58cc1a0cf8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767531978, "uuid": "6db92db8-0bba-479c-a4c6-43e193999f9b", "comment": "Malware payload (AsyncRAT)", "value": "e66b132a18c14bc5e628ee47e7aeb19ceca3be975a1d18c33e362a80a7e1fe6dd06746d7a3ee35746bbb22c8dc528395", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531978, "uuid": "3fe061b1-241a-4533-b440-132a7307358e", "value": "T1AF537C187BFA4125F4FF9FB01DF17256D639F663A823961F28C5028A1623988CE507F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531978, "uuid": "42a8e70c-cafa-4bb5-988b-07d0d7596ea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531978, "uuid": "4f1502f4-4efd-44c1-9bd6-f3309b451f5c", "value": "1536:HMwAT1Aa1XXLz32zNe+aRzqb2pIjThcSX26/uzoewOIem:k1AaF0e+czqbQchcEuzvwOIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767531978, "uuid": "a154dc3f-3201-4394-9af1-678a9ef485c3", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767531978, "uuid": "99a44994-b2ba-4865-a889-8f6c8a581a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767531978, "uuid": "3c07a045-b7d0-4b84-9dde-61070cdc947f", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b448af-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567210, "uuid": "d993b6c5-7a33-4559-82c8-d686d3a4f106", "comment": "Malware payload (Mirai)", "value": "a3b4887fac1ea01344519c388fff6d88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567210, "uuid": "8dee395b-af03-4b71-bd51-049731f16a75", "comment": "Malware payload (Mirai)", "value": "da9297bfe393c4f671b20bad0abce6bebcab10fe52ce3be12ecbd006d8583347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567210, "uuid": "0ba85911-5dee-4fa3-915b-f4fb6afdec1c", "comment": "Malware payload (Mirai)", "value": "c7db8fa3fc5d2d352d4b56d8381400d503c36c43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567210, "uuid": "9a5af717-63f0-4e66-aeca-dab1a93ff773", "comment": "Malware payload (Mirai)", "value": "211a49fa93952ce00416169d571a38f6f0b26ff0987de351885dd65d93cfb9858f3de5898b7cebb42495d861df48de0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567210, "uuid": "a9ffc466-8da0-4e17-a19e-a4ac647d31ff", "value": "T1DF230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567210, "uuid": "23915697-ae2c-4eb6-ad32-6d11eccf5b49", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9TH4:5DmKF7Gxyk8cqoHAmWurAufsG53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567210, "uuid": "24a7edba-7596-481f-b68e-b453f4077aab", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567210, "uuid": "563013a8-5a0d-4a57-9c22-0adf5e7cf938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567210, "uuid": "c1d09638-bdb8-4610-98a2-11cfa197b6b0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cc5ea0-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513025, "uuid": "9281a3a2-d541-48ee-8ca1-0726797abbe1", "comment": "Malware payload (WannaCry)", "value": "9d62c20962bd192c99e09b38ffdc2be1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513025, "uuid": "36e24b02-a7ca-49fc-87eb-c8a199972431", "comment": "Malware payload (WannaCry)", "value": "db5a4c852c3ca9541a45a680a58c4245ae903dab7b2a66c2d95261686207872e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513025, "uuid": "a77abec6-9bb0-4b17-ab2b-761cc2aa57b3", "comment": "Malware payload (WannaCry)", "value": "7381cffe8d0fca29ff7e45797ea377ae8dcf76e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513025, "uuid": "62a651cf-6c1b-4bbe-becb-929dac239e30", "comment": "Malware payload (WannaCry)", "value": "6c6145baa46f937ef7ea5d8d65046db10635ffa2cea6af7b5c3fc50b07957265bbb9a44ba66aae87a7f8a57d8f534231", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513025, "uuid": "0930c1fb-49ff-4ce6-81a5-4f6706b9713e", "value": "T19A364901D5E51BA0D6F24FF6267B9B00537A6E45895BA66E1221A00F1C77F0CDEE2F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513025, "uuid": "915bfef7-a6f7-4fc2-a5d6-b91f5777e66f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513025, "uuid": "2768a5b4-dac9-48af-852d-fa3ba2391c30", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513025, "uuid": "fdafd774-56e8-4a9e-8f8f-c5f293d98855", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513025, "uuid": "f8e99826-4728-4e51-b30c-505675c12e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513025, "uuid": "c8ad6b86-0ea5-40c2-9a33-9dc02a8386ca", "value": "db5a4c852c3ca9541a45a680a58c4245ae903dab7b2a66c2d95261686207872e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a5027a-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767554824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554824, "uuid": "64c9a1a1-e6f3-4016-9403-9da0b8d2381c", "comment": "Malware payload", "value": "d095d0b3b47f31eb44f0e32f4cdbfe94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554824, "uuid": "8e087dc5-9ce7-44a6-b9ff-8f32519f14fd", "comment": "Malware payload", "value": "db82b674c6a9e35c4b2586a5f85f322fa21123c83ea5ed9fe9a5214a2cd1377c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554824, "uuid": "cb262ce1-9ad5-4337-a5a4-00909dcc1807", "comment": "Malware payload", "value": "84fef4a6baac3bad5bd7572d0673d0a078e63b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554824, "uuid": "e1617f64-d4dc-406c-b7f2-6f6ede08ec93", "comment": "Malware payload", "value": "16eb8f891dfbffd5cdcb62ea08bbad25585541633a811255beaf4989578b69ff35a18e3cc1ca2d84635f0f84241b7a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554824, "uuid": "3cd4e4c0-a88b-4117-94c4-abedfc78e471", "value": "T159F39D1A67E420AAE4BA537499F302835A327CB15B7582FF22D4D57E0E336C0A572F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554824, "uuid": "62196fd4-6f16-4368-bc51-bb1371e48ac2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554824, "uuid": "5ed8c9b3-4dd5-4f59-8d51-fce2bc3dad19", "value": "3072:kahKyd2n31y5GWp1icKAArDZz4N9GhbkrNEk1QYo2ZT:kahOKp0yN90QEkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554824, "uuid": "3aae4078-bb40-4f7d-a058-32df1f24d243", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554824, "uuid": "e9f73060-8f67-4bc8-9868-9f57975e1bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554824, "uuid": "7496d1f1-f9e9-4c35-aa31-66a3d7102923", "value": "SecuriteInfo.com.VBS.Agent.CHD.13575.17955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1503e9b7-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767554709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554709, "uuid": "de1f80db-1e03-4a6f-b04c-869aa4723121", "comment": "Malware payload (ValleyRAT)", "value": "1818d962f04bdafba255f0a2bdbc5385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554709, "uuid": "2df9a753-a3f9-4570-baa6-06994dda8969", "comment": "Malware payload (ValleyRAT)", "value": "dcc0e2606f2881c371ae80d41f558fded4fc7723c15f458d067e6fb790da6829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554709, "uuid": "d68af821-836e-4228-9aad-964caece467a", "comment": "Malware payload (ValleyRAT)", "value": "0e973e1fe87713fd76ce6610f26452975f543ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554709, "uuid": "daf2fb07-245f-4036-8291-e452582bc01b", "comment": "Malware payload (ValleyRAT)", "value": "ee4c86b68b15ed3c1337655fd864d3883cd7842afb0e45facf847c03338597575fad5816288701f355171a01f1099ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554709, "uuid": "8d23c921-9c49-46c5-a454-ec4a2e6f4eba", "value": "T1DE3523552199EFEAF689D7F2753C5266AE0E1D324C7907084A8414B498FB3272F37B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554709, "uuid": "2c642c1d-6ab3-4086-b89b-a517a4cc3122", "value": "582292bd9ed48c1037a2ce70bd055916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554709, "uuid": "296f81a6-1e5c-439a-afc1-3e2772cbb663", "value": "24576:s+uvkN9QuD+29NBjfLsKy+2dX2Uudjlpth9WvlsHNgl6:wKee+aJK+AX2UothKMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554709, "uuid": "7910cd59-f9f9-44b1-be2b-b6dc4bdd2889", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554709, "uuid": "31aa9e99-3d01-499c-ac62-34d877704594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554709, "uuid": "098262e6-98e5-477e-b8e5-9eae5f8187af", "value": "1818d962f04bdafba255f0a2bdbc5385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101e2a42-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555130, "uuid": "1a02b0d1-047a-48ea-94e2-7e00c1470fef", "comment": "Malware payload (Mirai)", "value": "1ae9f9014f053f2be0809f0057040233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555130, "uuid": "5ead4d6f-aa5b-42ad-aaca-06b5a32087ea", "comment": "Malware payload (Mirai)", "value": "dcd2dd87f08b263385c28d1781fd7644a5b505aa927b67b63660284a6864c2a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555130, "uuid": "a51b5d09-4311-4fdb-ae8c-91360b4152ac", "comment": "Malware payload (Mirai)", "value": "44d463b4efdb7ed7ad30362eeebd03a85dd3c240", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555130, "uuid": "999526c7-d5d4-4b3e-b0d6-cf53bbdd501b", "comment": "Malware payload (Mirai)", "value": "f0dd6335d5cb9acc13c84ef30d71b4390185802fdcaa91834b9098e9de7d256ce756798d745c8371711c3ee49f6c449b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555130, "uuid": "216d030e-05ab-495e-987e-801d0ad4a661", "value": "T1CC54E80AAF610FF7E8AFCD7342E90B0528CC641B25A93B757534E918F24A68B16D3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555130, "uuid": "7db3194d-795d-4e1f-b57d-972ff1e231b6", "value": "6144:6R6Xd9Uz1pf2cSPqAg0G8PnWPfUi3bcmMziyDrXrE:6R6Xd9UzavPq8/ifUiQmQDrXrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555130, "uuid": "7a207889-c22a-493f-b283-8b604f7fd18a", "value": 298444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555130, "uuid": "e9ef0d75-e5f9-40f5-8d62-05bd7be59334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555130, "uuid": "f18f2150-e1cf-4362-b336-85fd7c16dc7f", "value": ".l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63959613-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513179, "uuid": "58ef09f7-9ad3-4f73-9ce7-4daf4b42a8b3", "comment": "Malware payload (WannaCry)", "value": "1cd384922855df02b6d795797131f77c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513179, "uuid": "dfd0adcd-65ca-46dd-bb80-92af10727c2f", "comment": "Malware payload (WannaCry)", "value": "dd1050fec1b43023018c086209a968a90c31790f5d3b8657a1c83c308a0aec23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513179, "uuid": "92cace3f-bc7c-4375-bac8-c5273ff1de1a", "comment": "Malware payload (WannaCry)", "value": "7edaea01eece54155ff25ff559893138fa42e6ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513179, "uuid": "51f5b63b-1d12-4dc2-a385-89c32a9bb02a", "comment": "Malware payload (WannaCry)", "value": "cf1d1afddd2edf882cb859fdbc9a78a0594bd752df250ad45552959aedff80f0f02103d3726cf974a17f833918836270", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513179, "uuid": "0fae0c78-6bfe-4067-b8ce-33cbf970483e", "value": "T1E43612A672DC80F4C609A130E4771A25FAB67C7D21B5960FEF908F651D23792B764B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513179, "uuid": "f2835a6e-045e-4549-8e5f-e8df0f319a12", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513179, "uuid": "27999101-defa-44e3-a269-040fcca52302", "value": "12288:T1bLgmluCti62rIMu7L5NVErCA4z2g6rTcbckPU82900:RbLguri3dmMSirYbcMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513179, "uuid": "ff918872-0a73-4d0b-9794-e2b339fee9dd", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513179, "uuid": "c6fd5124-f106-45fa-a947-f0b86c7e801a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513179, "uuid": "a0551080-01f3-41ff-b87d-86f8cb0ea998", "value": "dd1050fec1b43023018c086209a968a90c31790f5d3b8657a1c83c308a0aec23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fcc2fa-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512754, "uuid": "73778c37-cfbe-414d-a75e-4249905ee082", "comment": "Malware payload (WannaCry)", "value": "a3a301298e10c5c53c49475d2b1da7f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512754, "uuid": "9ff7a45d-4f3e-4e1e-8bb6-d178aab429b5", "comment": "Malware payload (WannaCry)", "value": "dd63c867a97cac9a55e003dabce9c9ffb1714560cb4f9817b977d0b78d16ee47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512754, "uuid": "e80d4b76-2491-4d1a-9b2d-aea6485f6022", "comment": "Malware payload (WannaCry)", "value": "65288a48fa2074d82c41d72478f6121ad7c5583a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512754, "uuid": "4c44832f-2f87-4a4e-8b86-2701eeabc034", "comment": "Malware payload (WannaCry)", "value": "cc1c26915e138184ed62784ed34c18b0ac7b3a69f9a97e93583da3d86b855afd18b70b34356608328f00a7978d09187f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512754, "uuid": "869a21bc-d1f7-4a9c-bfcc-4990a85abbb6", "value": "T12D363399727C92FCD105197480A7C927F7B37C6E42FD5A0F8F40896A0D53B5ABBA0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512754, "uuid": "013c2b9e-c810-4590-b195-b144d2cac5a9", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512754, "uuid": "0caf54a7-2ad5-4cc8-af5d-0900dd8eefc6", "value": "49152:RntQqMSPbcBVB1INRx+TSqTdX1HkQo6SAARdhnv:12qPoBf1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512754, "uuid": "3ea88a43-5bf4-4302-9f3a-139080af3080", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512754, "uuid": "045feb91-7e88-438f-a58b-67617d9712da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512754, "uuid": "316128a4-b910-449e-b401-820717b447b2", "value": "dd63c867a97cac9a55e003dabce9c9ffb1714560cb4f9817b977d0b78d16ee47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b239071-e9ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767564758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564758, "uuid": "df1bb88a-7a54-4688-9f4a-663d0498fed5", "comment": "Malware payload (Stealc)", "value": "473c0f6cc4f759bc27b39d24f4eb3afd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564758, "uuid": "71c2ed80-a853-40ff-8187-cf73bdbf1dec", "comment": "Malware payload (Stealc)", "value": "de1e5a910f9c946c10a912236cd51f12e1d7cc3c280552853059560bc787c309", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564758, "uuid": "82dbb6aa-fbb3-41b9-8ab5-59fbc3af8673", "comment": "Malware payload (Stealc)", "value": "f3af69c7e134a09573f4717553be1f6d6ca229f1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564758, "uuid": "44e5018c-0de1-4fab-9c4c-99f34675b97e", "comment": "Malware payload (Stealc)", "value": "a51e763808b457dba82c96a3404a49a37d938e1e5ba7d7639f8c353517014b6927a2a2a955aa0a892c6483cb86994293", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564758, "uuid": "38b925cb-fad9-488c-89aa-030ef2f37481", "value": "T185F64BD3EE441369D79FD27AD461A2552230F142133211E7BBA91766888BEC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564758, "uuid": "8e313b3c-780b-4e53-b85e-d51e1f44b125", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564758, "uuid": "8f87b1db-01e3-4fbc-a405-63c3e3f6d445", "value": "49152:H3Jag2Fcrb/TzvO90dL3BmAFd4A64nsfJFv5t6mgXDD+oTTSua5XLDmyFbNDraeD:H3wTxCmihpaN33q/Z8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767564758, "uuid": "f85b522c-ec4d-40e4-af3c-bbcc6ef9d09d", "value": 16305792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767564758, "uuid": "bf70e691-1022-4c52-97c0-f69277643a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564758, "uuid": "5760198b-3e9f-45a6-a25c-42e4d54718f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6048be-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512768, "uuid": "cafaeffa-ccae-4a1e-9ce6-e911788d19b5", "comment": "Malware payload (WannaCry)", "value": "f552f5aa1c01ff7b83687c0aed52f23c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512768, "uuid": "0f68305c-b8c5-4b66-8773-c9332e36fb5a", "comment": "Malware payload (WannaCry)", "value": "df2686e6611afec0cff56a92fb1f1f741b0b9e502c942b38604491bffe0bc31f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512768, "uuid": "ef7cc52b-0626-427e-84a8-8f1e49de48ba", "comment": "Malware payload (WannaCry)", "value": "40119662427c18ffc02b144b01e51b386063493f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512768, "uuid": "b3d3ed4e-e9c2-4f4d-9027-c6e0e1786948", "comment": "Malware payload (WannaCry)", "value": "cb80db5f278580f49ff736d818909c1bd27b6e628a3f89a4871f94512192a23d0d0ad9046a214560fb9f2b535c4bd3d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512768, "uuid": "847d2bee-a7db-463a-bf52-afb9ad6aa4e7", "value": "T109363394622CB2FCF0440EB40463896BB7B73C6967BA5E1F9BC086670D53B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512768, "uuid": "ac42bec4-d40e-4ef8-acc0-1cc15c02463f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512768, "uuid": "548b1ddd-5707-4fa3-b8ae-4d831cb164de", "value": "98304:YDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:YDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512768, "uuid": "2b6861a3-2a3a-418b-96bf-bea1646f31bf", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512768, "uuid": "b103fac8-9341-4341-833a-add2073832bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512768, "uuid": "dd2b3ee1-70a0-4c75-897b-59391e508efe", "value": "df2686e6611afec0cff56a92fb1f1f741b0b9e502c942b38604491bffe0bc31f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75c64eb-e943-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767513830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513830, "uuid": "5323f5be-8dd9-4ca5-8a50-7cbc8304b190", "comment": "Malware payload (Gafgyt)", "value": "b71da3e475c7c7dea4bdca1bb6e1104d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513830, "uuid": "1ae61f00-dbfe-47bd-aa16-10afad98835a", "comment": "Malware payload (Gafgyt)", "value": "df951e92613d37ba947cda870cfe8353821765ce67befb297637215a9eda97ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513830, "uuid": "81163cdf-2916-4865-b501-4e7e032ea444", "comment": "Malware payload (Gafgyt)", "value": "48aa8b472a62b3a03e12b579b1177176957ced58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513830, "uuid": "95b8f86e-4841-48f7-b9ec-2b6f649b2414", "comment": "Malware payload (Gafgyt)", "value": "97789f79fdabfdc6d12512d26a5e6ab7f5206c57f09a8a8ab537510904147fa7e6fc70fa968d4ce8894e7f41c002859f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513830, "uuid": "bff99d69-ab0a-4e78-895c-ba8d452c5dc5", "value": "T1FFF34A22B4C094FDC8DAC2789BAFB236D972F6095138761F23C46E262E5DF216F5C650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513830, "uuid": "802bf6d6-da22-40a6-8dcf-f9be44ae0881", "value": "3072:mfB8DzICOBWH1C1C6EtLzcI/6qjJ79W0QklcOakq:mZ01MHlIyOfxakq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513830, "uuid": "5157eed9-669f-49b6-913b-4203d9924bfd", "value": 164592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513830, "uuid": "65744f94-e9a6-4cf1-b9e2-54336c8376e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513830, "uuid": "122a005c-ed8e-4a0b-8a61-460c8bf9724b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd881fb-e9a3-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767554722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554722, "uuid": "454061bc-3f94-4228-ad2a-350dd960b8fb", "comment": "Malware payload (ValleyRAT)", "value": "a3e4bf11f2bddb38fb43d0c6f1e794cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554722, "uuid": "d4d5de83-cdcb-4650-9621-326860f99107", "comment": "Malware payload (ValleyRAT)", "value": "e07bffd9a54ba58df4b79b851075c714ec3e275805c47b891af8d5648db82081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554722, "uuid": "f6dc4471-6a54-4a8c-ad5b-fdac8ca1685d", "comment": "Malware payload (ValleyRAT)", "value": "96ba336824213a381332a7f79d88e74bd549fde9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767554722, "uuid": "0a18f6f6-77fe-4184-818e-622801399421", "comment": "Malware payload (ValleyRAT)", "value": "044fe395699a1bcf74b123ab487ffe87873b8324b0828a3280f9c9a38b2205e3f56a74b18e7fe8fd0a4f8f5d1465cec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554722, "uuid": "4ad5807d-6f70-427d-94ea-b56626da48ab", "value": "T1B875021B776328FCCA1F813882DA5772A971F4280364AEAB17D4D7B23F64D540A1ED39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554722, "uuid": "89b2bcfd-5bc6-4f59-9672-db8814937ed1", "value": "161e826dfd316276e2fb5c263851bbbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554722, "uuid": "8c72b5d6-1e02-4540-a97a-28e8cdb7a3de", "value": "24576:WH+vtzc7KCmdZ49gLK5m52dwmeF4d6zo7apPppvp5gc5h+Zs3U:WH+B+IVp52+eKY2pIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767554722, "uuid": "cab947f1-0f3d-4c97-ae72-3fa1d27189f7", "value": 1567744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767554722, "uuid": "a5656e6f-1fa4-465f-bc29-afa9188c9adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767554722, "uuid": "65256e47-bbb6-4727-9fc3-1c53ffab419b", "value": "1818d962f04bdafba255f0a2bdbc5385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bea688-e96b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767530873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767530873, "uuid": "3ec86af9-666f-4916-8c9b-3163a1a79089", "comment": "Malware payload (Mirai)", "value": "ab5d67e9bd41f185f4133551c758268b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767530873, "uuid": "f927e14e-13f3-4457-bf86-bff3739d739b", "comment": "Malware payload (Mirai)", "value": "e0b86d0f6e494fc73e2b90de4ea62fe9d6811a70f9f7fd3e0aab6979d6158b48", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767530873, "uuid": "8acf0a16-bb0c-4b52-a141-bdf70054b71c", "comment": "Malware payload (Mirai)", "value": "79e412983b8b7dfccf6172ac337944ab5d3c7dfd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767530873, "uuid": "94d0e141-8f41-4af8-b254-c6ca89daa5df", "comment": "Malware payload (Mirai)", "value": "82ec79983766b9603446ef03e5fd39ad1b0b87a4eb1872405723ad972102d569495611cadcaccb7c83f7d583606e9bc3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767530873, "uuid": "961ebe30-89be-412d-94db-25a7de090920", "value": "T1972110CF1064B965548CCF8030A6548975E8CAE1B1704E1B598878F395C8A177379FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767530873, "uuid": "a06c5ac8-f582-44d9-9820-4b73a5aa1c25", "value": "24:cEE528VEcJ8LNIZEts8DEVKTD8CEHq8/EO/89METK8P3E3eM08bEKPl8eEz88gEz:62OJmsNQDyqS/wpKYEeBkPla8qumrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767530873, "uuid": "23c24265-184f-4681-bf41-1089e253ff6e", "value": 1246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767530873, "uuid": "b4447ada-8250-4b27-b33a-69e34a584e22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767530873, "uuid": "b4e12076-ee9c-4b9d-8165-f09c56ca80ba", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d76507-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512460, "uuid": "b97a8b99-3b89-4abc-adb7-02dca15574be", "comment": "Malware payload (WannaCry)", "value": "20f22ed774bb74a36bb7701cf74e2be0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512460, "uuid": "1e260830-ef7e-476e-ad63-d65517c6d5f5", "comment": "Malware payload (WannaCry)", "value": "e0c6860327b9d8ebb5ea8305b429c3ebce2f7fe989fa4072c31d384d60685278", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512460, "uuid": "aeb5c119-2821-4eca-9921-8ece77dfeb29", "comment": "Malware payload (WannaCry)", "value": "3342decf899a20f3fefd2b63bb1392d036df13f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512460, "uuid": "ee254ed2-9f14-4c0f-8cf3-571a5ff18aac", "comment": "Malware payload (WannaCry)", "value": "55b46e28e33c13539f541083a86c9f2bd9bc33c33365de38b286cb1f4a45cd389213e04af9f89c1298d9ef14930d501c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512460, "uuid": "138d8b83-7d13-4eea-8aef-d3aabdcc0d87", "value": "T157363399317C92FCD10529B54477C957B3B27CAA22FE5E0F9B408A761C03B5AFB90A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512460, "uuid": "bf0c7de2-41b7-45b2-b7e6-06f5f6d30fd5", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512460, "uuid": "6564d485-8442-42ba-9bed-f112b496c62d", "value": "49152:RnsQqMSPbcBVQej/1INRx+TSqTdXj6SAARdhnv:1/qPoBhz1aRxcSU16SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512460, "uuid": "e5f97722-55c0-4ecf-9ce0-05f6c2f887c7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512460, "uuid": "3af852e6-d977-4daf-be8a-df2ab2311c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512460, "uuid": "f498c3cb-c60a-49bb-bb87-92bb46aab039", "value": "e0c6860327b9d8ebb5ea8305b429c3ebce2f7fe989fa4072c31d384d60685278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69820f3e-e99f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767553132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553132, "uuid": "2b611d66-6b5c-4d1f-9102-0ca235efd0ec", "comment": "Malware payload", "value": "59f24b9c21800d3637825e1441b84b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553132, "uuid": "462d2c95-08f3-4620-8024-57d01cb374c6", "comment": "Malware payload", "value": "e1d9455dd7eb63920f8563168c4e01efcfc78e22284f5f09f3f7bfb17f41701a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553132, "uuid": "0321dfac-88ba-4681-84cb-c601f62149ad", "comment": "Malware payload", "value": "f5289b4360c8a52b92899960f17b2eb9eaec04c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767553132, "uuid": "a1f5051c-e29a-4fe2-91e6-683e58ec414a", "comment": "Malware payload", "value": "19f2c12c6b5b68dea645ed66bd1bd532fc2e272d4b3f26eea62f429f8bae76fa8eef4e36a180c781a61af4f5518f54cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553132, "uuid": "300f6bc2-669c-4fed-9f32-39fc5e828629", "value": "T142086B4262EA04C4F9F7DA759AE66617C673BC122F30D5CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553132, "uuid": "2baab851-eb3e-49c1-82f6-cec370843670", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553132, "uuid": "ba6ba877-7e20-4be1-af34-ce8569ef15df", "value": "393216:TkmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNv:T5NmdsJY62A0y8Xy5rs3wbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767553132, "uuid": "c1dd6f9d-e3a8-402b-bf78-843c59cdd209", "value": 81977423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767553132, "uuid": "c466001b-dd47-4de4-ae89-2e5023b85521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767553132, "uuid": "adecb813-2381-47e7-b848-fc5f8ef50b9a", "value": "Extreme Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7828e1f0-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511066, "uuid": "5434b97f-7a06-4e59-91c8-db944d2145ab", "comment": "Malware payload (WannaCry)", "value": "a48ca7b40ab2a6ebdd94dbd52164c6cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511066, "uuid": "819051b0-a351-4331-8367-827c757a5e7e", "comment": "Malware payload (WannaCry)", "value": "e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511066, "uuid": "0f80747b-e7d4-48c7-b101-75a858c0771e", "comment": "Malware payload (WannaCry)", "value": "9203753bc934a2ae18c94b1127905f277316b481", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511066, "uuid": "5152c973-dda7-4229-9f4b-8c144ad8bda9", "comment": "Malware payload (WannaCry)", "value": "da60bfdd04acf8f42be0b3294e997f38350d07969c3da0f492ce1b1bd7a3ac5e8606cc3b02bece8d9c38f1f952810ee4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511066, "uuid": "f974a575-1245-47ad-94bb-109c54da97dd", "value": "T1FF3623A670BC90F8D206297494AB8E12F2B67C7921FA290FEF408D762D53F56F750742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511066, "uuid": "abdabb69-603c-4764-8b8c-8ecdb52e9ddb", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511066, "uuid": "f04d01c2-04ae-42c1-8ddc-c90eac9ea1c5", "value": "49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1GPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511066, "uuid": "8103954d-7d8d-4ab7-9aa5-50f1dfb65a5d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511066, "uuid": "02cea4f7-3a77-43d9-a22e-fba76219d161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511066, "uuid": "a5b42907-f138-41d9-9c01-6fdb5987592c", "value": "e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1877e5f-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513310, "uuid": "8bd82b3f-350f-4f8d-8a75-eb6a40d523b6", "comment": "Malware payload (WannaCry)", "value": "34c07578d4634e0af6f7d87b3413a679", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513310, "uuid": "52f9f5a7-4f9c-4743-9e19-16c34500df97", "comment": "Malware payload (WannaCry)", "value": "e20a765c36cd6dcbff978d1f57d3ee25622cf1fd450dfff2105f7936895cf401", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513310, "uuid": "76a5e6b2-e60d-4e8d-92ef-60dec2cb09b7", "comment": "Malware payload (WannaCry)", "value": "b986580f90ef4bf71f4e3cb7ea68ac6d875fd5ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513310, "uuid": "50dd5f44-ab69-404d-9c76-dd65a86a7392", "comment": "Malware payload (WannaCry)", "value": "3fbc2000a253c4cfcbd7a9931b20c1d87814574c65b6b4462f573a08e96a986c2c9438d1e0debea90f8577ffd7858681", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513310, "uuid": "7c135882-c04d-4d53-b019-494a115a4115", "value": "T18F362354B3B8927CF1671A348877866665767C66AABED70F4B10491E0C33B09AFE0F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513310, "uuid": "3a0fba5d-c095-4ca9-880f-18e13420b19e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513310, "uuid": "be4b5975-ce27-4dfd-a59c-f22e423a0070", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9Y:d8qPoBhz1aRxcSUDk36SAEdhvxWa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513310, "uuid": "4c449bd6-f1c5-434f-9f57-c305c34805c6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513310, "uuid": "681c1768-5769-40d9-ad89-71ac885496fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513310, "uuid": "5d27c28c-2d01-4c59-b4d8-95ef75de7d3f", "value": "e20a765c36cd6dcbff978d1f57d3ee25622cf1fd450dfff2105f7936895cf401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b83c50-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513095, "uuid": "5dce61f6-99ab-49f4-a4b4-08d127988002", "comment": "Malware payload (WannaCry)", "value": "76b47e0829177757b39cf3c3672049dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513095, "uuid": "61868b97-edf8-4e39-bd8b-f5b3d1c65d34", "comment": "Malware payload (WannaCry)", "value": "e228fc7b9ac453a1df8cbffcb11556e54671ccd3d2b5f0726b03974259d65972", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513095, "uuid": "28b2ae45-5574-44da-bf5e-7b27de06ad03", "comment": "Malware payload (WannaCry)", "value": "dbab88d0ccdff8a78012894b26e5845a2e3597fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513095, "uuid": "2babb907-ff01-4eb9-af6f-2353b7dad1d5", "comment": "Malware payload (WannaCry)", "value": "3989175585b409f30eda87d16ec6cc10e73d463c8f6bf3ea51ba493e8df2edd6b775799bfcb48fa8c10668f64153f724", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513095, "uuid": "4819d35b-9f4e-4a44-9c44-46e5733ab149", "value": "T13936239A75BC91FCC205267484B78B26B1B77C6E25FE5A0F9B4089360D03F95FB90B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513095, "uuid": "4d675972-77bc-4912-b9a9-545ab3d437a7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513095, "uuid": "e6285d18-d497-4b98-b218-e4b69875f5b0", "value": "24576:RbLgurihdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLJX6SAScROAdmv:RnnMSPbcBVQej/1INN6SA7ROnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513095, "uuid": "f44346d6-c43f-4708-a39b-23c79151b6fa", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513095, "uuid": "379aa4ba-56a0-430e-aaeb-2767bf93a507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513095, "uuid": "8a3d66d4-3cd6-4b9a-bf38-edb54abaa2b4", "value": "e228fc7b9ac453a1df8cbffcb11556e54671ccd3d2b5f0726b03974259d65972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b562ad-e971-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767533263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533263, "uuid": "6c7f7985-5deb-49b6-bf9e-b7d4fcb34c06", "comment": "Malware payload (Mirai)", "value": "ee01212ea80a062d6b2bf84d8d2efc56", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533263, "uuid": "3d53e6ea-ff09-4fcb-8c53-7d9f11ef8db6", "comment": "Malware payload (Mirai)", "value": "e22be4021fb23c8aec9bf72285598644b40ddebdac653ec88d7de160656a50e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533263, "uuid": "9dc07658-c38b-4475-8e32-23d439d48b62", "comment": "Malware payload (Mirai)", "value": "2ef9af224859834b7afd77e70234d10c9fbdecf3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767533263, "uuid": "7eb4d734-e9b0-498c-8e9a-3d50b45ae5e9", "comment": "Malware payload (Mirai)", "value": "a8e3106ea2e4a50f627e92ec6f73eaa174e5438ef66eddd1a98b4b628632dc3d62aa911078701bd52ff14c8c933b9d48", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533263, "uuid": "f54603ec-a957-4fc5-aae9-186778aad841", "value": "T1192108CF10A8F9A6654CCF4470AA908979F4C6E5F5704913A964B8F394C820327B8FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533263, "uuid": "813119ed-f986-40ab-ba83-faf3fff51d19", "value": "24:3J3nEE5OVEczLNIZEtcDEVKTNCEHq/EOB9METKP3E3eMEbEKP3eEzMgE19IdEkrx:dontQNQ/p2EedPX6Arx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767533263, "uuid": "3bb75ad6-f8c6-4e23-8565-9c602ae690c3", "value": 1150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767533263, "uuid": "70654485-6c51-41c1-81ac-d2a32fe52e5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767533263, "uuid": "fe695eda-ec7d-4411-a942-7e261cf1625c", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe97c90-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512421, "uuid": "995d89cf-164a-42ca-83dd-734e70b83900", "comment": "Malware payload (WannaCry)", "value": "0b1cc2825eaab71c33d887c783ede23f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512421, "uuid": "19176d4b-7b41-4654-94f5-66d30637673d", "comment": "Malware payload (WannaCry)", "value": "e23194950fdf793e53e33895605ab29e5e8aa6fd299ce9508490798ba3925278", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512421, "uuid": "fd93f398-d1a4-4bc4-9c40-5efb27c905bf", "comment": "Malware payload (WannaCry)", "value": "74839bf137fb938d81b5692cce42b2ba4aed045d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512421, "uuid": "2394e8e9-3f61-449c-afca-20d0e83f566c", "comment": "Malware payload (WannaCry)", "value": "2f96622a25e34141384a903973c7992b90a7fe54ab3dd0e362b87e48e21d3e980ed873a0353166ba53c4a97e68bedf52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512421, "uuid": "a26a7778-e9e9-416f-8dee-e64bd1fcd2dd", "value": "T1D736239A61AD91FCC106287480A74523F7B23CBE22FE6E0FDB904DA91D53755B760F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512421, "uuid": "85b5528d-962c-482f-9e1c-975ec93c52f0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512421, "uuid": "393ff46c-b1b8-4190-ab16-093c343973f6", "value": "24576:RbLgurihdmMSirYbcMNgef0EdNLKz6626M+vbOSSqTPVXmiHkQg6eX6SASk:RnnMSPbcBVgNRx+TSqTdX1HkQo6SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512421, "uuid": "a7d5e4de-04cd-43ef-8abd-7ba02bedad73", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512421, "uuid": "61ae7671-f174-45cb-a5e2-fe14ad03892f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512421, "uuid": "96780a58-ee25-4220-b914-6fe1fc34aa86", "value": "e23194950fdf793e53e33895605ab29e5e8aa6fd299ce9508490798ba3925278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8a223d-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512308, "uuid": "32af5032-2fcd-40f0-ba5f-8f5e0b688b06", "comment": "Malware payload (WannaCry)", "value": "9f61d37c99f647a1b0b3d0a431e4db24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512308, "uuid": "daa8e601-2753-4005-8397-116cd207de00", "comment": "Malware payload (WannaCry)", "value": "e24d098838da0f6171b4a609c765679fcace92735d28311a65d0dfb93763d32f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512308, "uuid": "6b1fcc4d-4d4f-4af4-aaf8-81702aae2fe2", "comment": "Malware payload (WannaCry)", "value": "eafc59cd26432e2b33682cc39b14660a8a958a9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512308, "uuid": "6d42a8ea-cb7a-465b-8dfe-96200328018b", "comment": "Malware payload (WannaCry)", "value": "8f67db100e63e6b5b931eecb17bce5a5db1461e6bcb67c21148676fe474153c6f57e6ec9df95427af43f06e88dbef99c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512308, "uuid": "def03234-094a-4ecb-8903-6660841ce5fb", "value": "T1543612137BA59679C06B02B048AAC762B7B1FDB113B9C707A750694D1C73BD06F923CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512308, "uuid": "fbb6d098-1833-4ec5-ac19-8f182470087f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512308, "uuid": "1247540f-12b6-4a21-8603-5888dde31e93", "value": "49152:QnsEMSPbcBVQeCB7cq0NRx+TSqTdX1HkQo6SAARdhnv:QfPoBhCB7CRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512308, "uuid": "85877fbe-8677-487c-95ad-6b201dc0ba54", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512308, "uuid": "24540fc9-0c56-45ae-862f-5509a879c586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512308, "uuid": "ac786ee2-e2bb-4e99-8e59-06d8ce1f3323", "value": "e24d098838da0f6171b4a609c765679fcace92735d28311a65d0dfb93763d32f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea195d3-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511694, "uuid": "63ff96d3-90b1-4dc4-8dcc-591db0345013", "comment": "Malware payload (WannaCry)", "value": "a4d49eaf60a8e333708469606ad9e1a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511694, "uuid": "4c723fe6-a25f-435d-94b3-0327d3d1d6e5", "comment": "Malware payload (WannaCry)", "value": "e2b54741be34be2c0d2bdebb78f32d3f79a885397b3a46f87f62e896f1a42371", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511694, "uuid": "ccfac67d-9188-497e-af48-0fa38a80ebe9", "comment": "Malware payload (WannaCry)", "value": "0debce6791059e239af3bc6ab42c1605c4a03937", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511694, "uuid": "e5277d56-bce5-4fb6-bb5d-058ffdc58964", "comment": "Malware payload (WannaCry)", "value": "0904558fdf66418500118d12fa2f05c38c876906605b7bb636ab094fb62f1aa5aef4554d76c35a08a23ff36df72cc223", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511694, "uuid": "470dbb0b-4f2c-4286-a85e-84d1a68b99ce", "value": "T12C365B037285C065C4280639CC6BCAFC65A3BD95FE2D910B3ED67F0F7973A85AA51B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511694, "uuid": "22771fee-8474-4ae2-9221-c04b42ee77e5", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511694, "uuid": "6b666c44-bd30-45a4-ac22-3cf8a97831cd", "value": "24576:SbLgddQhfdmMSirYbcMNgef0PSrHV7YoZnA/70CUiaE:SnAQqMSPbcBVarHV7YoG/QCnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511694, "uuid": "17f80280-ca74-42b3-8375-dc1d2efd2f3d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511694, "uuid": "9ddcf9f1-cd5c-4fa9-a8c5-d49af19ba886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511694, "uuid": "00d57652-b777-43e6-9abc-088f383405d2", "value": "e2b54741be34be2c0d2bdebb78f32d3f79a885397b3a46f87f62e896f1a42371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6933216b-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509753, "uuid": "6cc01bcb-4790-42c5-b202-a93c6d1a4148", "comment": "Malware payload (CoinMiner)", "value": "806a7729070fe833fa8a95efe442905e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509753, "uuid": "20b79d71-68b6-49e5-bdc4-1c4d8696de8a", "comment": "Malware payload (CoinMiner)", "value": "e2f226c1ca74d29c1f2fefc5e1f67e74bc03590c25028743dc0ad51bbad65c62", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509753, "uuid": "f16be25a-75b3-4f6c-a949-86ed209496c4", "comment": "Malware payload (CoinMiner)", "value": "eae5f6058d14178cee47f7040b15aed366e14c34", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509753, "uuid": "0a523536-2cf6-40de-8669-242733aeafc7", "comment": "Malware payload (CoinMiner)", "value": "5ef487ed1b246e1780bf0723ee17a7e0d863b5884a376fb1f97413d2cf29aa506f0782ff4db4e75770493176aaca039d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509753, "uuid": "462195f5-9c42-4b8f-9863-1289aca7dc31", "value": "T118A5335102C3FB3F909EDAC4A8F8BA350E6555F06B291A52785E0C5BBC32FF501B791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509753, "uuid": "1e9cf82c-0ef9-435a-9101-1d8191218a3e", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuI:G3LG658+S8YrCpHy2dUuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509753, "uuid": "13ac73ae-1c60-4b8e-b182-bb4810feb289", "value": 2207744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509753, "uuid": "b9b2810b-ecfe-48a3-affe-900484d64e9a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509753, "uuid": "14151fd9-df1c-470f-8b11-1340c8fe3555", "value": "e2f226c1ca74d29c1f2fefc5e1f67e74bc03590c25028743dc0ad51bbad65c62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb86211-e999-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767550722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550722, "uuid": "f3d52a39-b306-49a7-bb14-73932b62f105", "comment": "Malware payload", "value": "e3edec5522ca16a0fd633c143146a061", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550722, "uuid": "69d0af10-53f8-4ce0-8b3e-dc646af87e33", "comment": "Malware payload", "value": "e3648ed09ab275376cd8a111f3a8c32e254ee9739263d4f2ae3344037bdcca10", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550722, "uuid": "5748428e-7980-4308-8c3d-8de0f448cc55", "comment": "Malware payload", "value": "e75cbbeaf0d53a32a43ee0b9825b4a3fe1ed8a3d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767550722, "uuid": "c790f749-790c-4d4b-b9d8-0cccb1818dc2", "comment": "Malware payload", "value": "9a893fd68bcc1114a86fd285e8ec03348b28f3f92efa251f6030326e8f6148bf9a493d1308fc56b08a29616720a52d11", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550722, "uuid": "bd186d2c-835a-4550-9b3f-0cee434aea64", "value": "T1EE3395A167F9152AF6F78F783C7065968C7ABE726D61E08D4280204E08B5F95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550722, "uuid": "6dcca2f9-18f3-4d8d-b3cb-b07643c2efa5", "value": "648be50ba47e23462fad218c8d2609da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550722, "uuid": "7c288347-3b14-46a0-b05d-d3d962489417", "value": "768:+xVO8u/0vaXDiTLlGCI0App33R/U7+dEErfcqsq:kOaEiTLXA3H+idEAcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767550722, "uuid": "1cbdff8c-4234-4c3f-b801-43cd4bb3d5c2", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767550722, "uuid": "c8f6ab15-41d8-4be7-b86b-8b70673e76bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767550722, "uuid": "3665f328-4ee8-4cfe-b838-bc53a4c532de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c084aa-e9c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767568878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568878, "uuid": "1cdea672-9403-49cf-b002-50fa601e5316", "comment": "Malware payload (Mirai)", "value": "6c73e759d60601694517de963aef0d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568878, "uuid": "ed5282f8-fd57-4e00-92c7-dc1b7e0ed106", "comment": "Malware payload (Mirai)", "value": "e431329d953ef1a4e098cb13b3fa98565995b84dc106712c2e57e7a4a3fb9d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568878, "uuid": "0709d0ea-444e-40ed-b00a-d80f38e08c3d", "comment": "Malware payload (Mirai)", "value": "5ba07040d971391f7ba5bd640f1f07f6a337850b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767568878, "uuid": "2cc94fdf-01dd-493d-a8a8-4ad2b1289793", "comment": "Malware payload (Mirai)", "value": "a149ee7bf063fb5c256732022c20dc8e542e1e6443cfa64146c6166ed05243d372cfb583e8944479bd6220733da0ffa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568878, "uuid": "1fcef7b9-ac56-4d45-b7be-7f86c2f98eea", "value": "T1E1043926EEA0C0AAC492D1B867EBC1B2F730F8F40321365F73996E312E65F505B59746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568878, "uuid": "d38d5940-5d18-40ca-87ba-70d88ed335da", "value": "3072:NJn8Htol7xY2+/MYzx/TT0IdcTRDhNKdSQagvDgbCuCntu++awvlttFbJ:Nx8H+xY5MUvdcTdzWBDgbPsTwxFbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767568878, "uuid": "e55a78be-40da-4afe-b2c9-de8db04e6e3f", "value": 187936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767568878, "uuid": "d3a16e79-02af-46fa-a04d-094782d46853", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767568878, "uuid": "ad28a4b5-fe97-4ab5-a19c-92e3bfab97ea", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e69b6b5-e96e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767532095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532095, "uuid": "0f617bb5-0258-4c27-891f-b1216b523b5f", "comment": "Malware payload", "value": "d9583bb93c726ede827101088c82deb0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532095, "uuid": "8af4fe1c-5fa9-4227-9cc4-d99831176fc9", "comment": "Malware payload", "value": "e438ec2c5f8857f47b4abfe07a6af67ea14b9b59523a8c15cf9682312c45037c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532095, "uuid": "74a6e381-c081-4128-b31e-b23cf55f7741", "comment": "Malware payload", "value": "d97511fcb447ebdb2174467c1344ad5c3f43173e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532095, "uuid": "7bf34b49-7970-4e34-869a-947dbbb66b51", "comment": "Malware payload", "value": "1d3741f745b5db0e539d5e9b6cb1c6757ae60a269787c9564210a59b3b1278180e34b29a06d5d7c4d9a702069c274044", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532095, "uuid": "8bdbd751-aed3-4f91-b2d9-7e9bc0c34738", "value": "T1F8062219F2A464FBED57893D8A529201F96338628774DFEF135086365F136E0AE3E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532095, "uuid": "d3d0aba0-79df-424b-82a0-50d2eebd5815", "value": "3b4447580904d2f483c38cc264186fba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532095, "uuid": "c8603cef-0a8e-4de6-86b3-3603f3b189a7", "value": "49152:4z21QpruIFwh+YEpq6OWTXGGbNqQtXBp2j5K:WxuEwh1EpqnWTnq6XB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767532095, "uuid": "1114b811-b2a9-46cb-8451-5bc596571db5", "value": 3795456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767532095, "uuid": "14c3c4d7-62aa-4f46-a0fa-c855641d53bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532095, "uuid": "fd4ab7ab-8d5e-4b6b-9f55-4065917f0d88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e84e20-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509960, "uuid": "29ae8cf2-5c97-4a37-88dd-c30dd2b46013", "comment": "Malware payload (CoinMiner)", "value": "eda3f428640a07b45157f8e232bbfdd2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509960, "uuid": "c34ae3ab-4dfb-49bd-b441-2ba9412126af", "comment": "Malware payload (CoinMiner)", "value": "e447efdfe6d6c51e7a46970987f83910f5be1945d2bf3d45f9aaffe095122ea4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509960, "uuid": "b721c3f0-8b90-45b8-85ec-57e78141f7e3", "comment": "Malware payload (CoinMiner)", "value": "b81ac14c7e0405d5d77244c5f5b270369baaca2f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509960, "uuid": "af8e045e-0bca-4049-be38-4895db608ccc", "comment": "Malware payload (CoinMiner)", "value": "5b6997e9899f3607a33b3a7018df83abcc4af2137bf0b08702256356ae649e869f12a0f41c7cafef027d96d5edc6df21", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509960, "uuid": "79f46d1a-d7cd-472f-b1d0-632b0928b1e0", "value": "T1F26533E101C3B7BE5AD89BC015E837310D6555E05A396A5AF80F0C6BFCA1FE80A97D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509960, "uuid": "b8d65a80-8add-4149-8d4e-ba4d6d90b262", "value": "24576:G3LWjlhQ4nr0vJbDFF4xjPQ86X8ut9QF+8DfiHJqZp8C18zp0iZy0TTvUTb:G3LolhQAr0hNW188rJTQ+p8CU0r0/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509960, "uuid": "8cc0e5ca-5a5d-432e-8e6c-5e0102eca98d", "value": 1536000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509960, "uuid": "2d49e8da-1a3e-46d6-8ef7-84dd9abb0fd3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509960, "uuid": "4f243cfc-9c9a-4017-a523-921cc6f74c6e", "value": "e447efdfe6d6c51e7a46970987f83910f5be1945d2bf3d45f9aaffe095122ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8363f84e-e9b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767563054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563054, "uuid": "c1a52b9c-53b1-4e9a-bfdf-0d5c8c134eb4", "comment": "Malware payload (Mirai)", "value": "bdb3593c12d8185d6cd4fa0a8da10a0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563054, "uuid": "b8de66a1-c63d-4959-aa81-2db5b83e2fa5", "comment": "Malware payload (Mirai)", "value": "e548574ba177290ab33d902331ad9145e5a2c3c0d4e88335fd91ab42ec57551f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563054, "uuid": "65ec66fb-0b4c-4acb-a96d-0f3de215a47b", "comment": "Malware payload (Mirai)", "value": "22f0b6e30fe3bc0b549a73d1a371edf3cbbe775f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767563054, "uuid": "7bf6b81d-138d-4bb4-adc7-5b3ddb894a05", "comment": "Malware payload (Mirai)", "value": "a5e2ce05fa1f2595a9b4a1e453c4a76f633d46ef7b3c122a0ce8f680c8efa1bd78182f3811c9a7cc8b2f9701f6724695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563054, "uuid": "7b284f0d-549f-4e81-87ea-23adad5caf4a", "value": "T13CD47D5CFE4E3C42E2CBE2789E4983E1732771E4D32391A37582524CD5CA9E9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563054, "uuid": "cb983d1b-90b2-447f-94b6-7898ffbbcfaf", "value": "12288:VRd4rhKg9fT1MM4wp/ZJUfCEDrgBTBAdUGEfBIgnGn5Kw5kXF0uG:VRiJ9fT90fCEDcBTcIBfg5Siu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767563054, "uuid": "cad6937c-b7f4-4a88-b15f-b415eb36ce92", "value": 639248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767563054, "uuid": "2c6fb4f8-2c4f-4c34-9eea-7ba0cc658cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767563054, "uuid": "a1c2c136-c050-4a93-a3e8-fff6778d8ea8", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5d387c-e932-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767506406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506406, "uuid": "b8333f10-1158-4ced-a944-9fd271827994", "comment": "Malware payload (WannaCry)", "value": "e483da8dc2e72df362eb07faaf3af3b8", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506406, "uuid": "6bc38b42-5269-46f2-a7b7-4a2139dccec5", "comment": "Malware payload (WannaCry)", "value": "e5d2af532f6971a1d4dd80fd01dfdd5490bda7b865a24b1d491ee0d13aae2936", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506406, "uuid": "14726a2e-fe38-44fb-b540-2ca3b9c66130", "comment": "Malware payload (WannaCry)", "value": "c8e3e7bf243523c90ffaa29c0227ea22a2814a45", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506406, "uuid": "cda57243-53fb-469d-b613-9102ec15325b", "comment": "Malware payload (WannaCry)", "value": "c8a69bffdf367629372608669d4e2994d68c4b77aa2c854fab04daeda725a7c9bd2fcf6f9ff793196814aca90df4ef9d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506406, "uuid": "7d863590-417c-46cd-8df7-6cba69e9b04c", "value": "T10836D122F18398E5D05322B012297576EBBDEE350B2FF8DBA680DC256674BC0D735A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506406, "uuid": "4d0b478e-da69-40f8-ab60-bdf8a09e10b0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506406, "uuid": "bc0994d3-9181-47a0-bdc2-2df93f27950b", "value": "98304:EaePoBhzcdpR2j50Aj4Ouenmur2uuh0WD527BWG:EaePeUpR2j50AjKem/uuh0WVQBWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767506406, "uuid": "09530a8f-d7e5-4531-944b-dec6b39a131b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767506406, "uuid": "a1f9352b-545a-4112-a4c5-ce43140bc7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506406, "uuid": "d8ba91e7-884d-4ccf-93f3-45702b71eca3", "value": "e5d2af532f6971a1d4dd80fd01dfdd5490bda7b865a24b1d491ee0d13aae2936.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140ce614-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567162, "uuid": "8b10ec59-4aa4-4bf6-ad92-3c0e8c9626ae", "comment": "Malware payload (Mirai)", "value": "fcb72e8a2f83115a24af04115bf92b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567162, "uuid": "a6cce05a-ae3e-464f-82d6-2a3c49ee4eae", "comment": "Malware payload (Mirai)", "value": "e6d4b6f93d7ae50c79847c6b0d8b3e533bfdf5ed58a86dbbde66c58442f9f35c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567162, "uuid": "cb691b52-6798-4bf7-8d6d-afc53e2680f1", "comment": "Malware payload (Mirai)", "value": "ff3a5f6c62864ce48b650c673e2e41557baad8d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567162, "uuid": "40cb012e-56ec-4cbb-b40a-a2c46f777dba", "comment": "Malware payload (Mirai)", "value": "ce2d0f4c84651a2cbf8ef95f71ea221fa8de17ef1caea1413fc762fbb23d82747e32ba27e72ffa8fc1a96a271b547706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567162, "uuid": "923d6162-f332-4c34-8d90-7ced03625a0f", "value": "T1A8335B0272280A07E4675EB0353F17E093BFE99021F4F688690FDB5A8676E735586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567162, "uuid": "a80379b1-cfde-4f40-85be-555d51ea43cc", "value": "768:YpazA2xCRBPT5WxFzQrJbGMV4PPcit5Op76+cuKQD:PzPwBWXSJbbmPP1Up76+fKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567162, "uuid": "60d64b42-3842-475d-8ffe-c95e07e7cef6", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567162, "uuid": "31786025-a014-46ff-8723-be4b245a91df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567162, "uuid": "cb8841c7-f185-413d-ad8b-ee3f7a510721", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a56270-e941-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767512827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512827, "uuid": "075882ec-d56c-435a-a764-f57871d5c643", "comment": "Malware payload", "value": "5e93e2ed826844d3c76968b616f91b02", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512827, "uuid": "29faa789-6bcd-4a75-883c-3e19d2b22e66", "comment": "Malware payload", "value": "e7e905fd5d8e379835dc4fc33ef5943796f3e4db38364424a52a96abba6c30d6", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512827, "uuid": "a611127c-f821-4802-8c5e-19aa99be2752", "comment": "Malware payload", "value": "72c2745bc54026a4bbf297943bf608644d65976f", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512827, "uuid": "9bf0e128-5572-4d14-adaf-2383d4a0bbb0", "comment": "Malware payload", "value": "e7b18c2e695b27fc0e12106328522c22e2737820480c3e534c4a88b1e6a3e75c26e8ff2cca631b0ada5e4f56cdb6f40c", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "bestcruisetravelinsurance-com", "colour": "#6AE26B", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "minatoursmoqls-com", "colour": "#634140", "exportable": true, "hide_tag": false }, { "name": "willyprosty-com", "colour": "#27E248", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512827, "uuid": "c9e5f85b-5fac-4804-a873-699116a1c4be", "value": "T116E533BFA8A136BD5012ED1588C07DB0A3E16915ADEE173EFE0165BB10FF65089C663C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512827, "uuid": "284f7c2a-ba81-49d4-af09-dfceb9d10136", "value": "98304:gj22WO+iHcymYH83IChQGk/4VcQM0yT1eJG:gJ+Yb8r9V7yBeJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512827, "uuid": "df16dbe5-7676-43be-9357-a95ea46c7f35", "value": 3209957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512827, "uuid": "b9f2c8c0-85e9-4944-97ad-f081f9b15968", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512827, "uuid": "455e2f1e-5733-484d-863c-825e933d6268", "value": "ppruystgksmc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810318f8-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567345, "uuid": "e9a9b2f0-d0ba-401d-b637-66795419201a", "comment": "Malware payload (Mirai)", "value": "05668d38a6ff699a9d3e1808e03a997a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567345, "uuid": "969bba55-2b6a-4b94-939a-ccf140ebd815", "comment": "Malware payload (Mirai)", "value": "e81415db45f2d07987be9270e30c8781eb87143c78e3a22d1561991e2f927c0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567345, "uuid": "f143240d-004c-4720-ad39-1482cdfa8b3f", "comment": "Malware payload (Mirai)", "value": "9da6a879cf02e0d784f98a7640a7822e5b3128ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567345, "uuid": "41428a32-8642-4c26-a451-8da4e225f45f", "comment": "Malware payload (Mirai)", "value": "3b2d94a9be0b9acacac729e732075c05dba55e1a10c0d3c479cb20df25d80974386a447fcf6f241cc395eb275316184f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567345, "uuid": "7d8fff7c-1474-4fe1-a8a1-420346cba89d", "value": "T18B332AC0F94BC8F5C807893090A7F33FCB71D8394175E6AEEF59AE65DA27642421628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567345, "uuid": "378bb684-49cb-40a2-9c79-6f7eebd8a3ae", "value": "768:Ejf9mvyavZmpI6tZiFGustpGuiN/q230tZdgJhIz2fBVEv6pkMSmrc:2llNI6DiMuOpGuWihuUz25VXpkNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567345, "uuid": "f690bf76-0c96-4e42-bf92-074d3092eb39", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567345, "uuid": "eb43332e-9ef9-4c11-b883-a3e70e32cdf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567345, "uuid": "b3af2745-4b1d-4dff-a6b6-d0933778bad5", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2dfba5-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567228, "uuid": "1fe8a691-50b8-423d-8880-e89f4c8f0752", "comment": "Malware payload (Mirai)", "value": "f2fed48d6da7ab60170f306b9dd60304", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567228, "uuid": "c75a4893-6a24-4ad3-9760-0a34947ae20c", "comment": "Malware payload (Mirai)", "value": "e8d2da88697d8f7a62636a1e343f5db0d56667c8aac5ad2a3834ede39c66dc2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567228, "uuid": "0acf230b-6c30-4c9b-b350-b6df9e05ce72", "comment": "Malware payload (Mirai)", "value": "c8880b0a1863845943c11a0384bd299bd70ebef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567228, "uuid": "d8d8a980-f171-44bd-81c0-1d362f2da905", "comment": "Malware payload (Mirai)", "value": "7d8a690e738e0c7d9fff31f9d7c15426dc081610ff934a3bb1be233b1c43918a5118d27b68abba62e7a34be8e91b84e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567228, "uuid": "d29de674-cfde-4019-b030-8b40ebfc21d2", "value": "T15AC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567228, "uuid": "bcc5a8c6-2fc7-4301-bd79-96669857ef74", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHovrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIvrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567228, "uuid": "ecf0cb08-4973-4130-a765-6bba8556aaa3", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567228, "uuid": "8d55d81c-bae0-4e11-b198-5c3a9f913301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567228, "uuid": "d7858775-d27d-4b81-aef5-00d02fbce4b9", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9542a2-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511449, "uuid": "30663125-cb18-46cf-8353-b5b58fb88349", "comment": "Malware payload (WannaCry)", "value": "caf082a135af8d966e8dc7fb9f619bba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511449, "uuid": "d77f31e2-aa1d-4c45-b1df-6932fd27ea03", "comment": "Malware payload (WannaCry)", "value": "e8e5833bfd2e454fc0bd9b4808612ddbf120b4f2d10c0fbe881df70707181198", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511449, "uuid": "f2402ed7-ce86-43fd-99b2-73b43a40c17d", "comment": "Malware payload (WannaCry)", "value": "87255ecd6a8d98ae80f3e44d36e252ff11b2b48c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511449, "uuid": "25b737fa-05bc-4ad0-86ee-5d0548610fe2", "comment": "Malware payload (WannaCry)", "value": "8d1c96102f98c04083e596eeaddcb79ef77e34f56d86947b73c4adbfae818f0e1adf4d72cc5a5654629d1e6fa136ba90", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511449, "uuid": "aea34687-0573-47be-ad2e-4dfab169156d", "value": "T1E1362365B63CD5FCC10A10B864674522B7B33C9A22FE560FCF908A571D13B64FAA4B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511449, "uuid": "7d44730c-7334-4fdb-87f5-711b680e1842", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511449, "uuid": "37b1d416-c9ee-455b-ad8b-d33e0cbc5d25", "value": "24576:MbLguVQhfdmMSirYbcMNgef0QeQjGVVXmiHkQg6eX6SASk+RdhA:MnFQqMSPbcBVQejnX1HkQo6SAARdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511449, "uuid": "43682aa1-71b4-4ddb-855c-40958606fd01", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511449, "uuid": "aaa24cc5-d689-4c8c-8fda-2d9d3cf5216c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511449, "uuid": "327cd48a-4abb-45ef-a223-0666e23490f7", "value": "e8e5833bfd2e454fc0bd9b4808612ddbf120b4f2d10c0fbe881df70707181198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1417f4f6-e905-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767486846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486846, "uuid": "e24149f8-dff5-42d9-9f43-47576f126f6e", "comment": "Malware payload", "value": "a53dfe3d37dc6958ec71c1e67a1919b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486846, "uuid": "70b5294e-00f5-40cc-820f-9dfa98b95971", "comment": "Malware payload", "value": "e9bb7bf9e3fe5de02a392d09369e339e70613d795c4af72959eb00afcc3875ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486846, "uuid": "4106bce2-cb60-41c3-9dd1-f9bd4968f162", "comment": "Malware payload", "value": "2025a77ee3a6f542adedc960494c247e7005e3e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767486846, "uuid": "9d8cf78c-5008-444e-b52d-d3edbc25267d", "comment": "Malware payload", "value": "f934a8e079bccd42d52a167c73d9c0af4f3da04721e64930f832323551c0d26c6085d0a06cfcefd7a0e02f1499c12c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486846, "uuid": "63454868-ea88-4efe-a11c-2fc271371d04", "value": "T1F393631E6E639F6DF768873447B74E749B6D23D62AD1D684D2ECC1002E2024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486846, "uuid": "8930f738-acf5-4b3f-b7cb-7cb2e5f25dc3", "value": "1536:nONHdJK8USMwsc7ZydVk2VxDAUHxJs+zpvJ+3UKo/pVsQjztQFF:nON9c8UCsc7cHbNL+uxVfz2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767486846, "uuid": "aa95d2e8-d9f9-4e73-931b-9679f737e1cc", "value": 90903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767486846, "uuid": "572f5f8c-d8c5-45aa-b609-e0b260e87d7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767486846, "uuid": "341f0ca3-4029-4a38-a0e4-3f943e32334b", "value": "9e3363f017c60726bf610a2a472040144T.", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b20c72-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516744, "uuid": "0c639581-9704-46de-8c87-f4ef9200afff", "comment": "Malware payload (Mirai)", "value": "7afe110108c51a7cbf2122f1f9ab4f05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516744, "uuid": "bc35d307-b432-47cc-81a4-0d5ef8a731bd", "comment": "Malware payload (Mirai)", "value": "ea3eb82dc0888a9c10a193428aa2715a5ddb3f650aca1505be7e88721946c9af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516744, "uuid": "194289b0-5645-43b9-a50f-d648e58161c3", "comment": "Malware payload (Mirai)", "value": "aeb43b257162a716c8c4e18fc882f6b3a44328ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516744, "uuid": "c8e4aeac-3245-47eb-83ee-87653c313791", "comment": "Malware payload (Mirai)", "value": "7d5c358c15dd03f1be8eb140f8abc3d6152958f3d0335d8664947cda29cbc4ff58b65373b7b0e66f30de4ea01d373cc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516744, "uuid": "05d4ecb8-3646-4906-af01-a30e3f5c0a30", "value": "T10FD3F609FF610EFBE86FCD3706E9070525CC655622B83BBA7574D82CF60A64B1AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516744, "uuid": "874226c3-9c63-4c69-bf16-084349bf0d69", "value": "3072:Uc7PVfa17NaoKJ3pLKRsqW3JJLSSrRy+:XNfaVYoKJ3ARsDJAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516744, "uuid": "d1ffce8b-2df9-44de-af5b-289608a6040d", "value": 136440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516744, "uuid": "f1632fd1-8a07-4f62-b7f3-d0ea12bc5800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516744, "uuid": "6659636a-250f-4154-9a2a-ec6a7d06030a", "value": "ea3eb82dc0888a9c10a193428aa2715a5ddb3f650aca1505be7e88721946c9af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3857ea5f-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509671, "uuid": "4d489274-ccf5-4722-8855-5679d963884a", "comment": "Malware payload (CoinMiner)", "value": "2e99be4a5c84ef4ec6dc636bcf7a8b25", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509671, "uuid": "e54bade6-9181-4a8a-85f8-7b71a83cb6c8", "comment": "Malware payload (CoinMiner)", "value": "eaa26f7216489c912aefe62d042e23b14a47355cf86a3a2dadcbd5cdb74c8d90", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509671, "uuid": "b74ff34a-6c55-4041-b3ee-6bf620a2e60a", "comment": "Malware payload (CoinMiner)", "value": "64570362e9482ecee1f33dfb7fcacfd914eac4c1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509671, "uuid": "8a6bb0ba-2866-4f9f-a66f-0b7a8985bbab", "comment": "Malware payload (CoinMiner)", "value": "c4aa836e526220daff18bcab28d8377b374ab36fb9922ffeb8d2a6d86b12c4513f15b5877b17841db9d89c7fc83da040", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509671, "uuid": "a747cec6-5768-429c-837f-bd6f33aea10c", "value": "T17FB5331202C3FA7FA49DE9C4A8FC7B311E6654F067281A52785E0C5ABC71FF901A791A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509671, "uuid": "36cdcac0-194c-4d91-8ad0-0444d155ca50", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3R:G3LG658+S8YrCpHy2dUui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509671, "uuid": "f697705a-4817-4282-9075-097199aadda7", "value": 2289664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509671, "uuid": "ad067def-475d-4081-82ff-a0427a4d1a43", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509671, "uuid": "d1c5aec3-2018-494c-b425-e6808211554b", "value": "eaa26f7216489c912aefe62d042e23b14a47355cf86a3a2dadcbd5cdb74c8d90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb27dc6-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509227, "uuid": "3409d9c7-40b4-45ec-943d-f943e23c16d9", "comment": "Malware payload (CoinMiner)", "value": "94b00c0ab70599500919a3edf64ee34d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509227, "uuid": "1dc2e08a-33d8-4f72-9dcb-1d25f5949c57", "comment": "Malware payload (CoinMiner)", "value": "eb3e25549b08759fcd6476afabeaa7ae33f1c50533a1d62cdaf7721116d6c160", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509227, "uuid": "4528ea0f-0419-4e9e-a001-dded6c69b79d", "comment": "Malware payload (CoinMiner)", "value": "bce0797ce328d75177efe6a0d7022c880713e1ec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509227, "uuid": "7c40f910-4397-4287-8472-264e20b2d2a1", "comment": "Malware payload (CoinMiner)", "value": "45ba8eff5d613e1bfe7aaf1a2f218da2fb5e5d3e81ccf3dd0ea0645cc7f85dbf912d783aadc66d61b513da92904a0a1e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509227, "uuid": "7e265705-c6ae-42ca-af8b-acd71f4428df", "value": "T1BB06336202CBFCFF5981D47858E8AB320F5655F19A6C9125F929082DBC26EE3407B737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509227, "uuid": "16514ca4-2965-4afe-b79d-68a4a1b28393", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQd:CC65sr3KrCfsYiZQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509227, "uuid": "2b910c75-d49f-4963-95e6-0e204f9c86b7", "value": 3805184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509227, "uuid": "3ba2b71f-caa7-4b69-9897-d3d9e0fdd461", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509227, "uuid": "e9821818-af47-44e9-8bdf-c3f5c5bf9ac1", "value": "eb3e25549b08759fcd6476afabeaa7ae33f1c50533a1d62cdaf7721116d6c160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc94aa3c-e9b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767564546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564546, "uuid": "90683e2a-8ed2-471c-b138-6517bfc84648", "comment": "Malware payload", "value": "4da47e16cdf57e7b49ebf231bc345d4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564546, "uuid": "711a09bc-d684-434d-8239-ff1017af603e", "comment": "Malware payload", "value": "ec0f23bf0003a916112767c3875d201fde6b1acf80d9458a4321c43b3ac86983", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564546, "uuid": "2347556b-461b-4d54-ad9e-83386a38c82c", "comment": "Malware payload", "value": "b8700b8f1eb8767f061496655e6fe1b1c60ef79a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767564546, "uuid": "0d85ad80-8987-40d8-814c-0a75fbfb3744", "comment": "Malware payload", "value": "733f90ed2319bb0652fdaf63c6b78616947f644139a55383f9ce0ce001551b7d38345ab922f8f93d053a661602d9e387", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564546, "uuid": "1712a973-401c-4651-9967-87b15bd3aba0", "value": "T1FB6273A9F952BBB6713C4070F69661C5A34825BF47A83E79709BFC38331C2C852FA561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564546, "uuid": "58c60ae0-b13e-4419-ad27-81bbe0b9259c", "value": "384:ncWFeaEqunZXm9QEO5QOgpbw8h2zxZS+3A9H8mcz5yGAeE0WeyBAPq0TlQ+B2kc8:nc+AquZXm9QEO5XgvayGAeEreyBAPqod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767564546, "uuid": "157d8db0-e791-4e00-a787-990a2f22e85c", "value": 14808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767564546, "uuid": "165d25d1-2be3-4c28-a7dc-2f5d4213e52b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767564546, "uuid": "12882db3-b44a-4f8b-9e5d-408be6f5e81d", "value": "x2-main.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6f4c48-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513011, "uuid": "69005173-975b-42f1-84ed-9a2906bb517d", "comment": "Malware payload (WannaCry)", "value": "46d0756ffd884532f8c9223a65b20c81", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513011, "uuid": "97732460-2eca-4a62-9d12-28b8b9fabf8d", "comment": "Malware payload (WannaCry)", "value": "ecbd49e62eb0e352323a339e3e95f06f605ea054000135a6320fb1f837416b4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513011, "uuid": "17352f34-17a8-4f86-a9ae-a01aa185ca70", "comment": "Malware payload (WannaCry)", "value": "840e56fe2e39eaa33e12d816f9ac3d4a2c1a7194", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513011, "uuid": "5afdc859-6468-4617-9884-cabeaf5b8634", "comment": "Malware payload (WannaCry)", "value": "25b19caa9d8c38cdd80468ada83fdc52d4030c1c9fede2bf1b4363801d8621c960eddc8c834edd6f877920f9269433ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513011, "uuid": "b9bd4e8b-eb71-44cb-9cf4-1922068be7a1", "value": "T11736235A75BCA1FCC11A637464778E2696B77C5A22BD970F8F408B620C03764EFA4B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513011, "uuid": "fe8ebe10-b2bb-4065-a7ef-1d380a41a769", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513011, "uuid": "77ce0676-a65a-4a9b-8f7a-073be453e520", "value": "24576:RbLguqQhfdmMSirYbcMNgef0QeQjG/D8kIqRY:RnaQqMSPbcBVQej/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513011, "uuid": "8c265b5a-4d7c-4351-9303-9cecc265f2ae", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513011, "uuid": "1c5db111-95db-4131-be28-e19fb00f695c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513011, "uuid": "8390da71-f066-4908-bcb2-cc59eaf852cb", "value": "ecbd49e62eb0e352323a339e3e95f06f605ea054000135a6320fb1f837416b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4a828f-e987-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767542993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542993, "uuid": "9530cfcf-5d9b-472b-bdec-caff06bdee32", "comment": "Malware payload", "value": "43bc15f38017e3427d7972a8ee2702a0", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFConverter", "colour": "#F65348", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542993, "uuid": "5adae37f-f672-48f0-a417-a1159029f3f7", "comment": "Malware payload", "value": "ecc15c35c1f6e04c049023a664b23a3369dfeddb155408601f660c295b6bfa33", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFConverter", "colour": "#F65348", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542993, "uuid": "f37274a8-3448-4784-a666-9a273ad22fca", "comment": "Malware payload", "value": "da82bb9dc36b59ac0017d700e2c1315604fac487", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFConverter", "colour": "#F65348", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542993, "uuid": "fedf2730-97b3-40d5-8496-22c1babfc235", "comment": "Malware payload", "value": "61ebbb2a89e02f4cec77234711caea9ba8af2c2a97624298de863c278071370cfdd797c8d19b8de76720c9039a04deba", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "PDFConverter", "colour": "#F65348", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767542993, "uuid": "16d5b34d-d7ac-4bec-9a13-850d3a26c7b1", "value": "T196344C536706282CC26B51321ABBF7714370F4517791377AA79482325EBAEA01F62F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767542993, "uuid": "9ad62f9d-c0fc-49e7-bbe2-52893ffe42fd", "value": "6144:Ls+hidtESQGCpsRDaSm3b+xO4ZUeSXRMoHLKW6RNGAcG7ZZ6t9bgX8JVRl:xYxBaYnCRMoHLKW6RNGAcG7ZZ6t9bgXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767542993, "uuid": "e1c5677a-062b-49ff-aa13-15adacef9f45", "value": 245568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767542993, "uuid": "c293148a-d668-4f92-b304-79f9cbd5e373", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767542993, "uuid": "b932467d-bc97-4ebe-bd08-cedb3681273d", "value": "ecc15c35c1f6e04c049023a664b23a3369dfeddb155408601f660c295b6bfa33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06e9c05-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516798, "uuid": "8a48d04a-5140-4c6f-9876-12d62873666f", "comment": "Malware payload (Mirai)", "value": "da3c6d8965af0afdde9d282d120f4cab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516798, "uuid": "d25c6a1a-4be9-4043-9cfa-029070eca2a8", "comment": "Malware payload (Mirai)", "value": "ecd98ba5a5857a2212617203865f9049f822df95157a322b0d5ff0c514339e66", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516798, "uuid": "a453bd5a-9841-4e3a-8376-960000909311", "comment": "Malware payload (Mirai)", "value": "ff149efff430f51ca8ae1b6895e0ee0a4e039b73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516798, "uuid": "9946c478-258a-4f31-8e18-e5db8d39fe8f", "comment": "Malware payload (Mirai)", "value": "7452e0edd196ef8119c183dfe42878a700716c7b4cb65828c9eea1aadb659e9b7cae0f3f9c8daf4869855f55322603a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516798, "uuid": "48c4ee10-4807-4986-98d0-862584af5884", "value": "T142B35C52FD92DA12CAC521B7FB1E428C371743F8D3EB33039D266F21268A91A0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516798, "uuid": "9a556b96-0fce-48b8-86fd-c17134fccbe1", "value": "1536:kVwKz0M86Lg9matGj4wL/SthbfdZLoyxAGNXWOjeZz07ASLl+v5DNb:kVweXpLNatGLLohDrVxAkLAzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516798, "uuid": "2c0f1763-b401-4252-b1fd-22deca20f85b", "value": 107732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516798, "uuid": "a6a10956-9580-46f4-a734-60ea705ca2d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516798, "uuid": "ef121fa3-6e1e-4394-9f48-55b0958f9147", "value": "ecd98ba5a5857a2212617203865f9049f822df95157a322b0d5ff0c514339e66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7c4511-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509542, "uuid": "44c0fc96-549e-420b-86d8-079c6d7156b9", "comment": "Malware payload (CoinMiner)", "value": "b45d036393bf3f4a755a9e29e95114e9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509542, "uuid": "fd5aadc7-68fa-4016-b6af-dae81755ac73", "comment": "Malware payload (CoinMiner)", "value": "ecf26c4d8d3068f9b8b80548d1bd272d2258f2e1d8e391aedd0745c46fc66c3a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509542, "uuid": "21ccbdb1-f9f8-48dc-8cc0-57ef5eed1aa2", "comment": "Malware payload (CoinMiner)", "value": "930c2621b80fdf74a781ccf6599b8e4e9c345943", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509542, "uuid": "76c81bb9-4e2e-4d8b-aee7-26e1ff193aaa", "comment": "Malware payload (CoinMiner)", "value": "66b2f447826780c31feff83403d68f01cebefb5b2ab18536227a9f47b5d13e4ed63d9c701e3a8a94b7fc62ec0b339792", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509542, "uuid": "e5ef4882-3939-4abc-b8f2-ca43856f1212", "value": "T1D8D5331200C3FD7E65D9DDD058FC7B350E7B51F0A7681522BE6A0426BC22EE641EB61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509542, "uuid": "d433b60a-8d2a-4295-bdd2-199cb49c8506", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jE:G3LG658+S8YrCpHy2dUu4KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509542, "uuid": "eec4cf16-79f8-4427-afe9-4e0b9694cda8", "value": 2973696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509542, "uuid": "25fe4dc5-7119-4673-a7a6-e3534ee57188", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509542, "uuid": "1dd8ed0d-837b-4e3d-aedb-39d77f2aa9df", "value": "ecf26c4d8d3068f9b8b80548d1bd272d2258f2e1d8e391aedd0745c46fc66c3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214ba07e-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767510920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510920, "uuid": "aa147058-b42c-47a4-93e4-cfc62aa1480f", "comment": "Malware payload (Mirai)", "value": "55c655382936970ed00816fdfd30f40f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510920, "uuid": "8d72bed2-a0d9-49c9-9673-2ff8db0ec045", "comment": "Malware payload (Mirai)", "value": "ecfb6cf4a45962d3879b927124e18c62a77937b180c40931586a307444e1813f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510920, "uuid": "79b487bd-2664-47f9-a559-adfe4ec424b1", "comment": "Malware payload (Mirai)", "value": "21b6c906a4d5b7c62885f7d977d7460f665c50ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767510920, "uuid": "8a44e64f-83b3-4195-a56c-d7a189aab2b8", "comment": "Malware payload (Mirai)", "value": "e1cdf0bc67524050a2114f00b219028e238e406de4bd26d54809369f58d2ce36f9574722661ba8730611b64718abf736", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510920, "uuid": "ccb592bd-f289-4ba9-af31-6ab18158e54f", "value": "T1A4D47D5CFE4E3C42E2CBE2789E4983E1732771E4D32391A37582524CD5CA9E9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510920, "uuid": "cf2fe761-a622-403e-a8a7-a948399b2a9a", "value": "12288:VRd4LvKg9fT1MM4wp/ZJUfCEDrgBTBAdUGEfBIgnGn5Kw5kXFwuG:VRiv9fT90fCEDcBTcIBfg5SGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767510920, "uuid": "24df44f8-4f9e-4346-b657-b93cc68c0721", "value": 639248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767510920, "uuid": "11e888e5-fb4b-4691-a4d7-2cf1cbfe9f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767510920, "uuid": "f33e3883-d5b9-45d6-97a7-24443774e0f8", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48392159-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513133, "uuid": "8e1a175a-ed88-4c34-8672-56ed2a24e2b6", "comment": "Malware payload (WannaCry)", "value": "b4a0c2ff755856f92f19cb651a61ae80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513133, "uuid": "62ec58ac-c035-4ec7-82af-852cc7d4ccd1", "comment": "Malware payload (WannaCry)", "value": "ed2c83c75f687f6e23598be242b6e53d63f90f8870338e632d390e6111c2dee3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513133, "uuid": "c4a756f5-b0d1-4a3e-9033-7b0fe7d8276e", "comment": "Malware payload (WannaCry)", "value": "6937cdafe1e80af4bf90fd0f844e725257b16a08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513133, "uuid": "a5bf8851-0f36-43a2-ac9b-e8b1fc6b10e5", "comment": "Malware payload (WannaCry)", "value": "716ea0d3b936377230f2f80af3c3584648e02bff299bcc9e3501469423bb10575cc2b2b657eb3bccf49bd0b9b7729a88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513133, "uuid": "1cd9f190-ea0a-4c36-83c2-1e681525a128", "value": "T1143623A6746C90F8D206257498AB8F16B2B77C3921FA290FEF508D362D53F52E754B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513133, "uuid": "98da67fd-4419-489c-ad3d-07439d618f93", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513133, "uuid": "d1802a41-b598-4bd5-9496-1d6fb27ae4a3", "value": "24576:RbLguriBJMSirYbcMNgef0QeQjG/D8kIqRYoAda6626WgkQg6eX6SASk+RdhAdmv:RnGMSPbcBVQej/1Il6kQo6SAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513133, "uuid": "a1a82ef0-cca6-408e-9566-beaeab93ac0c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513133, "uuid": "fc92eb8c-86ef-4f3f-b685-ea81e52e98a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513133, "uuid": "9d4c8aac-5b64-4846-a8e3-19ef73794306", "value": "ed2c83c75f687f6e23598be242b6e53d63f90f8870338e632d390e6111c2dee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacdae90-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512869, "uuid": "b823d820-d17a-41cc-a368-21058ef65aac", "comment": "Malware payload (WannaCry)", "value": "d55c176c7a814233f6e57e699f8f6230", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512869, "uuid": "dbf86694-7862-422d-a766-7360fb8c8b82", "comment": "Malware payload (WannaCry)", "value": "ef11b181da12beac2128d1093c5b2a1314373840f3780c051ffd05413b4f46c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512869, "uuid": "a7617e7a-42f1-4cdf-b369-5f30ba30b619", "comment": "Malware payload (WannaCry)", "value": "cb0051e7c130acfd7f21bb03a6843cc2950b52da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512869, "uuid": "0d6b24ae-045c-44c0-b4b5-d8d951faa699", "comment": "Malware payload (WannaCry)", "value": "7a555fe03459fa179366736788da2e32e65f3742f411c908b431a99032ce4867fc43d5e913de9622bed95256421f7e85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512869, "uuid": "c53260f6-0f9c-4055-b382-7a20de3f7b22", "value": "T165363358622CA2FCE0450DF80463895AB7B33C6967FE5E0F9BC086661D53B4FAFD4A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512869, "uuid": "9a20c68b-8a7a-4064-a920-78c9d4f13812", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512869, "uuid": "59e242c6-474a-4d8c-954f-a83e47cf63ff", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593jVp2H:TDqPe1Cxcxk3ZAEUadz54H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512869, "uuid": "2b506fef-3007-4d4c-ae5c-fada9a00a422", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512869, "uuid": "39242d3f-e4a2-45fe-a666-6002364424f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512869, "uuid": "5c95115d-dd5d-43ee-bd5c-2b38058b4d6b", "value": "ef11b181da12beac2128d1093c5b2a1314373840f3780c051ffd05413b4f46c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3bffab-e931-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767506112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506112, "uuid": "7481fad3-12c0-4ef1-a7c2-7d66df12d341", "comment": "Malware payload (Mirai)", "value": "c1add68d8d084f88d87fb72c99ab2546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506112, "uuid": "475d56b5-fc74-4569-a93f-c2401dd3de04", "comment": "Malware payload (Mirai)", "value": "ef1f82958f0b706c45d2cd3dae961daf968ba445e5dd2a34659c5b73c09f7355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506112, "uuid": "ee677eeb-7070-49f3-8e9e-4e210675643c", "comment": "Malware payload (Mirai)", "value": "4a070a430bff3a0a74fee279d02d32712d62c732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506112, "uuid": "327f56e3-d1eb-4b50-a811-7dff747b2c31", "comment": "Malware payload (Mirai)", "value": "eef5ab44701e05c4327cbef015ce3b6d4cf33bba08bb43344332418775806f038d221ff90d94c73b718b662fdecd8774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506112, "uuid": "9f0d03ed-112b-4420-a090-5681f31789ef", "value": "T1D0F47E637B318FA4F325D6B005F386156BA422A20AF764C1937DD6107A6066E2C1FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506112, "uuid": "67cd90a7-d955-4a3f-8c5d-cef7370be0ff", "value": "12288:WGWyo1C1wOME7LHl4dMWMLSfXxIDgpZlZFy7C:WL1Ct17LZWMLSZFnyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767506112, "uuid": "c0368ed2-06c2-42ca-bfc6-e43be6349b12", "value": 730136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767506112, "uuid": "a99ab4ba-ced9-456e-9ad0-e0e1d929c937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506112, "uuid": "e1419c84-7810-4c0d-8549-185470af46f4", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de60a4f3-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513385, "uuid": "2e6b76f1-5178-4916-b5f6-420650b6f9ea", "comment": "Malware payload (WannaCry)", "value": "6a3a7cf5ae56063c26e85021fcbe38d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513385, "uuid": "fcdfd076-b297-4f09-a579-2b309e2e89d4", "comment": "Malware payload (WannaCry)", "value": "f020f75d6fac088b78abeaf848cba5b53ac0a2dd79be1ebe458f7a9514aa94b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513385, "uuid": "b5df05a3-b242-482c-a74c-6ac9286359f1", "comment": "Malware payload (WannaCry)", "value": "5120eda5738374bb8046236daa65864a8a02ac81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513385, "uuid": "a240d31e-5f65-4eb2-a700-4296d1985196", "comment": "Malware payload (WannaCry)", "value": "f4d3db88ed25b4ce6855f226f1b05f57733f9e21e8610f102186a2391ea099c66ee5403db1d8abe69e8cbb137d5462f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513385, "uuid": "22e7e297-741b-45f3-a48b-7307af3dd726", "value": "T1E836336CA12CD2FCE1450DF840B3C55AB6733C55A6BE1D0F9B8046BA1DA3B5E5FD4A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513385, "uuid": "90847594-fb0a-4fae-83d3-8614ed16c3d2", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513385, "uuid": "7af890a8-6666-47f5-a9da-cd6f1f720869", "value": "98304:SDqPoBhz1aRxcSUDk36SAEdhvxWa9P593vHmD527BWG:SDqPe1Cxcxk3ZAEUadzvHmVQBWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513385, "uuid": "1956b327-1e85-459e-ad9e-580d648440cb", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513385, "uuid": "65f31464-2d63-43fd-ab87-c6425625c253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513385, "uuid": "0ac030b6-bfff-4baa-b1cf-ed2178e57a46", "value": "f020f75d6fac088b78abeaf848cba5b53ac0a2dd79be1ebe458f7a9514aa94b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c489b40-e938-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767508979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508979, "uuid": "8ebab474-4acd-417a-bef7-06e34761b680", "comment": "Malware payload (CoinMiner)", "value": "fc1d9cd9df75e99b4070620c4bd1b2a8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508979, "uuid": "093e3356-9bd0-406b-a018-e38764662ab5", "comment": "Malware payload (CoinMiner)", "value": "f0a78b7dc67aaebad0368f51ad9e04acba59cc174f827e091626bf8b6a10c7e1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508979, "uuid": "6959d18a-f421-4f67-b9d8-fe6d20edd692", "comment": "Malware payload (CoinMiner)", "value": "1a38a1cc9648215c1772b7abb1e8cc6c45ace910", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508979, "uuid": "7cac3f16-b12a-4f1c-b822-69ecd3019991", "comment": "Malware payload (CoinMiner)", "value": "6252dea02edc5578b9c62d54933d85c08c370556c6eb40b96089e450b4d3c42d849c1519797a7e110eb1ea56ba05e690", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508979, "uuid": "1c3c0cc2-9817-4ff5-a8ed-8995123c2236", "value": "T12826333511CBFDBA7589C964ADF4E7314EA925E29D784005FC290828BCA1EE6407B73F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508979, "uuid": "0190b075-7fdf-4f11-9dfb-13efe812a2f2", "value": "98304:G3LG658+S8YrCpHy2dUu4KrCf43vwvKZQgzfhF:CC65sr3KrCfsYiZQgzJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508979, "uuid": "0984348a-95ec-44b3-b9f2-69b8e57da25f", "value": 4455723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508979, "uuid": "789795aa-038c-4c6c-95bb-c0da89a4f267", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508979, "uuid": "646222c6-3dd3-461a-8c63-a8098b368fd5", "value": "f0a78b7dc67aaebad0368f51ad9e04acba59cc174f827e091626bf8b6a10c7e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d73a42-e942-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767513126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513126, "uuid": "f858c920-1e35-467e-8e9d-6c611320cadf", "comment": "Malware payload", "value": "487ce65d0c0a2af18d77d76fa64237c5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513126, "uuid": "7ddbca74-2596-4b85-9444-bd94c9ed2c44", "comment": "Malware payload", "value": "f18b4afa7a7e5b231c267aa61741e3aceda43d5b744de8e79b7e0b86941f3c61", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513126, "uuid": "e9908cde-e3fd-4b1c-9605-3a9cb1de8017", "comment": "Malware payload", "value": "5b2230baa4de6fe1cd3c803967fcd1409c6bb352", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513126, "uuid": "8e87cce5-d7cb-41f2-b1bc-4569d4581699", "comment": "Malware payload", "value": "77d801721ec3f1a4ff82bcaf25cfd58badc2d07754e674031456cb27fbd9c9af5d2da878ab2c525f99f8e5a5f2a4b533", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513126, "uuid": "454924c6-1ed5-4ac5-8fff-3152f1b70fa8", "value": "T1135533732F917C8FE7D795E1F3CE12287C6C2FA6CEEF90245570928200644A261B99CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513126, "uuid": "642996a8-9cfd-4497-8b88-fc50d99e7436", "value": "24576:k6zDiVkgEq9zRhop3FN8LLP3I1sO7+I1FCD9ih4tp6/o4DtceqKlhd8FWVs:k6XiCgEq9zRhoJALfI1sO725u4z6tDxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513126, "uuid": "d1a63638-8bc4-4307-b3ed-0642c14d95e5", "value": 1290309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513126, "uuid": "3e9bbd36-ea97-4280-b078-b059e69bef6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513126, "uuid": "2decf0f2-f306-4a02-9ae5-2172ac1b81e9", "value": "Detalle_137.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76c346e-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509857, "uuid": "dd6fcfb5-8e44-456b-8eb0-26ead7fa53c2", "comment": "Malware payload (CoinMiner)", "value": "e4db0f638c04d2ed2e176080d5cf50f8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509857, "uuid": "24e89d4d-d672-4172-acf9-1f2af8e94448", "comment": "Malware payload (CoinMiner)", "value": "f1e882372722a52eab09830d2271477282b9a595b96f08f756b073aea243aa0b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509857, "uuid": "fa640342-79eb-4c6f-aacf-9c96861bd3ec", "comment": "Malware payload (CoinMiner)", "value": "b6f6f908101a5448c61be6cd07c9096787614898", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509857, "uuid": "f75d94ed-9b06-42fb-ace6-308aa1fda140", "comment": "Malware payload (CoinMiner)", "value": "e4eeaa1e6ecc0fdd149812369b6c777f415dbfc61e49a11d2bfc07e10bd96c795dcaa58196f8fe48fe3301bcb59527c7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509857, "uuid": "69466de2-3e79-49a7-b6a4-28ac69514aa1", "value": "T1909533A001C3FB7F568C9BC468F876311E2559E02728556AE80F1D6BFC72FE905A7D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509857, "uuid": "af6888da-015c-4612-a29a-cb6869796cea", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHt:G3LG658+S8YrCpHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509857, "uuid": "eb4f5db6-8744-4247-82bb-d5bd5fc9689e", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509857, "uuid": "d83e4197-bbfc-4349-9fc4-0928420cc908", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509857, "uuid": "72083609-9482-4de3-82be-bb87d92b5336", "value": "f1e882372722a52eab09830d2271477282b9a595b96f08f756b073aea243aa0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5092a3-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767511211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511211, "uuid": "fd542935-31f5-4f97-9ddd-2d485dea8abf", "comment": "Malware payload (Mirai)", "value": "20532b27d976e865aceb0ec11d9f2ff8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511211, "uuid": "196fa6c0-e3c5-4780-86db-865178a04558", "comment": "Malware payload (Mirai)", "value": "f1f2ca2401c4ee590bfee181934ab0f6009548749e97a71eafeaa344c46c0967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511211, "uuid": "90116a66-4661-4630-a228-b2da59b84973", "comment": "Malware payload (Mirai)", "value": "5e337053f5277a38c0d5869d64ccfbf124d586e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511211, "uuid": "f20a3b07-580b-4b20-bc76-b1357cac11ac", "comment": "Malware payload (Mirai)", "value": "8a17cea1742d7bbe4e9c26bd0ab5c806e009f16aeb510ba4ceb9e5102a427b0f52e2cc20aaecf728603a253bc852fb9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511211, "uuid": "87ce5c59-98a5-4b80-8586-925d490ce0ff", "value": "T154630287B42FDD71EC4219B175A2C048F310E75FDBBA132549051A784D7AF32241DFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511211, "uuid": "1904ab57-cc29-42e7-9e17-b4a82423e5fc", "value": "1536:fSA9ENb1r8Vr6oU19i0lzM339BtKfdYMWzT0nmMCR/h4TVm:fSAUb1OQ19i0lz439BgdY10mMmOhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511211, "uuid": "6270b57f-9961-4e12-a44b-980b5f089139", "value": 70748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511211, "uuid": "b9cbfe7e-819b-48e6-b25c-8b4dda337038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511211, "uuid": "7cd16207-51eb-4fa6-acbb-0cb15d164533", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224eb8cd-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511781, "uuid": "940d59e1-4c6c-4dc4-9343-e0c654ff85bc", "comment": "Malware payload (WannaCry)", "value": "06fa874f545bf101f68da4f8bc38c5b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511781, "uuid": "b0f895c0-f07e-4e4a-a962-6b5a5c31157b", "comment": "Malware payload (WannaCry)", "value": "f2e2e2df987cbe9fb2261d45a4488e8a5e1852508bb58b88de086e3283745c2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511781, "uuid": "45f4d33f-d0ac-40da-b184-32e71ff4ea60", "comment": "Malware payload (WannaCry)", "value": "176fcbe05e20b8ded2eac6b5b8760581f18bff35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511781, "uuid": "e49c0b52-3b72-45fb-8990-bdc820c0d8ba", "comment": "Malware payload (WannaCry)", "value": "52413ca0a0bfdd154ef9d51331aa7d16a2b11240dad186e6c7aa05843c901b5e062da31f594cf1c202e88443b32578e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511781, "uuid": "00449b53-c5bd-4530-906a-c677da744e1b", "value": "T1E8369CACECC872A1F14FAF3068294A0E7D74388B5ADD141436C06E7914A2D27EDDBF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511781, "uuid": "9e995959-e9e9-460a-bc62-aaab7492d968", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511781, "uuid": "75beb2a3-1bc0-4d81-ad35-a4bf9aeeb1be", "value": "49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:TDqPoBhz1aRxcSUDk36SAEdhvxWa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511781, "uuid": "246e25ba-7eae-43c6-969b-86fc3f29955c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511781, "uuid": "b4db542c-5ea5-47aa-a586-aacca47851cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511781, "uuid": "ff33a065-9edb-438f-9bb7-0f1c6466dcd6", "value": "f2e2e2df987cbe9fb2261d45a4488e8a5e1852508bb58b88de086e3283745c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0499444d-e97f-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1767539219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539219, "uuid": "458a231c-837c-4464-93f6-e3d7cc04c616", "comment": "Malware payload (GenesisStealer)", "value": "6a2d696bb6db6ef652df529fb66c8032", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539219, "uuid": "e1289d68-0936-49e6-9594-3427f376cb4e", "comment": "Malware payload (GenesisStealer)", "value": "f300b47cf4f870afa59212f8aa98174d15ef513daa080b7d5c864bdd9ed6afbe", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539219, "uuid": "60c388aa-4c59-4654-bf7d-b9cc702f321e", "comment": "Malware payload (GenesisStealer)", "value": "7c280a67332ef5b59b5ddd4de919d725cd7795fc", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767539219, "uuid": "10083c4e-a4d2-4bda-8424-3f4d7d3c4705", "comment": "Malware payload (GenesisStealer)", "value": "e21dd183c3346cc13ad13e39cac4f6c1004af86d474aa3e418118f13c76346151f66f3afb50459d03884db9d152f959d", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539219, "uuid": "9f9273b2-9700-407b-83cf-d0a469b78651", "value": "T1D7F4E028904B1EBD5233B86500B23EC539D2CA11E5D86F379B90C77A986426D7473FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539219, "uuid": "8defc573-8d02-4c90-88b7-3f088a1c4ba2", "value": "12288:mtgc2+TunPj2fovIIfB9/OzvJ4Qy8VwXtoj0llPS456BXnW2u:SgcHCiov3X2zJ4A+oKu9n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767539219, "uuid": "e494a4a0-a63b-4dad-a32c-36303a6abd6d", "value": 742480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767539219, "uuid": "87b541c8-e181-47ff-8135-95245771a7c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767539219, "uuid": "395c2f6a-7963-4b34-8e7d-9d2ea840c3af", "value": "8cd5b89442c7175a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a703177e-e932-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767506420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506420, "uuid": "b2bdbed0-37d5-468b-b3fc-b8b0b5446796", "comment": "Malware payload (WannaCry)", "value": "c7878e8e4bbb1222bc10facc29801d19", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506420, "uuid": "45f8317e-0a2e-4dc3-8af3-ec2618c6ae88", "comment": "Malware payload (WannaCry)", "value": "f48f713168ef951fa3c7ce2a8cc480ef42a168c4184043a302b206da7fab0239", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506420, "uuid": "98e305a8-fe10-44fc-90c3-755abe827b36", "comment": "Malware payload (WannaCry)", "value": "867d013dd581a92e0ccc8d0858a8d62e951794c9", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767506420, "uuid": "221b73bb-4147-4d3b-9be7-48af8c25f2a2", "comment": "Malware payload (WannaCry)", "value": "852679a291b8298b19839468fd11ed7198e309cada5b98fec8d5a98cb93b044bd5e6a921286b7580156f547eadda544f", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0147", "colour": "#E79D27", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506420, "uuid": "84e32891-7f46-4620-9a30-badd08ce4b59", "value": "T10036C090648BAD34E40F4C304F84A65F7372A8A3C7582B5F6B829E7A5D91FC14F0B679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506420, "uuid": "31e6fb25-9dbc-449d-9cd2-e24210669703", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506420, "uuid": "803810f7-d414-4ea7-8e1c-efcda50715c9", "value": "24576:SbLgdriIfEcQdIVUacMNgef0QeQjG/D8kIq4LKz6ClX6SASk+Rdh8ev:SnsEKUacBVQej/MRG6SAARdhjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767506420, "uuid": "53d502ec-3672-4473-b739-2c252c62b4fc", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767506420, "uuid": "3c2daa1d-5a08-43df-9870-414101ecdfea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767506420, "uuid": "368465cf-d186-496e-a1c9-9e609dbad428", "value": "f48f713168ef951fa3c7ce2a8cc480ef42a168c4184043a302b206da7fab0239.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0791f96c-e93a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509589, "uuid": "48b638ec-8522-4d2f-85cb-7557e5a68312", "comment": "Malware payload (CoinMiner)", "value": "b41eb6e7d428b9e27a1b133ee0bdb3ad", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509589, "uuid": "b27d8856-0e29-422a-b7c1-d499ad9fcd85", "comment": "Malware payload (CoinMiner)", "value": "f52b5711dba916231ef0e187c2067de1131c23e2a0c4cf78068c3c8203c544ae", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509589, "uuid": "f8b1b919-f7a5-4a2a-aaa4-5ad04f62167b", "comment": "Malware payload (CoinMiner)", "value": "274b8a945b7bf122b108ce20f060d31d8aaecd48", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509589, "uuid": "303a6b7c-6cc2-4fb8-8c9e-6d30acf24f08", "comment": "Malware payload (CoinMiner)", "value": "837f34b901b54585213e81f7926a897ef5b8ca24594c6047d18e626fd2e7e9ce715051235e2e0eb5b466a8611800b09b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509589, "uuid": "2b7e097b-9823-4d8f-b9c7-5de972069737", "value": "T153C5336101C7F97F544EE9D058FCBB310E7A51F0A7292626BD2A041ABC31EF641BB52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509589, "uuid": "56347296-561e-4899-ad56-74d9d83745f0", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5q:G3LG658+S8YrCpHy2dUu4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509589, "uuid": "b3bc1bd6-563b-4195-b30d-0ba6cd452fdd", "value": 2723840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509589, "uuid": "8dc48d4e-69a5-4cda-bd38-d46f4b9b7756", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509589, "uuid": "81d676fe-6a0c-4a91-bd6b-f209bc88cbdd", "value": "f52b5711dba916231ef0e187c2067de1131c23e2a0c4cf78068c3c8203c544ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5ebff9-e93d-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511285, "uuid": "742d3c1d-5605-48fd-8463-a43c75054b50", "comment": "Malware payload (WannaCry)", "value": "65181c60f5659b7e99de3cb6666f4bc2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511285, "uuid": "d9838baa-156a-4385-ba32-b3743a6ffb6a", "comment": "Malware payload (WannaCry)", "value": "f52cfe52b9d638f1154a318f1cd420fce4dc1f57a117fe3452dcef04fd59e5a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511285, "uuid": "a3a53aa3-150a-44a1-831c-af497422f778", "comment": "Malware payload (WannaCry)", "value": "8421682de2f1537ac0fbdffed7b934f280002e16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511285, "uuid": "ef7a98a8-538f-4a87-b92f-a5e75d1a2e4d", "comment": "Malware payload (WannaCry)", "value": "5a0337c31dbccb39edea562d15055e626ba4a53585e53be3a4a8de62ef02d49e231ea38206bf4c210fcd80e9f6aa2484", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511285, "uuid": "4ba5f20b-47ab-443d-be0d-3ee62d25a61b", "value": "T120362358722CD1BCD10519740C67C9DEA6723C65DEAE5A0FBBC0776F0D33B5AAB90A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511285, "uuid": "20c533c0-cc0c-4ce0-8d6f-e6f91b13b171", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511285, "uuid": "0e42e805-9dc5-4e5d-9c54-62f4e9d5c995", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAME:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511285, "uuid": "67179911-9fe3-47eb-8407-b262a111c13c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511285, "uuid": "92942665-702d-4532-a51c-497a9dd1ae72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511285, "uuid": "c88cf865-f99f-4427-85b1-fb03cf7f39bc", "value": "f52cfe52b9d638f1154a318f1cd420fce4dc1f57a117fe3452dcef04fd59e5a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9315211f-e935-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767507675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507675, "uuid": "95176742-4cf5-49d4-bdeb-a10345090683", "comment": "Malware payload (Mirai)", "value": "db94dbc9d8ad31881d5c1dbe0f5a0c28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507675, "uuid": "ffbdc028-b9a3-42bd-82a0-2b9aed1d9b5d", "comment": "Malware payload (Mirai)", "value": "f546812a77929ab66379c90d53aa4379db26e9371cc8637094b802feb771d3bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507675, "uuid": "1165ec40-4eb1-4f20-abb9-c4c9f0d5fcb9", "comment": "Malware payload (Mirai)", "value": "6883a2a49d4c0ab378a0745d62875f3eb4e9d39a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767507675, "uuid": "d07ab462-a31e-40a5-9948-9eaa21cf314a", "comment": "Malware payload (Mirai)", "value": "37eb65a24d03915e5d41cd99ffd0ed13e7019ece629c83784aa627c8b6486ef18e2b1fc37dcbb31c63d8d1f5fbb76999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507675, "uuid": "debbb66e-4a75-4230-9a8c-c80a85093d46", "value": "T1A634E70AABA10EFBE8AFCD3705E9170124CC551321B97F367274D914F54B68B8AE3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507675, "uuid": "4563590d-34bd-4ef0-ac86-b4d968735e72", "value": "6144:b4HrXbssxRd+m0TpVZSgq4OjEFAjULdt:b4H1xIRncEtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767507675, "uuid": "a6cf20f8-e3d2-4434-b910-eac91fa35914", "value": 244124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767507675, "uuid": "2e17c9d2-5635-4312-a591-2ce40c30565a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767507675, "uuid": "73e076e0-2117-460d-a9e1-a0e90dfc1eb6", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec490a4-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512097, "uuid": "b3bcfe0e-ddad-49b7-8b59-88a7c454e3c6", "comment": "Malware payload (WannaCry)", "value": "cf4f46336abeec03630297f846d17482", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512097, "uuid": "e0ba8785-5208-46c6-9157-7d3df51dedbe", "comment": "Malware payload (WannaCry)", "value": "f54fbfcb038af9a12d446f0150b97fef7a71ca02eec07c517f0ed00fdbea8185", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512097, "uuid": "76c2ca8b-691d-4cae-995b-f6c9d14adeca", "comment": "Malware payload (WannaCry)", "value": "9bd7e03423cda2792e9f9dfc74fbf517fcbbc585", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512097, "uuid": "23f5a759-790c-45e3-872a-da9120608f01", "comment": "Malware payload (WannaCry)", "value": "414c121117ac260dc29edea0b8e9ae18671e89e96def08158be54defda2e1379089114e3237b1f39c245c8d077767b2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512097, "uuid": "5b9ab2b1-83d2-498b-8c74-5d395decb595", "value": "T17A363368622CD6BCE10519B40473C62AA7773C6566FF5A0F8B504DA73D13B5FBBC0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512097, "uuid": "22ae0a82-5357-4e39-b2a7-7a6a89bba9f8", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512097, "uuid": "e57851de-a3f0-472f-94f7-54f1d995e0aa", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:TDqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512097, "uuid": "646a0b0e-f173-4bdc-8c19-57b4b04d96f5", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512097, "uuid": "b487adf4-ac5f-4406-9c65-ccf5bb4bd776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512097, "uuid": "ef15ed48-5da4-47af-8a43-0773dfe6dcd1", "value": "f54fbfcb038af9a12d446f0150b97fef7a71ca02eec07c517f0ed00fdbea8185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49012eb3-e987-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767542770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542770, "uuid": "83ab57e7-c5d9-4df1-a064-8d53c40e9da4", "comment": "Malware payload", "value": "1b0f63a5f2c9f8637071730cf924dacb", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542770, "uuid": "80f155c2-6d84-4924-9803-ef26b7c7853c", "comment": "Malware payload", "value": "f5bd5070852baf016192d752f58f631020be07560736e7826746b07a15657607", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542770, "uuid": "f76787e8-a86e-4457-b8b8-987981ddefb5", "comment": "Malware payload", "value": "de0dd16cfc2dcfe882b0d1fa8cafe1fdccba1700", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767542770, "uuid": "67472be3-68ac-4773-bfb5-eb3642f4ce51", "comment": "Malware payload", "value": "c480de8d65925e9df9eda4216e02128e32d57d73aa228dd186cc0d08d052cec14089dcaf4783a6a5c50ec8d54466aec9", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767542770, "uuid": "bf67a7d2-c24d-4be9-a6ba-2d0b2c2d727b", "value": "T1FEC34B93772125F6C53F413A072BE7625632F915AF12A325B790E12A1E7AB70A313C4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767542770, "uuid": "d61a1911-27b0-4c0a-8616-35980a7376f5", "value": "3072:2+ARQw9TdJ27h7Ut2fUquAOzjnzui39B30WWzCyUdohmKu6Q:2vRQoeJS2f1Ozjnzui39B30WWzCyUdo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767542770, "uuid": "366368eb-c3b8-4974-b5dd-0b550e015562", "value": 122976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767542770, "uuid": "72b22b4f-19b5-4a21-9a4f-698baf0f7ecd", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767542770, "uuid": "6f3bac3d-bc2b-4990-a576-0e4fe12ee4c4", "value": "f5bd5070852baf016192d752f58f631020be07560736e7826746b07a15657607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85631aed-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "9777bc04-723b-4e70-b902-79c8b2002d93", "comment": "Malware payload (WannaCry)", "value": "c2906a725d83842d3f71c39ef932399f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "6de69973-c6f7-4645-b39b-fbc07b132c41", "comment": "Malware payload (WannaCry)", "value": "f5ff0c82070bc1f8263f0d8f6e20dc615b09dd40d8280e11e5354c5a7560c640", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "58a3b77d-f896-4d31-bbfb-d9be5472ad88", "comment": "Malware payload (WannaCry)", "value": "6a24b037a4ba117d3404dd8282430014b0fe7d8d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512806, "uuid": "59a7b3cc-9f52-4db2-bd89-4d04c940f3f8", "comment": "Malware payload (WannaCry)", "value": "210ddd1018194e8ec29e9f99adbdd36ec4a2624970a3f3046aa75977e81b2963c11611a0ce04eb93f349d244a3b2b195", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "a7554203-c889-45e6-bde3-ea0e7029ee50", "value": "T1F436702498C9E7D0D703E1B6477E46388A510095F3157B52B3B0AFE3E66B09A5EB02DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "5f39a7bd-5f78-424d-900a-07a339120250", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "f5bc374c-5b04-4c92-a367-440fc35520e1", "value": "12288:T1bLgmluCti62WfSm0idNVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjE6eT:RbLguriIfdMSirYbcMNgef0QeQ4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512806, "uuid": "be9a81ea-d518-4935-a020-a2cfffef0abe", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512806, "uuid": "29cf2298-95f2-45a3-9577-84b11297a9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512806, "uuid": "74aacd76-df6c-44bd-992a-48c8118c1a56", "value": "f5ff0c82070bc1f8263f0d8f6e20dc615b09dd40d8280e11e5354c5a7560c640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dee0f12-e93e-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511425, "uuid": "aff44ad8-8dd8-4bc5-90f7-294a1a0fe597", "comment": "Malware payload (WannaCry)", "value": "815880eb5d5aca43b279095cf27a4f86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511425, "uuid": "d1a5f84c-7ed3-4f8e-af77-76d2981e3162", "comment": "Malware payload (WannaCry)", "value": "f6d5c94fce6b46a7a6e842330dae49e421c9ce5a9083373f2fd3d242b4ca5129", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511425, "uuid": "4e56e323-428e-41b8-8422-ce2aa49859a0", "comment": "Malware payload (WannaCry)", "value": "882f26d444c8248d76c72f2179630ccb169be6d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511425, "uuid": "ef4b927c-a968-4caa-b1b1-66857ee4f1fa", "comment": "Malware payload (WannaCry)", "value": "10937b8569808b4586baf9581336c7f9e7737c568b35d390da9c768bc81e4a6849cf8aac0fe2388250c1059985b235d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511425, "uuid": "e185175c-082e-4bbb-b6ec-d87ccb0b110a", "value": "T17A36236630ACC0B5D103657088B7CF62E5B67C292275694FBF904E7E2E237A2E715B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511425, "uuid": "33bd5579-4075-4d09-b8e8-3e2d38827bdc", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511425, "uuid": "0a72fde4-fc2a-4d3b-ada5-4cbbe1b87081", "value": "24576:RbLguriIfEcQdIVUacMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTP:RnpEKUacBVQej/1INRx+TSqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511425, "uuid": "55563c91-d1c8-4cc0-afa0-84ee5652f99c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511425, "uuid": "f559a74e-9814-42d7-863f-da1ff474ba72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511425, "uuid": "49172120-aa13-4686-b2ce-d904662e8a2a", "value": "f6d5c94fce6b46a7a6e842330dae49e421c9ce5a9083373f2fd3d242b4ca5129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6afb0b5-e943-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767513829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513829, "uuid": "436653f6-f9a6-45d8-b432-aa0b6cfdc29d", "comment": "Malware payload", "value": "f3c19312c721868ccd831c3d857e8003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513829, "uuid": "3bb326b2-d058-4005-a08f-da147a4bc8b3", "comment": "Malware payload", "value": "f77a98913cab4e3ce95c570c6252b5ecb03812c19cf3199d6208818cb66eac00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513829, "uuid": "e7397bba-0b8c-4578-bd0e-a3fe3b9f052a", "comment": "Malware payload", "value": "cc1f7527025e4d1f7e89e65c7d417e763a8c44ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513829, "uuid": "e71a3a7f-24dd-46ec-9614-16dee68a7ccc", "comment": "Malware payload", "value": "233b273eff4d41a39c94e079c7e26097a733322285303722800f7a0ca23263cbbbc203ed1f48e2108443f688cc256155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513829, "uuid": "dfdb5348-44fd-4ec8-9742-70a3c0d5feed", "value": "T17EC31A54F946C0F1DC0B48B0A09BB73F8B30E63592229A94EF685F6ACB33D165717798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513829, "uuid": "44f26291-551d-4bf2-be3a-32e1c28c394b", "value": "3072:ykQhMxsn6pLfFfjYuhErxdJd2EVlabiPzP4j:ykQhy6ALxinUwzQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513829, "uuid": "97d99c6b-6d74-46a8-bcd3-f7e53f179ab1", "value": 120580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513829, "uuid": "68ad08a9-7325-4aee-82f0-7a80a9f30fc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513829, "uuid": "e019e1d6-45a2-47fa-8ba8-06d9e6e0fce2", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94289d92-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512831, "uuid": "f7efcbc5-bf4b-4625-b83b-32808260ae49", "comment": "Malware payload (WannaCry)", "value": "1a6a8bac6fa32599a5d446977079f3b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512831, "uuid": "001ef208-2958-4300-b541-aa04de930aae", "comment": "Malware payload (WannaCry)", "value": "f7f352508a5f0bd33e7cdb71b4cc1d3743dd7e156c864a84c3070b144c9f8869", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512831, "uuid": "fbedac1b-4fc3-4744-aa38-ecd0b605bae7", "comment": "Malware payload (WannaCry)", "value": "ec26bb7dfec62fdd8f2adebe009d4fc90b7c332f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512831, "uuid": "1ac5b1ce-6c60-4d9c-8366-27228b014e3f", "comment": "Malware payload (WannaCry)", "value": "054c8adc4e6fc27f63bac555d0ee2844ae3d966159badea0e39d2b429b7e505da0745e9f4b56c91f50b2e7053f5e8aa9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512831, "uuid": "72f9319c-111e-470e-a662-48cb00fb6b9c", "value": "T199362395766C81FCC206167090B78A26F2B7BC7E11FA4B0F9B508A352C53B91BB64F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512831, "uuid": "2b75cb04-a82e-4bba-9b2b-a1adc8f8db6e", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512831, "uuid": "12ef874a-e6a0-4a18-b922-971969b9e93a", "value": "24576:RbLgurihdmMSirYbcMNgef0DHzoAdNLTSk+RdhAdmv:RnnMSPbcBVD3N3ARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512831, "uuid": "8e30ed4e-7afc-4b28-9637-007a0d7a45ad", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512831, "uuid": "d567b188-adfd-454c-8e4b-168f38393fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512831, "uuid": "5fc8f38f-d395-4bc9-b90e-ae1bda64f21a", "value": "f7f352508a5f0bd33e7cdb71b4cc1d3743dd7e156c864a84c3070b144c9f8869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bdec58-e9ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767558179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558179, "uuid": "df27ea73-0a12-451d-a016-4578cd9688c3", "comment": "Malware payload", "value": "cdca4428337fda33b236ebdfdb11e16d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558179, "uuid": "4f87381b-b657-478e-9f6c-1587b2c8f647", "comment": "Malware payload", "value": "f8ba24dedf301a50a7a7325bc3b26c9e5956c62507c54116f32c85c3d18f1b0e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558179, "uuid": "167ae0e9-228d-472e-8600-b67f86883a0a", "comment": "Malware payload", "value": "0dd7df37962dffa3714678b13e8a5f1e37efc80c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767558179, "uuid": "3dcb3fd3-5189-49c6-9955-0b03e87683e1", "comment": "Malware payload", "value": "7e03d42bb26d7240d2030aa43f6048bce5683b42d509d96bac478befd8e20881ebf3918ea625981577ed614b0dff361f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558179, "uuid": "a7405d71-d354-4e0e-809c-5b13dccc2e9e", "value": "T107E62BA3EE545329CADBE23AD47166497230B185133111D7BFA907A58C4BBC8173BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558179, "uuid": "6f24c5de-4080-4db6-891a-ccb495db2cbc", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558179, "uuid": "466c7a7a-01cd-4aea-97d0-9803534a28aa", "value": "49152:qLs1wmGrb/TWvO90dL3BmAFd4A64nsfJ+5leBCuBlijJ1k0eYwBpSXVLaI4zEd2J:qL2fqKwo5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767558179, "uuid": "ad0a5873-8c46-4a93-912f-6d9c8f3eb3db", "value": 14988416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767558179, "uuid": "56a44f7b-a7ff-4159-941a-627d82f24b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767558179, "uuid": "d0f56482-c11a-4081-9c19-e497f7ac383c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a726d93-e952-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767520089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520089, "uuid": "4ec20fc0-7802-401e-8051-f565c44b34bd", "comment": "Malware payload (Mirai)", "value": "72f2098162d054fe3ec5005bc2b44362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520089, "uuid": "cc687425-b7b2-4cab-9278-65e241ad074e", "comment": "Malware payload (Mirai)", "value": "f8dd0cdec623c3852c474190565f1e9019f89673395ac720d33717d10a675bf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520089, "uuid": "f7fb3d9d-7293-4b48-8aee-3a1e97f958dc", "comment": "Malware payload (Mirai)", "value": "643f73bc3521dae1386884b2b6d319c81115c6d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767520089, "uuid": "b81367ae-1001-4fb8-ac93-e40ecf1f7865", "comment": "Malware payload (Mirai)", "value": "75c46048065c471a73ffa0f9025ecbcbaf79997f56dd0ac553ecc75a297b89ad3edcfd11f5316b00b06d15baad72fd96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520089, "uuid": "849ca201-ba84-473a-842d-305818f76c87", "value": "T1F3638E21C578ADA0C5444AB0BAAC9DB44743A404A6E77EF2CB81CF59540BAFCF145BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520089, "uuid": "8b7301ce-f303-43b8-952f-b95fd8124305", "value": "1536:N/6I6pJwtIkUmIijwlphtdmJeHyWr66Nha3q9g1CYqJP:NyIoJGUbijQYeHkEha3q9g1IP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767520089, "uuid": "0950d5c6-9f85-4937-835f-3a1381df80c1", "value": 72316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767520089, "uuid": "01c719d4-6a00-4c3a-9483-7756b3a5bbd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767520089, "uuid": "22b5d014-1e7f-48bc-8136-64cf92be0081", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1597183f-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567165, "uuid": "9f0a07a1-4332-4d29-9057-b8edb4b46dd5", "comment": "Malware payload (Mirai)", "value": "21a6320e27a045d299564d007949832a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567165, "uuid": "8c37d877-1c06-4e3d-a0a1-e343faf84f62", "comment": "Malware payload (Mirai)", "value": "f8f45807b488bf5cc522b74a1a8c4f4e983ac952b2ff1f2b4639e93f93b1e4c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567165, "uuid": "d0290ee7-dc3a-4402-b06c-60cff06023fa", "comment": "Malware payload (Mirai)", "value": "d9ff17cf3dd96e53bfb4e71c561a78712a2b5e6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567165, "uuid": "ece5ecb3-eb06-4dd9-81db-72f0bb6e355b", "comment": "Malware payload (Mirai)", "value": "ad0e17090fffe0adfc8bfad0838b496c285c38ca7553485a10243d085ccd6a499e7e9dd4a7ea9f34221ab887ef939f02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567165, "uuid": "94307671-922e-4123-bd20-7cb1bf0256f1", "value": "T119A3A91E6E319FBDF578873047B74B30939D63D623E19685E2ACD1141F6024E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567165, "uuid": "1531635f-ecf5-4f03-8f95-6cab9a7ffa7c", "value": "1536:X774B8PhdWllcoUuj12HAuGnNgkC5Wq9ebkZpz6BRFXcbfLvTe0n:hPVHArnK1WqNpz6BR9cfK0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567165, "uuid": "1b49ee4e-4af5-4ccd-9bce-298456c8e2e2", "value": 105668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567165, "uuid": "4d3fdf57-2cbf-4e8d-906b-d522e640d01d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567165, "uuid": "e758d0a9-0fa8-49bd-a196-fb529ad74ce3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b18d9a4-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511769, "uuid": "eb6bc392-1a3a-43a4-b654-df78c8debf1c", "comment": "Malware payload (WannaCry)", "value": "e1baffd5cbbc77e92b26d8d5546ed912", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511769, "uuid": "f159cca9-e2f5-4c42-8008-aa23712dd0a2", "comment": "Malware payload (WannaCry)", "value": "f99566563fecac227e55fffbc5acb6d371abdaf77db2671d1aac16febafd7f2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511769, "uuid": "541cdc20-c148-4483-9c41-84f7d3f86ee5", "comment": "Malware payload (WannaCry)", "value": "e459f6e0398b20727eee0f3a6e37e1428f2df226", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511769, "uuid": "adbcc63f-6c39-4cd1-a368-e29173c83c30", "comment": "Malware payload (WannaCry)", "value": "a58337a8be567313f8707c6ae710775230e2983b169c258e948228f26fe299dedfc52ab24dbc6d6a61183a7c775fcba8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511769, "uuid": "fb8b799e-d037-4f82-9977-832ec9677945", "value": "T1E8363359327CD2BCC109167464B7CE67A7B37C5A26BD5A0F8F008A661C43B59BFA4B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511769, "uuid": "55b68a2f-938f-43c8-9f8f-2212bffc40d4", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511769, "uuid": "f0365789-98df-4ce9-8dde-9d616edbcf28", "value": "49152:SnAQqMSPbcBVQej/1INx+TSqTdXeRdhnv:+DqPoBhz1axcSU4dhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511769, "uuid": "845a9267-1c2d-4d08-bdaa-f78936d331b9", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511769, "uuid": "909cd7fd-d5bb-4a28-ba2a-ff45cf9605b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511769, "uuid": "a02a2bd8-f1bf-47af-a0a7-ec2a4b8161f7", "value": "f99566563fecac227e55fffbc5acb6d371abdaf77db2671d1aac16febafd7f2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7a5808-e94a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767516768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516768, "uuid": "eca3e103-b593-48af-ae58-80d3782a655a", "comment": "Malware payload (Mirai)", "value": "1efd441b99226bef094c88d46bf190db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516768, "uuid": "9a4ca32d-3e02-4d29-a9f7-637d1ec710db", "comment": "Malware payload (Mirai)", "value": "f9a3aedd44ad088443dcd3d53aa3467f78a2fafe0d1ca73fc344795e7995a374", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516768, "uuid": "ba0d3081-0067-44c8-96c7-1d34c5555ef6", "comment": "Malware payload (Mirai)", "value": "95fba59d0a1d72cb0293c51bb189410d89296789", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767516768, "uuid": "479ad269-0b62-4981-87f2-97c08054470e", "comment": "Malware payload (Mirai)", "value": "831264066c052cb23bda433adb37b4ccd4dbfd6723075249cb838bd4a0c4902ffe76bf9688ef77362250e1cd7db2a44f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516768, "uuid": "4b0654b9-10ab-4fc8-bd03-008a3ca8a36f", "value": "T16E937DC5A743C4F5ED5621B8553BF7365A32E63A0039DB4ACB24B835AC26602F72739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516768, "uuid": "8c34f129-b7ac-497f-af0c-6cf69e11cb20", "value": "1536:GJ9DMn0YrcG1xtEqrotOoDyJab1mrh6ho+5v2LX+ojZxlShwztTZ6XgmpD:kM0nG1xCqrbQyJaxmrh6ho+5u9jZ3wUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767516768, "uuid": "37c117f0-722d-4943-8312-a845338c15fb", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767516768, "uuid": "de409389-1123-4a34-b42c-ef70c987c71f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767516768, "uuid": "09f0fe6f-fda9-437a-944c-5d1916a8d7e2", "value": "f9a3aedd44ad088443dcd3d53aa3467f78a2fafe0d1ca73fc344795e7995a374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4c8505-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513298, "uuid": "4ade4444-2a24-4695-807a-767844b34569", "comment": "Malware payload (WannaCry)", "value": "5265fc3146b7e3922c79ef463aaecd16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513298, "uuid": "8505d354-1d98-43b5-bddb-18b141096ad3", "comment": "Malware payload (WannaCry)", "value": "fa00d59535de04c6a7a582e6897073ed78e9c7fb4bfbf2ab3419b89b538f9117", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513298, "uuid": "c4e58a9d-e4e7-4a06-b8ee-1cf0960ddfc5", "comment": "Malware payload (WannaCry)", "value": "bc06658291907ae47eadd970e8f796a39868d7fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513298, "uuid": "e8589475-ef0c-4f1c-83f6-994906994e5e", "comment": "Malware payload (WannaCry)", "value": "a8fb659a9227a3a853e392f9954ca02914e3ea8da428e8deaf18beeef6f95a72ef1f0fa8a25b471fbcb31b740a9be245", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513298, "uuid": "a2ef5dd5-6fba-45ff-9069-c1de4906799a", "value": "T118363314571C92BCF0A508B448534A7DB7B77C28977A8B1F97D4C62A0E63B96AFE0F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513298, "uuid": "68c4a31c-abb5-4ae9-89c0-a8c40c0eb049", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513298, "uuid": "8d81f118-34d0-428d-a305-403371b7dca1", "value": "49152:JnjQqR6kQo6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAH:d8qR6k36SAEdhvxWa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513298, "uuid": "063acfd2-7e91-4d54-b0eb-12f1c9a2c6ed", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513298, "uuid": "78e561bf-9f78-45c8-89b7-3fee5ec798bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513298, "uuid": "c244c15e-682c-448b-b787-73097d4cea6b", "value": "fa00d59535de04c6a7a582e6897073ed78e9c7fb4bfbf2ab3419b89b538f9117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8d72f0-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512362, "uuid": "6775aa9d-f2bc-41e3-becc-2470967361ad", "comment": "Malware payload (WannaCry)", "value": "3f4f7d83fced7b6c37df1355e4b9afe0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512362, "uuid": "f50c3fc8-aac4-4bf7-a3f5-789ff03862f7", "comment": "Malware payload (WannaCry)", "value": "fa2bf9f93f6bea82d328147a29c356f03d9c88347ec60eb11c4bd783f04b517f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512362, "uuid": "e20f6ee1-9ce8-4613-a2e8-d94502ebd929", "comment": "Malware payload (WannaCry)", "value": "ddf30a29eb10298dc152fd57c86cd370e10e138a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512362, "uuid": "41145d2f-c57e-4e91-8307-c6d242b3d6b8", "comment": "Malware payload (WannaCry)", "value": "5a86c81e981c4fd386f1250785fe28ac77bd1ccac9eada27af5c3af11095a6f655972c761f4a132a039fe1b7dc7f84ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512362, "uuid": "5603224f-ddb7-4e30-b64b-cb28bf462ae9", "value": "T135368C1627FC0214F1F75F79E8B9485268B6BC07BD38D91D20511E8E0A22B55C9B2FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512362, "uuid": "871c86bf-ab4e-444b-9f4d-4689c54a79df", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512362, "uuid": "9cd6671c-9f5a-48e0-a3a3-e06fd48a771a", "value": "24576:JbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz66:JnjQqMSPbcBVQej/1INR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512362, "uuid": "49bfa6cf-50bb-4774-875b-4f158c802ad4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512362, "uuid": "55dbf082-0e24-4008-b00a-2ea72c6de7b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512362, "uuid": "72c4332c-1515-4008-933b-cc361d8aeafb", "value": "fa2bf9f93f6bea82d328147a29c356f03d9c88347ec60eb11c4bd783f04b517f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842154d4-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511945, "uuid": "0d0517aa-8673-458f-96a2-e04189b71942", "comment": "Malware payload (WannaCry)", "value": "5818d137c6c7324aa05a01c8c3cfe9d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511945, "uuid": "20b99c2e-e1f0-431d-abf6-66fdbc7462c6", "comment": "Malware payload (WannaCry)", "value": "fa40bdbdd5305d4fab585b65633e7c27b36ef79ccf51983f8e41ac3573ebf944", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511945, "uuid": "164b98f0-f0b5-4609-b629-1986d6dcb968", "comment": "Malware payload (WannaCry)", "value": "58a75425a9e7331de5f9d62d74d5ab063df90996", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511945, "uuid": "25916674-7b44-49ad-a8a3-886a50e586c1", "comment": "Malware payload (WannaCry)", "value": "871361810168ffd1dc912ec4bb2070e16ae4345a864f70acd743f2075f3386c1193ca7ab9a8463a9df6f82c8a00ec401", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511945, "uuid": "bf65cb0a-14e1-4046-8bfb-62c96a0b7363", "value": "T1833633A4622CA2FCF0450EB44463895BB7B33C69A7FE5E1F8B8046670D43B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511945, "uuid": "6ac43eea-77e0-4e17-b15c-27bdd9b9f2a0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511945, "uuid": "44ec2e51-9926-4b70-a4de-d7a32d448153", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2P:d8qPe1Cxcxk3ZAEUadzR8yc4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511945, "uuid": "3a2c5345-2bda-4e62-9087-d8183aadd2ac", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511945, "uuid": "c73240b2-8ab7-4bf4-9c49-cc138e8f20f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511945, "uuid": "8147c7ba-4e06-450f-88a3-97d16e51cf82", "value": "fa40bdbdd5305d4fab585b65633e7c27b36ef79ccf51983f8e41ac3573ebf944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed17d8b9-e9b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767561513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561513, "uuid": "5414fa33-fe00-4060-8c94-81bcd276525d", "comment": "Malware payload", "value": "e5af968bd5c5d662e3f60ccbfc4fdc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561513, "uuid": "821413e6-c608-4bd4-9c02-c49a72899ad4", "comment": "Malware payload", "value": "fa91fcdad9ec4e01323a34a49266fce0bebf4abe9d73ba51a2a66ac9c2a870ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561513, "uuid": "47fa1030-5236-45de-a3f8-68f0b1e8fdf7", "comment": "Malware payload", "value": "fb28bb23897c0b0453658b5f710c2cc8dec78cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767561513, "uuid": "0c1a57f7-05e8-4e7c-aa3c-1ce23f27776f", "comment": "Malware payload", "value": "b35a538ff7f6ea2fa39a9ab1711f01a41b81bcfd9b44190518364633b16106a9ffb35fe36871690186ada7e2173f5e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561513, "uuid": "04e4e01a-f31c-413c-8f10-fc99841e3498", "value": "T1ED863983AE948329C59BD23DED71A1457230B045533513D3BFA34AB29DCBBC4973A72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561513, "uuid": "6d925a8b-0baa-4f66-974b-d1fe600ac73d", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561513, "uuid": "39a8f05e-5209-4352-9c65-938a9dc3d34d", "value": "49152:ljMsEBrb/TRvO90dL3BmAFd4A64nsfJW1RnuUMTh3AfR8Gom2jSpd2FwjNb6QcQo:ljUTuo9qMaLVFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767561513, "uuid": "2187d5e6-257c-45c5-995f-5fa134d1de9e", "value": 7931520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767561513, "uuid": "e7adb1b3-e53f-4554-a8e0-d5394f08fe9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767561513, "uuid": "e1b836d3-455b-43e3-8b8d-b44afd2d794e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e7a7a6-e93f-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767511807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511807, "uuid": "404600a9-1ffe-4f8e-ae4c-358149295e8f", "comment": "Malware payload (WannaCry)", "value": "33d373e264dc7fdb0bcdbd8e075a6319", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511807, "uuid": "3fad0d27-e722-4d92-b8fe-14225c81f92b", "comment": "Malware payload (WannaCry)", "value": "fade02b958b99c08787e13ba1117164bac6ba8ed27740cd590b5beed188fe540", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511807, "uuid": "4ca13f74-e60e-46b8-9adc-c4b6c1e192d0", "comment": "Malware payload (WannaCry)", "value": "918ffd174ee2c58494c00392c2268da43693c603", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767511807, "uuid": "4512be88-0a0d-4f5b-b812-bd74ebb8a69b", "comment": "Malware payload (WannaCry)", "value": "5ebeadce9a4ca26e47d10e38f0b8fdea21bfbe6ce465856f1e26252b5f8486de029c71df61a4b6fe82231422575a33fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511807, "uuid": "f27de4e3-d317-42a5-84cc-44804ad1c3cf", "value": "T109363359717CD2FCD10A19B414A7CA67A3B33C6A16FE6A0F8F4089661D03B59FF90A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511807, "uuid": "7fa5f32c-fd19-4424-875c-e7487fb973d3", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511807, "uuid": "65d54db6-9b89-4a18-b8fd-b7b13e64af7d", "value": "49152:RnxQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:16qPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767511807, "uuid": "53654032-422f-4e0c-b6ee-9f8e1acea8e8", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767511807, "uuid": "71772804-540b-4aeb-b1dc-4d5b0bf1f7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767511807, "uuid": "a77fd9cc-560f-4dab-aef0-69dd373b7cc0", "value": "fade02b958b99c08787e13ba1117164bac6ba8ed27740cd590b5beed188fe540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77b2d19-e997-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767549881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549881, "uuid": "9558d3d7-cd64-4f53-8442-d877c39969cd", "comment": "Malware payload (LummaStealer)", "value": "5242c1a113b61f4a7c11be5ea6c576c5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549881, "uuid": "d92e5c84-4a33-476c-9116-6fee66dbf2cb", "comment": "Malware payload (LummaStealer)", "value": "fb55670b7175f3f3e0e778328ca331ed30057a9dce93e70aca8e5489b422dea7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549881, "uuid": "a3182ea9-6f80-4f5a-b73c-206cc05ee5fe", "comment": "Malware payload (LummaStealer)", "value": "0d154f64c524cb6f04e6fa7bd058adeabffa2ea8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767549881, "uuid": "295ffc70-caec-492b-9cfb-e71c4b32d8f0", "comment": "Malware payload (LummaStealer)", "value": "94f66428adca034cb6a00a2c3db7ffcbb1e9f49c691c494a81003a726e321bf2bc1b7ac40f0eb11410b175e9c52eed21", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sosokenota", "colour": "#7CB0D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549881, "uuid": "ca8829c7-98a8-4e78-a046-d82aead949e8", "value": "T118552312C7DEC173ED7227B068F644C3092ABC829A79C65F7686989E5C727568C3037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549881, "uuid": "df435fae-ef27-4a30-b159-8fa40bd1ee74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549881, "uuid": "737fa6ca-04a5-4dde-9a1a-e1ab06a89b50", "value": "24576:QonOYu3hTe2OvAG4VunKCSbBIjeHiXH79LTTt/p4N1m:zOYG6224tCveCXtTtp4N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767549881, "uuid": "01973d6f-bd22-4c39-b7cd-1da7a79af92f", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767549881, "uuid": "f5ba505a-503d-4c0f-81a0-ea5cbcc09323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767549881, "uuid": "9f95739a-0b32-4967-9078-3f4f9f58a059", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d14b26-e937-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767508460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508460, "uuid": "94bf9d70-ea18-4ef8-9af5-2ec19dd281fc", "comment": "Malware payload (Mirai)", "value": "4ad57311651df8a289c1c401b717db6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508460, "uuid": "8f4a92e2-ed7a-41b2-8744-3901c84ba8f6", "comment": "Malware payload (Mirai)", "value": "fb6455974b9301657f973358fc3408a1e8b913c1eddee8177cdeb85032515c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508460, "uuid": "284e4194-23cf-4818-aa46-ffac88ed9bae", "comment": "Malware payload (Mirai)", "value": "016c6aeba1067a6e59dda778c3b07233f5fd0358", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767508460, "uuid": "f591ba82-3563-404a-8e2d-23f970d5659b", "comment": "Malware payload (Mirai)", "value": "e2b67ea0d920ec2e260e7d03dbf19c22927f83d7fd8bb91b8ae5aae84228a6978efece18c3a204a7ac6396d38fab2119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508460, "uuid": "9efc5df1-bb66-4e69-81e8-ebebd215a24e", "value": "T12F057CC9EB87E0F1F26300F1025EDBF64538A12A5013F6F6EF452A6674727616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508460, "uuid": "69ab2df3-9fee-4f96-b6f2-a0bd771175e6", "value": "12288:GRVzPVPhQ8hGvQvwH95A6htjkrZTBVVWAvu0XgywECPvCPyMDWw9FL8Lu:GRVhhQ8hyxH92KjK17WAvua6NPaWw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767508460, "uuid": "2befc7b3-e91d-4519-927f-ce0957c59d7e", "value": 857176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767508460, "uuid": "f8488583-fc68-45b9-a838-dd2b57c0f505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767508460, "uuid": "c8fb6617-0abf-4cf8-a2d6-d36732e2a974", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a455b3c-e940-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512224, "uuid": "42213586-8a27-4563-ac1d-dc2718442fec", "comment": "Malware payload (WannaCry)", "value": "95ae8e32eb8635e7eabe14ffbfaa777b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512224, "uuid": "950abf3c-4bcc-43dc-b4f1-6bd38755a20f", "comment": "Malware payload (WannaCry)", "value": "fb648bfb485f910e065cc18778364a56be32044d1ac4729449f3cc28221b12e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512224, "uuid": "db74db67-db34-4ae7-8d04-92c3e055e2d1", "comment": "Malware payload (WannaCry)", "value": "d5872c3f694a9e23c0583c4ae3e5c59eab26c021", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512224, "uuid": "541dbb96-a50e-4596-948c-7787f3243de8", "comment": "Malware payload (WannaCry)", "value": "4ca2ff276370643be1bf5c195a5473de2578249419a106e1f32c7e78fdbbd38ae85383de5c36d3734586a8b56f70b841", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512224, "uuid": "501d9e0f-f859-48e1-b011-56240548b492", "value": "T14E36339971BC91FCD20529B484BBCA23B2B23C6D26FE6E0B9B4049751D43F56F790B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512224, "uuid": "76521765-d170-43e2-b217-429a8df3fe04", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512224, "uuid": "b627a803-dd25-4822-8519-8c81d00e8705", "value": "49152:RnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1nPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512224, "uuid": "6126a5c4-a2e5-41b4-a43c-e473a5cebbda", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512224, "uuid": "83c7bf61-1fef-47e8-b1f8-29114ab3f6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512224, "uuid": "ec97ad72-a2c2-4489-98af-910ec5a63087", "value": "fb648bfb485f910e065cc18778364a56be32044d1ac4729449f3cc28221b12e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6d2acb-e94d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767517811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517811, "uuid": "5db84c95-73f7-4873-b7ac-32bb036339e9", "comment": "Malware payload (Mirai)", "value": "d5f8b26ae79d8a5bd8cee0034b4180e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517811, "uuid": "5ffd77d4-01cc-41bb-b1e3-e457dd301aa7", "comment": "Malware payload (Mirai)", "value": "fbc145c2d4f398cc70adc58e0473967e82e038669bc8d46733ce87a150b17a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517811, "uuid": "24145c89-622a-43c4-a9fd-147b1da131bd", "comment": "Malware payload (Mirai)", "value": "c8a544e4797c4d1684ef1168ccd1c2773c68e1ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767517811, "uuid": "527eb090-41f0-4220-baf5-77ecfea6b59c", "comment": "Malware payload (Mirai)", "value": "90793d197a6e198a89304b223d35323b283ec419e7bfd7b120fe4dbcdb4129d4a3147991b2445b71b55cf9e9c742c2ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517811, "uuid": "0aa4baf0-a241-40c3-be50-de31d77bc86d", "value": "T190E3F852A951CF12D0C311B9FF5E525937136F78D3EE32029D24BFB0278A8EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517811, "uuid": "2b410a1c-fd75-4e09-954b-cae927c477ed", "value": "3072:WMMtJdgQXXeeHreaGeMnffZT9rVJM+ksPPBgLv:WttJdBXLHCaI99rA+kQGLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767517811, "uuid": "7e6f061b-39ce-4384-89f1-e168468d9128", "value": 154588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767517811, "uuid": "5681b0e7-e8c9-4a3b-881d-713e74857aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767517811, "uuid": "2a2f3a91-59fe-4bd3-baf0-459b8264dfff", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82669044-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567347, "uuid": "5edf0775-cf51-4ec4-8dff-b2600b0d207e", "comment": "Malware payload (Mirai)", "value": "64a90337947bb10704d0fd09311dfb3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567347, "uuid": "28d02065-d998-490c-aab6-f53d0e308bc9", "comment": "Malware payload (Mirai)", "value": "fce43a96448cf52f1ff6c6f3a7067c1c4733b573d20f5ff1725ba821af7af4e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567347, "uuid": "a34347f6-78d1-4c86-b8a0-97494c0f73c5", "comment": "Malware payload (Mirai)", "value": "c52bca3d11654321dfb6686026ce26dc7934bfc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567347, "uuid": "dcb12adc-60e5-477d-802b-c86286917a62", "comment": "Malware payload (Mirai)", "value": "43ef19974641861623e88b827b96a1ffeb2867213a3f82f041f15feec439c650f30f2f95a5e36e5cc02393d1615709bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567347, "uuid": "7f8ca2e0-81b3-469c-8861-059f7898336a", "value": "T141333B21AD7A2E17C0D1B87A62F74724B2F6578A21E8C71E7D720E4EFF109C061676B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567347, "uuid": "cdcb06e2-8048-44d2-8d95-e9434794f8c3", "value": "1536:ewl2tSukgAHAqxF7z81llSq2LQR8YoTm9:eA28ttzeV2S8YoTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567347, "uuid": "5b73e956-74b6-4e93-a97e-f8964321c496", "value": 54608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567347, "uuid": "823fc4ef-0112-414b-856b-f9e8819948bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567347, "uuid": "8859307e-1aa9-485b-afa7-fb79c875f653", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116fccd3-e9c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767567158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567158, "uuid": "b39ea3f3-bce9-41c3-a635-bb27ecdfeeaf", "comment": "Malware payload (Mirai)", "value": "18874331f33e6c3a0a59eedda505904c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567158, "uuid": "030951f9-c052-44f4-95b2-abeb73280980", "comment": "Malware payload (Mirai)", "value": "fd090d33574d8c408df9c1fea4de2e519ba320629069287684efdb0815339dc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567158, "uuid": "2d110a71-242a-48a1-ab2c-d4cc934ec098", "comment": "Malware payload (Mirai)", "value": "223098956801aa688134e53f1788016a406c2842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767567158, "uuid": "b64b044d-0560-4358-8412-9c8fb78c847d", "comment": "Malware payload (Mirai)", "value": "f1b4494bfa7664429cf6804b27e59ff29ce67d0fa4f609f9ef38f8a7fde840f137ec5d4b10f446fb51671ef02b04651d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567158, "uuid": "942b7bb2-2d15-4762-84ea-9e2c449524ff", "value": "T170B2D03C1B111B98EA1EC0BD43AD5B613CB41B3591829D4B6207FDD79F5A8B43453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567158, "uuid": "e1bc81d7-6f4b-4fe4-a932-ad672c1a39b6", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiQ7mdtJgGlzDpH7uNj1JA8:YeD8ZSWvZHZbs1row697qohQvg9Q7itg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767567158, "uuid": "da529eef-e3a6-45a6-985a-69225b24851d", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767567158, "uuid": "e442947e-084d-4a7d-bc15-69b946ba590a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767567158, "uuid": "be7fb1a5-00a5-4440-b931-a74bdec163c8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85fb568-e96f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767532622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532622, "uuid": "2c64d480-92ef-4650-815f-6e5ec01b2b64", "comment": "Malware payload", "value": "e617a345cdab3923017101407ab17ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532622, "uuid": "62d1f684-6bf7-4de0-aa19-3408959806cd", "comment": "Malware payload", "value": "fd5c0a64d2e0e39d876ebdd2f8663b7eb24d1444a33dda0b3cbf70d2eb2c1751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532622, "uuid": "9e7e6d49-ad7b-46d4-9bcf-4c0ac3b41d9e", "comment": "Malware payload", "value": "a5f9a263930f8cd13426b62ff849f958618f8ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767532622, "uuid": "0384c70e-e6ae-4b87-821d-a9758d2d8c12", "comment": "Malware payload", "value": "311bc7bc9debe7d88270b30ac75b2c7457429b3885d87edee74c95b8f443d0510e42a10eb83a1a9b1927486786b4228d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532622, "uuid": "f815c442-6ceb-4605-b93a-7485d2538d60", "value": "T1A30833B240E3081BE0A2E87676B7CD744E494C8AA696D3FBCECD57857D25083A43D7D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532622, "uuid": "bd74a684-d1f2-418c-801c-0bc0d3464687", "value": "1572864:DBh62jcLKOL16eMhtxLu7L0tPmTtygNNXnoBEpBTLM52pF35:1djcLFLapu0teIgNNXoB6TYMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767532622, "uuid": "93cfcf89-575f-45df-bfa3-259b1bc6b45c", "value": 78759936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767532622, "uuid": "ba1bb82d-0aed-4ef2-84a4-1bf067bdcb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767532622, "uuid": "d9f2f8e9-cc1b-4aa2-bc23-540faf3f58e6", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2904cf8-e939-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767509554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509554, "uuid": "20eda704-003b-4236-b8a7-c13eaffba1b3", "comment": "Malware payload (CoinMiner)", "value": "057594dde3b8112d18bb0c9beabd9ebc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509554, "uuid": "e4dd85fb-088e-4404-89ab-32b081aac152", "comment": "Malware payload (CoinMiner)", "value": "fe0e1254200be2c04d0c61f3e529387ab6e1c19591f68230b4d28ab64bad043d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509554, "uuid": "eec6899f-c84a-4fda-9e4a-ab528fe21b91", "comment": "Malware payload (CoinMiner)", "value": "d12946d01cc6e4a0c63055b99db1abd88021abd5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767509554, "uuid": "b3c0cea3-f475-4c2d-91db-8a4ff83d065c", "comment": "Malware payload (CoinMiner)", "value": "f6d3d26900a68e8df5c7c2f8da3cbc482cbac2fdb62fe198807eed2c2a565f481177330198e1051f5a1c9b87dae93332", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509554, "uuid": "a975bc0b-71ad-4c0b-ab09-3c43429254cc", "value": "T1C3D5331200C3F97F95DAD9D448FC7B350D6B51F0A7681622BE6A0425BC32EF641EBA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509554, "uuid": "d1dfdfa8-925b-424e-8b51-da4931acb5ae", "value": "49152:G3LolhQAr0hNW188rJTQ+p8CU0r0/ZNqqHy2dd1cuw3llqi5RTh4jC:G3LG658+S8YrCpHy2dUu4KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767509554, "uuid": "7d66cde7-8a4d-4641-baf5-166b0cd2e32a", "value": 2928640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767509554, "uuid": "9841afaf-7ae2-4d95-b538-8256f5b98d25", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767509554, "uuid": "fd6d102a-fdfc-4c05-88a7-e590aed762d5", "value": "fe0e1254200be2c04d0c61f3e529387ab6e1c19591f68230b4d28ab64bad043d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d437c7ba-e941-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767512939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512939, "uuid": "7a5e2a92-b484-4f06-b97e-67ae4a16a2ca", "comment": "Malware payload (WannaCry)", "value": "95afc822015843b74d588ce1f3c39e43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512939, "uuid": "18ecffb1-740e-4835-8c85-938ff1730da5", "comment": "Malware payload (WannaCry)", "value": "fe17f27ea3a8a8c0e02e9728779227c247b11753674d0552301283fca8d5c7fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512939, "uuid": "fb236d95-e08c-47f6-82f4-8184e1f188d0", "comment": "Malware payload (WannaCry)", "value": "4f9317f835874595b6eb3d14c7e45821751ff1cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767512939, "uuid": "6a87b444-3594-4a85-9977-80de6c58005d", "comment": "Malware payload (WannaCry)", "value": "bda25d054c1d5f01c71ff3b3c502584675d124abadd3f053e56d2186a5ebce14f2d3222a982e002b7eede043bbce3a9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512939, "uuid": "b47a5f94-af72-4e02-8abb-1f154e4b227e", "value": "T1A6363360112CF6DDE1575BB004A3D679ABB63C37AB7A6A0F67408AD60C1263FFD90607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512939, "uuid": "ca69f132-7a0e-47f4-9b5d-2f6371be235f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512939, "uuid": "62f86107-21c5-4a80-8a79-dd4b26ab485f", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8Vj0:+DqPe1Cxcxk3ZAEUadzR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767512939, "uuid": "d2e510bb-1a9c-493a-8695-cb0ae484b19c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767512939, "uuid": "1008eecd-547a-4e41-9e0b-2acb28ed66c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767512939, "uuid": "4ef32765-4bdf-4883-a18d-e62f931e4cdb", "value": "fe17f27ea3a8a8c0e02e9728779227c247b11753674d0552301283fca8d5c7fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c313f87-e942-11f0-a129-42010a9c0007", "comment": "Malware payload (WannaCry)", "timestamp": 1767513274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513274, "uuid": "0c1fa6e3-96ff-4766-988c-de1de341b6ec", "comment": "Malware payload (WannaCry)", "value": "e2739e0b80c60f40e8b0c43ba70ff844", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513274, "uuid": "0b43d0d1-cd2e-4b40-aa87-956899bcf7aa", "comment": "Malware payload (WannaCry)", "value": "fe3bead418d34802cb8437b0014ab510f2fac9a26c1a470741145543882bb90d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513274, "uuid": "b78f29e9-b28a-42b8-bf38-cbedbddbff9e", "comment": "Malware payload (WannaCry)", "value": "a5f7988b28633f1c19ce6b745b565979ccaf40d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767513274, "uuid": "741931f4-d083-4e47-a1bc-f0dd341061a2", "comment": "Malware payload (WannaCry)", "value": "58509444b00030ef5d4820918e9f9716495e8470ec8e7c8491a0efa0466972ae7167373564a7a2c2f2d55b0bb2d1779f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "eternalblue", "colour": "#8A1C1C", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513274, "uuid": "5c4361a8-743d-4132-aa73-b4d16227d6c4", "value": "T1A43601838007156CE059C971C1EE4B91D9372EA57A6DB08E6F13FA4A2BF36D3B592D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513274, "uuid": "4f1ce28e-54a9-4e12-a4ff-81806e86a378", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513274, "uuid": "7a165bbc-c8e6-4260-859f-af08b7dc51dc", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAw2v2:d8qPe1Cxcxk3ZAEUadzR8yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767513274, "uuid": "203052f1-4893-49ed-b0ba-efb3635d0e9d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767513274, "uuid": "a33fd481-ee79-423d-8462-d4947eb8f8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767513274, "uuid": "6985eab3-4f82-4048-bb75-5786b17dc8cc", "value": "fe3bead418d34802cb8437b0014ab510f2fac9a26c1a470741145543882bb90d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebf3108-e9a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767555127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555127, "uuid": "ad338d1d-04b1-4eee-bc27-388ae2669143", "comment": "Malware payload (Mirai)", "value": "522b32671cec95ee84ab6f500577b499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555127, "uuid": "d60edfaf-e76d-4690-befe-cf62f8d17141", "comment": "Malware payload (Mirai)", "value": "ff7f18f4d1b85a174a42324d07b819dc269cc1a434090a733de29251a19aa0b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555127, "uuid": "feb47558-719d-435b-8ee3-d6af2a542db4", "comment": "Malware payload (Mirai)", "value": "fe339439feaab12213dd346c3a3bff067ad6f1cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767555127, "uuid": "b2d8bca2-48ec-4569-a3f4-7397896a8e49", "comment": "Malware payload (Mirai)", "value": "4a001793d58f26f706b3de4c9f80ee7d1646d1e1dae3a5dda120689d9f2c48ddb250942af4de30a53d330ef81cbba128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555127, "uuid": "75ad54d7-d4c9-4c61-9eea-01a557b8f3e9", "value": "T1AD244B02771D4E43E1532EF0263F1BE083AEEDA528F1B584691EFE855271EB22485FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555127, "uuid": "058e6095-1a44-4294-8aeb-20860ea410c4", "value": "3072:jx62BiApnKvJaydXPONUmZ9e1HNsCgxOJRBA5zo+Ssalx/KEqc:Q2ZpnacQP+he1tZgxOJPA5zo+3Kqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767555127, "uuid": "93b11cba-9e6f-4d73-a34f-f2704828d8d3", "value": 225636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767555127, "uuid": "bfcb7e1f-a630-4713-9765-5713382b8e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767555127, "uuid": "0a8d4241-c589-4499-b3c0-b36f1dc9b5c3", "value": ".p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }